Age verification in the EU: eIDs, the EUDI Wallet and the age app
Which national eIDs return a date of birth or an over-18 flag, how the EUDI Wallet and the EU age app prove age, what DSA Article 28 and France, Italy, Spain and Germany expect, and a design that combines them.
In short
Age verification in the EU is moving to electronic identity: national eIDs, the EUDI Wallet and the EU age-verification app can prove a user is over 18 without giving the site a name or a date of birth. For 18+ content, the Digital Services Act guidelines accept facial age estimation only as a temporary alternative.[1]
- Germany's eID card, ID Austria, itsme and Latvia's eParaksts platform can answer "over 18" alone.[2][3][4][5]
- Member States must offer an EUDI Wallet by 24 December 2026; on 29 April 2026 the Commission urged them to make the age app available by the end of the year.[6][7]
Age verification in the EU has two layers. The EU layer is the Digital Services Act (DSA) Article 28 guidelines, the EU age-verification blueprint and the European Digital Identity (EUDI) Wallet under eIDAS 2, Regulation (EU) 2024/1183.[1][8][6] The national layer is the adult-content rules of France, Italy, Spain and Germany. This guide covers which electronic identities (eIDs) prove age and how to combine the methods.
Age verification in the EU today: the three DSA methods
The DSA guidelines name three methods: self-declaration, age estimation and age verification. "Age verification provides certainty about the age of the user, age estimation provides an approximation".[1]
| Method | DSA guidelines | For 18+ content |
|---|---|---|
| Self-declaration | Not appropriate (para. 52)[1] | No |
| Age estimation | For minimum ages under 18 and medium risks, if independent or audited (para. 47)[1] | Temporary alternative only (para. 38) |
| Age verification | Expected for high-risk products and services (para. 37)[1] | Yes |
| Government-ID age tokens | Effective when anonymised and issued by an independent third party; zero-knowledge proofs suit (para. 41)[1] | Yes |
Paragraph 49 lists five criteria for any method: accuracy, reliability, robustness, non-intrusiveness and non-discrimination. Under the reliability criterion, "a self-signed proof of age would not be considered reliable".[1] Compare them in age assurance with eID versus age estimation.
Which national eIDs return a date of birth or an over-18 flag
Every eID identifies the person, so age can be computed from the date of birth. A few schemes answer only the age question. See eID schemes by country.
| Country | eID | Identity data | Age-only answer |
|---|---|---|---|
| Germany | Online-Ausweis | Fields the provider's certificate allows; never a national ID number[2] | Yes: age-over check without the birth date, § 18(3) No. 10 PAuswG[2] |
| Austria | ID Austria | Name, date of birth, sector-specific identifier[3] | Yes: age_over_14, 16, 18, 21 (Level full)[3] |
| Belgium | itsme | Name, birthdate and more, by scope[4] | Yes: age_gte_13, 16, 18, 21, 30[4] |
| Latvia | eID card, eParaksts platform | Name, surname, personal code[9] | Yes: age-threshold check without full identity[5] |
| Estonia | ID card via TARA (public sector) | date_of_birth (for Estonian personal codes)[10] | No age-over claim[10] |
| Sweden | BankID | Personal identity number and name; birth date derived[11] | No |
| Denmark | AltID (state app) | ID card in the app[12] | Yes: age proof 15+ and 18+[12] |
| Spain | MiDNI (in person only; remote use not live) | "Simple" level includes date of birth[13] | "Age" level: photo, DNI number, over 18 or not[13] |
| Spain | Cartera Digital Beta | None[14] | Over-18 credential only[14] |
| Ireland | Government Digital Wallet (pilot) | Selective disclosure: any of name, date of birth, PPSN, address, photo[15] | Yes: over-18 yes/no[15] |
France Identité is testing a proof that shows only over 15 or over 18, according to Siècle Digital; its acceptance under French rules was not confirmed as of 5 October 2026.
Watch out
Holding an eID does not prove adulthood. Swedish banks set their own BankID age limit, most commonly 13 or 18,[16] Germany's eID works from 16,[2] and AltID is open from 13.[12] Check the date of birth or the age claim, not the sign-in.
See also age verification with MitID and age verification with itsme.
The EUDI Wallet and age attestations
Under Article 5a(1), every Member State must offer an EUDI Wallet "within 24 months" of the first implementing acts (24 December 2026), and the user can disclose one attribute at a time.[6] Date of birth is a mandatory attribute of the wallet's person identification data (PID), but an over-18 flag is not in the PID table of Implementing Regulation (EU) 2024/2977.[17] Age sits on the eIDAS minimum list of attributes (Annex VI) that Member States must make verifiable against authentic sources within 24 months of the implementing acts (Article 45e). The over-18 proof comes from age attestations and the EU blueprint.[6][8] The Dutch government: "you can share only whether someone is over 18".[18]
In Ireland's Government Digital Wallet pilot, one published online age check shares only "over 18": "her name, date of birth and address are never shared".[15] Germany's state wallet, d-you, is due to launch on 2 January 2027 with age proof among its first uses, according to a ministry press release of 9 September 2026.[19] Under Article 5f(2), regulated private relying parties must accept wallets at the user's request "no later than 36 months" after those acts (24 December 2027); micro and small enterprises are excepted.[6] More on the EUDI Wallet page.
Prove you are over 18
Continue
1The site starts an online age check.[15]
Scan to continue
Scan with your wallet app.
2Across two devices, a QR code hands over to the phone.[15]
Share your age
- Over 18Shared
- NameNot shared
- Date of birthNot shared
- AddressNot shared
Share
3The consent screen in the published example: only "over 18" is shared.[15]
Over 18 shared
4The site receives only "over 18".[15]
An illustration of Ireland's published online age check, not an app capture.[15]
The EU age-verification app blueprint
The Commission's blueprint is a reference app for proving you are over 18. Version 2, of 10 October 2025, added passports and identity cards as onboarding methods next to eIDs, plus the Digital Credentials API; Denmark, France, Greece, Italy and Spain were "the first Member States to take up the technical solution".[8]
- 2 July 2025DSA guidelinesArticle 28 guidelines adopted.
- 14 July 2025Blueprint v1First age app release.
- 10 October 2025Blueprint v2Passport and ID card onboarding.
- 29 April 2026RecommendationShip the app this year.
- 24 December 2026Wallets dueEach Member State offers one.
The EU age-verification timeline.[1][8][7][6]
The proof "does not contain any identity data", the provider "is not informed about online services for which the user presents the 18+ proof", and proofs "are issued in batches, for one-time use only" so checks cannot be linked.[8] Zero-knowledge proofs are the mandatory presentation mechanism, "with plain mDoc presentation as fallback". Separately, France, Denmark, Greece, Italy, Spain, Cyprus and Ireland are piloting the app inside national wallets during 2026.[20] The Commission's recommendation of 29 April 2026 allows it standalone or inside a wallet.[7] See the EU age verification app.
DSA Article 28: what the guidelines expect for 18+ content
Paragraph 37 of the guidelines (C/2025/5519) expects age verification for high-risk products: "the sale of alcohol, tobacco or nicotine-related products, drugs", "access to any type of pornographic content" and "access to gambling content".[1] This guide covers the online-content cases, not the sale of goods.
Watch out
Estimation is allowed for 18+ content only "as temporary alternative" where verification is "not yet readily available", if comparable to verification, and not "beyond the first review of these guidelines", due within 12 months (paragraphs 38 and 92).[1] Whether that review has happened was not confirmed as of 5 October 2026.
- Offer more than one method and a redress route (paragraph 48).[1]
- Prefer double-blind methods (paragraph 46).[1]
- Store nothing beyond the user's age group (paragraph 39).[1]
- Check age at each access on adult platforms (paragraph 51).[1]
Age verification in the EU: national rules
| Country | Legal basis | Covered | Applies from | Method must |
|---|---|---|---|---|
| France | SREN law of 21 May 2024; Arcom framework[21] | Porn services[21] | October 2024 framework, then a transition[22] | Offer one double-anonymity method; estimation allowed with a fallback[22] |
| Italy | Art. 13-bis DL 123/2023; AGCOM 96/25/CONS[23] | Porn sites, video-sharing platforms[23] | 12 November 2025; 1 February 2026 for other EU States[24] | Certified third party, double anonymity, a check per session[23] |
| Spain | Ley 13/2022, art. 89.1.e[25] | Video-sharing platforms[25] | In force[25] | Keep minors from the most harmful content[25] |
| Germany | JMStV, KJM assessments[26] | Adult closed user groups[26] | In force[26] | eID-card check accepted as face-to-face equivalent[26] |
Italy. Public systems (SPID, CIE, wallets) are usable only where the double-anonymity requirements are met, and AGCOM found SPID's standard flow not fully compliant because the request to the identity provider carries the site's domain.[23] AGCOM's list of covered services, version 5 dated 29 September 2026, has 79 entries.[27]
Spain. Cartera Digital Beta was presented on 1 July 2024.[28] It carries only an over-18 credential, presented with OpenID4VP, to sites on a signed government whitelist.[14] We found no confirmed public launch as of 5 October 2026. A bill raising the social-media age to 16 will lapse with the early general election, Europa Press reported on 5 October 2026.[29]
Germany. The KJM names "Nutzung der eID-Funktion des neuen Personalausweises" among accepted checks.[26]
Privacy: double anonymity and what you may store
Double anonymity means the proof issuer does not learn which site asked, and the site does not learn who the user is.[23] A plain eID login breaks the first half when the identity provider sees the site, as AGCOM found for SPID.[23] The EU blueprint keeps both halves.[8] Spain's whitelist limits which content providers may ask.[14]
The issuer never learns the sites
The user approves
A double-anonymity age check, simplified from the EU blueprint.[8]
Age verification "should not entitle providers of online platforms to store personal data beyond information about the user's age group".[1]
A design that combines eID, wallet, age estimation and documents
Estimation is least accurate near the threshold.[30] The UK's Ofcom lists facial age estimation and digital identity services as capable of being highly effective, and expects a challenge age: anyone estimated under it takes a second, different check.[31] Australia's trial calls it a "waterfall": start low-friction and escalate when the result is inconclusive near the threshold, up to document verification.[30]
1Estimate age from a selfie
With liveness, against a challenge age.
The estimate clears the challenge age
Pass on the selfie
Where estimation is accepted.
Step up
eID age claim, wallet proof or document.
2Keep only the result
Age group, method, time; offer redress.
A recommended design from DSA paragraph 48, Ofcom's challenge age and the Australian waterfall.[1][31][30]
Video pending: flow-age-waterfall
Age estimation first; borderline results step up to an eID or a document.
On NIST's leaderboard the lowest mean absolute error for ages 18 to 30 on visa photos is 2.379 years (29 September 2026), higher on less controlled images.[32] Australia's best systems reached 1.3 to 1.5 years in a separate evaluation; the two figures are not comparable.[30] Unless estimation is shown comparable to verification, the eID, wallet or document step is the check for 18+ content in the EU, not a fallback.[1] ISO/IEC 27566-1 was published in December 2025.[33]
How Didit helps with age verification in the EU
Didit runs the eID, estimation and document parts of this design: eID verification sign-ins in the hosted flow, age estimation in the liveness step, and the document route with NFC. EUDI Wallet acceptance is coming soon. Five eIDs are live: MitID, BankID Sweden, the Finnish Trust Network, Smart-ID and Mobile-ID. Each sign-in returns a signed date of birth, so it proves age without a document photo. Turn them on under Workflows, ID Verification, Countries, Wallets accepted; only completed sign-ins are billed, at the rates on the pricing page.
Age estimation costs $0.10 per check. Didit's own model has a documented mean absolute error of 3.5 years overall and 1.5 under 18. Those are Didit's own figures, not comparable with the NIST or Australian results above. Adaptive Age Verification sends borderline results to ID verification, face-matching the document portrait to the age selfie. We recommend estimation first, eID or document for borderline cases; an eID as the adaptive fallback is not a documented product setting. Users without an eID use document capture with NFC chip reading ($0.15) and liveness. See age verification and digital ID wallets.
| eID | Countries | Age data | Didit status |
|---|---|---|---|
| MitID | Denmark | Signed date of birth | Live |
| BankID Sweden | Sweden | Signed date of birth | Live |
| Finnish Trust Network | Finland | Signed date of birth | Live |
| Smart-ID | Estonia, Latvia, Lithuania, Belgium | Signed date of birth | Live |
| Mobile-ID | Estonia, Lithuania | Signed date of birth | Live |
| German eID card (Personalausweis) | Germany | On our roadmap | Coming soon |
| itsme | Belgium | On our roadmap | Coming soon |
| EUDI Wallet | EEA | On our roadmap | Coming soon |
| ID Austria | Austria | Talk to us | On request |
Screenshot pending: hosted-flow-wallet-chooser
The user picks an eID or a document in the Didit flow.
Didit provides
- eID sign-ins with a signed date of birth
- Age estimation with liveness
- The document route with chip reading
Stays with you
- Which rules apply to your service
- Your challenge age and methods
- Redress for refused users
Check age with eID, estimation or a document
Pay only for completed checks.
Key takeaways
- For 18+ content the DSA guidelines expect verification; estimation is temporary.
- Germany's eID card, ID Austria, itsme and eParaksts can answer the age question alone.
- The EUDI Wallet PID carries a date of birth; over-18 proofs come from age attestations.
- France and Italy require double anonymity, which a plain eID login can break.
Frequently asked questions
What is the difference between age estimation and age verification in the EU?
Age verification gives certainty, for example from an eID, a wallet or an ID document. Age estimation gives an approximation, for example from a selfie.[1]
Can I use facial age estimation alone for adult content in the EU?
Only as a temporary alternative where verification is not yet readily available, and only if the method is comparable to verification. The period should end with the first review of the DSA guidelines, due within 12 months (paragraph 92).[1]
Which national eIDs can return only an over-18 answer?
Germany's eID card, ID Austria, itsme and Latvia's eParaksts platform. Most other schemes return a date of birth from which age is computed.[2][3][4][5]
Does the EUDI Wallet include an over-18 attribute?
Not in the mandatory PID table, which carries the date of birth. Over-18 proofs come from separate age attestations, and Ireland's pilot has published an age check that shares over-18 alone.[17][15]
When will the EU age verification app be ready?
On 29 April 2026 the Commission urged Member States to make it available by the end of 2026, as a standalone app or inside their wallet.[7] France, Denmark, Greece, Italy, Spain, Cyprus and Ireland are piloting it inside national wallets during 2026.[20]
How does an over-18 proof work without revealing my date of birth?
The proof holds no identity data, and the issuer is not told which services you visit. Proofs are issued in batches for one-time use, so two checks cannot be linked.[8]
Does a successful eID sign-in prove the user is an adult?
No. A sign-in proves identity, not adulthood. Swedish banks most commonly issue BankID from 13 or 18, and Germany's eID works from 16. Check the date of birth or the age claim.[16][2]
Can I use SPID for age verification in Italy?
Not in its standard flow. Public systems, including SPID, CIE and wallets, are usable only where the double-anonymity requirements are met. AGCOM found SPID not fully compliant with them because the identity provider sees the site's domain.[23]
What data may I keep after an age check?
Only the user's age group, according to the DSA guidelines. Keep the result, not the document or the date of birth.[1]
Sources
- Commission Guidelines on measures to ensure a high level of privacy, safety and security for minors online (Article 28 DSA), C/2025/5519, EUR-Lex, Official Journal C, 2025.
- Personalausweisgesetz (PAuswG), § 18 Elektronischer Identitätsnachweis, Federal Ministry of Justice, Gesetze im Internet.
- ID Austria, Personenmerkmale (attributes for service providers), Republic of Austria, ID Austria developer documentation.
- itsme data sharing documentation, Belgian Mobile ID.
- e-Identitātes un parakstīšanas platforma, LVRTC, eParaksts.
- Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 (eIDAS 2), EUR-Lex, Official Journal of 30 April 2024.
- Commission urges Member States to roll out the EU age verification app, European Commission, 29 April 2026.
- Commission releases enhanced second version of the age verification blueprint, European Commission, 10 October 2025.
- eParaksts authentication consent screen, LVRTC, eParaksts.
- TARA technical specification, Information System Authority of Estonia (RIA).
- BankID collect API reference, BankID, Finansiell ID-Teknik.
- AltID, Agency for Digital Government, Denmark.
- MiDNI, Policía Nacional, Spain.
- Age verification protocol for platforms integration with the system, v1.0, Ministry for Digital Transformation and the Civil Service, Spain, 30 June 2024.
- How the Government Digital Wallet works, Government of Ireland, 23 June 2026.
- Get BankID, BankID, Finansiell ID-Teknik.
- Commission Implementing Regulation (EU) 2024/2977 on person identification data and electronic attestations of attributes, EUR-Lex, Official Journal of 4 December 2024.
- ID wallet, Dutch Government, NL Digital Government.
- d-you: Deutschland startet digitale Identität für alle, press release 53/2026, Federal Ministry for Digital Transformation and Government Modernisation (BMDS), 9 September 2026.
- EU age verification solution, technical portal, European Commission project portal.
- Technical guidelines on age verification for the protection of persons under 18 from online pornography, Arcom.
- Référentiel technique sur la vérification de l'âge pour la protection des mineurs contre la pornographie en ligne, Arcom, October 2024.
- Delibera n. 96/25/CONS, AGCOM, 8 April 2025.
- Tutela minori: age verification, AGCOM.
- Ley 13/2022, de 7 de julio, General de Comunicación Audiovisual, Boletín Oficial del Estado.
- KJM bewertet vier weitere Altersverifikationssysteme positiv, Kommission für Jugendmedienschutz (KJM).
- Comunicazione del 30 ottobre 2025, list of services under art. 13-bis (v5, 29 September 2026), AGCOM.
- Cartera Digital Beta press release, La Moncloa, 1 July 2024.
- Leyes sociales del Gobierno que decaen con el adelanto electoral (secondary source), Europa Press via Teleprensa, 5 October 2026.
- Age Assurance Technology Trial, Part A main report, Australian Government, August 2025.
- Guidance on highly effective age assurance (Part 3 services), Ofcom, 24 April 2025.
- Face Analysis Technology Evaluation: age estimation and verification, NIST, last updated 29 September 2026.
- ISO/IEC 27566-1:2025, Age assurance systems, Part 1: Framework, ISO, December 2025.
Compare every national eID on the eID verification page.
Prove age without collecting more than you need
Start with eIDs, add estimation, keep documents for everyone else.
Related articles
- Cl@ve integration in Spain: who can connect and what to use instead
- PhilSys verification: how businesses check the National ID
- OpenID4VP verifier guide: accepting the EUDI Wallet
- eIDAS regulation explained: what eIDAS 2 (2024/1183) changes
- Smart-ID API: a developer's guide to RP API v3
- National digital identity worldwide: models, leaders, standards