Age Assurance Online: A Technical Assessment of Current Systems and their Limitations

Online age assurance requirements are reshaping how consumers access digital services around the world. Numerous US states, Australia, the UK, the EU, and other jurisdictions have begun adopting age assurance or verification requirements for social media, AI chatbots, adult content, and other services. Many jurisdictions are considering similar measures. 

Collectively, these moves represent a major change from how online services have been accessed over many decades, and they implicate a variety of important concerns and values affecting adults and minors.

KGI’s new report, Age Assurance Online: A Technical Assessment of Current Systems and Their Limitations, provides a clear, practical assessment of how age assurance systems operate in practice and the consequences that can be expected from their deployment. The report provides a detailed examination of the technologies behind the most common age assurance architectures and mechanisms in use today. 

The report evaluates age assurance architectures and mechanisms using a consistent set of criteria: baseline accuracy, resistance to circumvention, availability (lack of impediments for eligible users to be able to access age-restricted services), and privacy. The key findings are as follows:

• Multiple use cases: There are multiple use cases for age assurance, each with different requirements and challenges. These use cases largely fall into two main categories: (1) safer defaults for general-purpose services such as social media, AI chatbots, short-form video, gaming, and search, and (2) blocking access to specific content or services, especially adult-oriented services such as gambling or pornography.
• Multiple age signals: No single age signal is sufficient on its own.  All existing age signals (self-declaration, commercial and government records, government IDs, age estimation) suffer from either accuracy or availability issues. In order to deploy a practical and effective age assurance system, any practical age assurance system needs to support multiple age signals so that users who are unable to successfully demonstrate their age with one signal can use another signal. Because the privacy properties of age assurance systems vary greatly and many of the most privacy-preserving designs are also not highly available, allowing the user to select a more private signal if available will protect user privacy more than requiring the user to try signals in a predetermined order.
  
• Privacy protection: The most commonly deployed age assurance approaches present privacy risks, even though more privacy-protective approaches are possible and becoming more widely available. The most common age assurance systems require the user to either directly identify themself by name, email, or phone number, or to provide the age verification provider (AVP) with an image of their face. This forces the user to trust the AVP not to misuse their data and to protect their data from breach or disclosure even though the user may have no prior relationship with the AVP and no real alternative options if they wish to access the desired content or experiences. These risks are especially acute in cases where age thresholds below 18 are in use and minors are asked to demonstrate their age. Systems with stronger technical privacy guarantees are possible but not widely deployed.
  
• Circumvention: All age assurance systems are vulnerable to circumvention. It is not technically feasible to build an age assurance system which would prevent all minors from accessing restricted content or experiences without also blocking large numbers of adult users.
  

Taken together, these findings illustrate the inherent tradeoffs that characterize all currently available age assurance approaches. Different use cases place varying demands on accuracy, availability, privacy, and resistance to circumvention, and no single mechanism excels across all of these dimensions on both mobile and desktop. This report gives policymakers, service providers, independent experts, and users a clearer understanding of the consequences, expected outcomes, and implications of different implementation choices.

Resources
Download the Report
Report Overview