Age assurance: eID, wallets and age estimation compared

Last reviewed: 5 October 2026 · Not legal advice

Choosing an age assurance method is a trade between certainty, user effort, privacy and cost. A national eID or a wallet age proof gives a date of birth or an over-18 answer backed by the state. Facial age estimation needs only a face and takes seconds, but it returns a range, not a fact. A document check with a selfie works for almost anyone with an ID, at the price of more steps.

Age assurance methods compared: the decision table

The EU guidelines under the Digital Services Act (DSA) split age assurance into self-declaration, age estimation and age verification.^[3] Self-declaration is not an appropriate method in the EU, and a tick box is not highly effective in the UK.^[1][3] That leaves these methods.

Ofcom also lists open banking, mobile network operator checks and email-based age estimation as capable of being highly effective.^[1]

How accurate is facial age estimation

Accuracy is usually reported as mean absolute error (MAE): the average gap, in years, between estimated and real age. MAE is not a pass rate, and an accuracy percentage means nothing without the dataset, age band and threshold behind it.

Australia's Age Assurance Technology Trial ran 28,514 facial image tests across 13 estimation vendors and found high accuracy outside threshold buffer zones such as 16+ and 18+.^[7] Its authors call it "a fundamental misunderstanding" to test estimation against an exact age limit "without either accepting there will be a margin of error or applying a buffer age".^[7] According to Biometric Update's analysis of NIST data, the top algorithms err by about 1.25 to 1.55 years for ages 0 to 17.^[17]

The challenge age and the buffer

Because estimation errs by a year or more, nobody sets the cut-off at the legal age. You set a higher challenge age, pass users estimated above it, and send everyone below it to a second method.

Section 4.16Ofcom, Guidance on highly effective age assurance

"Where the age assurance process used on the service involves the use of age estimation, the provider should use a challenge age approach"

Source: Ofcom, 24 April 2025^[1]

A user estimated under the challenge age "must then undergo a second age assurance step", and Ofcom cites the retail "Challenge 25" practice.^[1] NIST publishes Challenge-25 results next to its accuracy figures.^[10]

The waterfall: estimation first, verification for borderline cases

Australia's trial names the design: "Sometimes referred to as a 'waterfall technique', this process begins with a low-friction method (e.g. age inference or estimation)." If the result is inconclusive near a threshold age, it escalates, and may end in a full documentary check.^[7] The EU guidelines ask for more than one method and a redress mechanism, which a waterfall gives by default.^[3]

The age waterfall, as described in Australia's trial and the EU guidelines.^[3][7]

The order matters for cost and drop-off: users who clear the selfie never see the slower step. Ofcom found that 65% of checked users on porn services, 70% on dating and 83% on social media were 18+ between July and November 2025.^[2]

What the user sees

A good waterfall feels like one short flow. The strip shows the borderline path.

Wallets and the EU age app: proving age without identity

The Commission's age verification blueprint, first released on 14 July 2025, is a mini-wallet for one fact: the user is over 18. Its second version, of 10 October 2025, adds onboarding with passports and identity cards as well as eIDs.^[4] "The proof of age itself does not contain any identity data", and proofs come in batches for one-time use, so visits cannot be linked.^[4]

Simplified from the EU blueprint.^[4][6]

France, Denmark, Greece, Italy, Spain, Cyprus and Ireland pilot it inside their national wallets during 2026, with zero-knowledge proofs as the mandatory presentation mechanism.^[6] On 29 April 2026 the Commission urged Member States to roll out the age app by the end of the year, standalone or inside the European Digital Identity Wallet.^[5] Under eIDAS 2 (Regulation (EU) 2024/1183), each Member State owes its citizens at least one wallet by 24 December 2026, and the Dutch wallet will let a user share "only whether someone is over 18".^[15][16] More in age verification with EU eIDs, the EU age verification app guide and on the EUDI Wallet page.

Age assurance rules by regulator: UK, EU, Australia, US

The regions agree on the direction (more than one method, a buffer for estimation, minimal data) and differ on detail.

UK. Ofcom judges methods on technical accuracy, robustness, reliability and fairness.^[1] Over 69 million age checks ran across 32 analysed services between July and December 2025, with facial age estimation and photo-ID matching the most common.^[2]

EU. Estimation may stand in for 18+ only while verification is "not yet readily available", and not beyond the first review of the guidelines, due within 12 months.^[3] Whether that review had happened by 5 October 2026 is not confirmed in the sources we checked. Italy's rules apply to sites in other EU Member States from 1 February 2026.^[14]

Australia. Platforms must take reasonable steps to keep under-16s off, with fines of up to 49.5 million Australian dollars.^[9] The government's trial assessed more than 60 technologies from 48 vendors.^[8]

US. The Supreme Court held 6 to 3 that Texas's porn-site age verification law "triggers, and survives, review under intermediate scrutiny".^[12] According to Pearl Cohen, the Fifth Circuit stayed the injunction against Texas's app store law; according to Loeb & Loeb, Utah delayed its law's main duties to 6 May 2027.^[18][19] Check each state's current status.

1. 24 April 2025Ofcom guidanceHighly effective age assurance defined.
2. 27 June 2025US rulingTexas age verification law upheld.
3. July 2025UK and EUUK checks start; DSA guidelines adopted.
4. 10 December 2025AustraliaUnder-16 social media rule applies.
5. 24 December 2026EU walletsEach Member State owes a wallet.

Milestones that shape method choice.^{[1][2][3][9][12][15]}

Privacy, data and ISO/IEC 27566-1

ISO/IEC 27566-1, the international framework for age assurance systems, was published in December 2025.^[11] On data, the EU line is short: "Age verification should not entitle providers of online platforms to store personal data beyond information about the user's age group."^[3]

• Store the age result, not the document image.
• Prefer methods that share only an over-18 answer.
• Publish your false positive and false negative rates.^[3]
• Offer a second method to anyone refused by the first.^[3]

How Didit helps with age assurance

Didit runs age estimation with a document fallback in one workflow, and national eID sign-ins as shown on the eID verification page. Age estimation costs $0.10 per check and runs with passive liveness. By Didit's own figures, its mean absolute error is 3.5 years overall and 1.5 years under 18.

Adaptive Age Verification ends on the selfie for a clear pass or fail; a borderline result moves to ID verification, with the document portrait face-matched to the age selfie. An eID sign-in returns a signed date of birth, so it proves age without a document photo: MitID, BankID Sweden, Finnish Trust Network, Smart-ID and Mobile-ID are live, and EUDI Wallet acceptance is coming soon. The design we recommend is estimation first, then an eID or a document for borderline cases. See the age verification solution.

Frequently asked questions

Sources

1. Guidance on highly effective age assurance (Part 3 services), Ofcom, 24 April 2025.
2. Report on the use of age assurance, Ofcom, 15 July 2026.
3. Guidelines on measures to ensure a high level of privacy, safety and security for minors online, C/2025/5519, European Commission, EUR-Lex.
4. Commission releases enhanced second version of the age verification blueprint, European Commission, 10 October 2025.
5. Commission urges Member States to roll out the EU age verification app, European Commission, 29 April 2026.
6. EU age verification solution, technical portal, ageverification.dev, read 5 October 2026.
7. Age Assurance Technology Trial, Part A main report, Australian Government, 2025.
8. Albanese Government releases Age Assurance Technology Trial findings, Minister for Communications, 31 August 2025.
9. Social media minimum age, Australian Government, Department of Infrastructure.
10. Face Analysis Technology Evaluation: age estimation and verification, NIST, last updated 29 September 2026.
11. ISO/IEC 27566-1:2025, Age assurance systems, Part 1: Framework, ISO, December 2025.
12. Free Speech Coalition, Inc. v. Paxton, No. 23-1122, Supreme Court of the United States, 27 June 2025.
13. Technical guidelines on age verification for the protection of persons under 18 from online pornography, Arcom.
14. Tutela minori: age verification, AGCOM.
15. Regulation (EU) 2024/1183 (eIDAS 2), EUR-Lex, Official Journal of 30 April 2024.
16. ID wallet, Dutch government, NL Digital Government.
17. Beyond accuracy: what NIST's latest age estimation results mean for age assurance, Biometric Update, 14 August 2026 (secondary).
18. Fifth Circuit stays injunctions against Texas App Store Accountability Act, Pearl Cohen (secondary).
19. Update on Utah app store law: another waiting game, Loeb & Loeb, May 2026 (secondary).

See every national eID that can carry an age check on the eID verification page, and country by country in eID schemes by country.