Age verification and age assurance
Check that a user is over 18, 21, or any threshold you set — with a selfie and an ID document, or via a government database check — on one API.
- checkFacial age estimation from a selfie — no document, no name
- checkAny threshold you set, with the age rule applied automatically
- checkYou get a pass or fail; the data you do not need never reaches your systems
Four ways to check age
| Method | How it works | Typical use |
|---|---|---|
| Method | How it worksThe user goes through a passive or active liveness check. The model returns an estimated age and liveness assurance. No document, no name. | Typical useHigh-volume 18+ gates where you need speed |
| Method id_cardID document check | How it worksThe user provides a photo of a passport or ID. We read the date of birth and check the document for forgery. | Typical useLicensed operators that must record a verified date of birth |
| Method account_balanceGovernment database check | How it worksWe match the user details against a state database. | Typical useBrazil, Mexico, Peru, India, Nigeria, South Africa, Kazakhstan, Ukraine, USA |
| Method stairsStep-up flowRecommended | How it worksStart with the Liveness step. Only the users near your threshold go on to a document check. | Typical useLowest friction at scale |
How age verification works, step by step
Age estimation from a liveness check
The user goes through a passive or active liveness check. The model returns an estimated age and a liveness result, so a photo of a photo or a deepfake does not pass.
Document check and date of birth
When the estimate approaches your threshold, the user photographs or uploads their ID. We read the date of birth, check the document for signs of forgery, and match the selfie against the photo in the document. The date of birth is then checked against the estimated age, so a borrowed or edited ID does not pass.
Database check where available
In Brazil, Mexico, Peru, India, Nigeria, South Africa, Kazakhstan, Ukraine and the USA, we can match the user details against a government database. Where regulations allow, this replaces the document step entirely instead of being an extra one.
What you get
Your system receives a pass or fail against the threshold you configured, plus the evidence trail you need for an audit. A user who does not pass automatically is reviewed by a compliance manager, so a single estimate is never the final answer.
What your regulator expects
| Market | What is required | In force since | Who enforces |
|---|---|---|---|
Market🇬🇧United Kingdom | What is requiredPart 5 services (publish/host their own porn) and in-scope Part 3 user-to-user/search services must use age assurance that is technically accurate, robust, reliable and fair. Self-declaration does not qualify. | In force since25 July 2025 | Who enforcesOfcom, with the ICO on data protection aspects |
Market🇪🇺European Union | What is requiredUnder Article 28 DSA, online platforms accessible to minors must implement appropriate and proportionate measures to protect minors. The Commission's 2025 Guidelines identify age verification as an appropriate measure for high-risk services, including platforms providing access to pornographic content. The Commission's 2026 Recommendation promotes a common EU approach to privacy-preserving age verification. Additional age-verification obligations may arise under Member State law. | In force since14 July 2025 | Who enforcesEuropean Commission for matters within its competence, and national Digital Services Coordinators for other DSA enforcement. |
Market🇺🇸United States | What is requiredAge-verification requirements for adult content are primarily governed by state-specific laws. A number of states have enacted requirements for covered adult-content services to verify that users are 18 or older, including, for example, Texas (the U.S. Supreme Court decision in Free Speech Coalition v. Paxton (27 June 2025) upheld the Texas age-verification law) and Ohio. Requirements, verification methods and enforcement mechanisms vary by state. | In force sinceState-specific | Who enforcesState authorities/Attorneys General, depending on state |
Market🇦🇺Australia | What is requiredApplicable high-risk online services must use appropriate age assurance and access controls to prevent under-18s from accessing/exposure to age-restricted material, including pornography. Self-declaration alone is insufficient. Measures must be accurate, robust, reliable, fair and privacy-compliant. | In force since27 December 2025 | Who enforceseSafety Commissioner |
| Market | What is required | In force since | Who enforces |
|---|---|---|---|
Market🇬🇧United Kingdom | What is requiredMinimum age: 18 years. Age verification required before depositing or playing. Identity verification required before playing; name, address and date of birth required. No gambling allowed until verification is complete. No established KYC method; ongoing accuracy/re-verification required. | In force since7 May 2019 | Who enforcesUK Gambling Commission |
Market🇩🇪Germany | What is requiredMinimum age: 18 years. Verified registration/identity before gambling. Technical identification/authentication must prevent underage/excluded players. Personal data confirmation annually; re-checks may apply when payment details change. | In force since1 July 2021 | Who enforcesGemeinsame Glücksspielbehörde der Länder (GGL) |
Market🇦🇹Austria | What is requiredMinimum age: 18 years. Age and identity must be verified before gambling. Applicable KYC/AML requirements apply under §31c GSpG in conjunction with the FM-GwG. | In force since1 January 2026 | Who enforcesAustrian Ministry of Finance (Bundesministerium für Finanzen, “BMF”) and the Austrian Tax Office (Finanzamt Österreich). |
Market🇵🇹Portugal | What is requiredMinimum age: 18 years. Player identity verified before registration becomes active / before gambling. Verification via public databases, Citizen Card/Digital Mobile Key or ID document. No gambling if verification fails. | In force since29 April 2015 | Who enforcesServiço de Regulação e Inspeção de Jogos (SRIJ), the gambling regulation and inspection service of Turismo de Portugal |
Market🇦🇺Australia | What is requiredMinimum age: 18 years. Customer identity and age verification before betting; no deposits/bets until verification is completed. Risk-based electronic/documentary KYC; additional verification where required. | In force since26 February 2019 | Who enforcesACMA (federal enforcement) for IGA 2001 matters, AUSTRAC, state/territory regulators (licensing). |
Market🇦🇷Argentina | What is requiredMinimum age: 18 years. No uniform national online-gambling KYC regime; requirements are jurisdiction-specific. In Buenos Aires Province: identity verification at registration, including biometric/liveness + facial recognition. | In force sinceN/A | Who enforcesProvincial gambling authorities (LOTBA / IPLyC Buenos Aires). |
| Market | What is required | In force since | Who enforces |
|---|---|---|---|
Market🇲🇹Malta | What is requiredCASPs (“subject persons”) must identify and verify customer identity via reliable independent documents before establishing a business relationship/providing services. FIAU Implementing Procedures set accepted verification methods (face-to-face/digital); risk-based ongoing monitoring and source-of-funds checks required. | In force since30 December 2024 | Who enforcesMFSA/FIAU |
Market🇦🇹Austria | What is requiredIdentity verification via reliable independent documents required before business relationship/occasional transaction; ongoing monitoring; CASPs must obtain authorisation from the FMA before offering services, in accordance with Articles 62-63 MiCAR. | In force since30 December 2024 | Who enforcesFMA |
Market🇱🇺Luxembourg | What is requiredClient and beneficial-owner identification/verification required at start of business relationship. CSSF Règlement 12-02 details risk-based CDD; ongoing monitoring mandatory. | In force since30 December 2024 | Who enforcesCSSF |
Market🇮🇪Ireland | What is requiredCDD required prior to business relationship/occasional transaction — identify and verify customer identity via reliable documents; records kept; risk-based ongoing monitoring. | In force since23 April 2021 | Who enforcesCentral Bank of Ireland (CBI) |
Last reviewed: 13 November 2026. Sources: Ofcom, European Commission, eSafety Commissioner.
This page is not legal advice. Talk to us about your jurisdiction.
Built for compliance teams
Data minimisation
You decide what the API returns: a pass or fail against your threshold, or the full date of birth. Anything you do not need is not sent to your systems.
Coverage
240+ countries and territories, 14,000+ document types, and government database checks in nine countries.
Age rules, down to the day
Set a minimum age, a maximum age, or both. Then choose how age is counted — from the date of birth or from the day after — so the birthday edge case aligns with your policy.
Speed
A check takes 11 seconds on average, so the age gate does not become the reason people leave.
Liveness included
Passive and active liveness, deepfake detection and 1:1 face match run inside the same check — not as a separate integration or add-on.
Ready to run your first age check?
Test on your own traffic in the sandbox, then go live when you are ready. No monthly minimum.
Integration
Three ways to add the age check. A sandbox is available as soon as you register.
Hosted form
Skip the integration entirely. Send your users a link to a verification form we host in your branding. No development work on your side.
Web and Mobile SDK
Keep the flow inside your product. Native SDKs for web, iOS and Android handle camera capture, liveness and document photos, and return the result to your app. See it on a real device — our demo app is on the App Store and Google Play.
API
Create an applicant, start a verification with an age threshold, receive the result on a webhook. Full control over the flow and the data you receive.
ISO/IEC 27001 certified · GDPR and UK GDPR compliant · ICO registered ZB680338 · Data stored in Belgium
FAQ
How does age verification work online?expand_more
The user proves their age with a liveness check and an ID document that includes age estimation from a facial check or a database check. A model estimates age from liveness snapshots, a document check reads the date of birth from a passport or ID, and your system receives a pass or fail based on the threshold you set.
What counts as highly effective age assurance in the UK?expand_more
Ofcom expects a method that is technically accurate, robust, reliable and fair. Self-declaration and a simple age gate do not qualify. Facial age estimation, ID matching, open banking, email-based estimation and reusable digital ID are among the methods Ofcom lists.
Can you verify age without an ID document?expand_more
Yes. Applicants from Brazil, Mexico, Peru, India, Nigeria, South Africa, Kazakhstan and others can go through the non-document verification flow. Through the official database integration, this KYC flow is available to clients.
How much does age verification cost?expand_more
It depends on which checks you run. A step-up flow means you pay for each step you add to your flow. Billing is pay-as-you-go with no monthly minimum. See the price list.
Which countries and documents do you support?expand_more
We cover 240+ countries and territories and 14,000+ document types, with government database checks in Brazil, Mexico, Peru, India, Nigeria, South Africa, Kazakhstan, etc.
What happens to the date of birth?expand_more
Your system receives only what you configure — a pass or fail against your age rule, or the full verification data. On our side, we act as your data processor: what we retain, and for how long, is set out in our DPA, and you can request deletion.
What is the legal basis for the biometric check?expand_more
Liveness and 1:1 face match involve biometric data, so the flow captures the user’s explicit consent before the camera opens. We act as your processor under a DPA, and we support your DPIA with the documentation you need.
Where is the data processed?expand_more
Verification data is stored on servers in Google Cloud in the EU. A government database check sends the minimum details needed for the match, and transfers outside the EEA are covered by the standard contractual clauses in our DPA.
Is someone 18 on their birthday or the day after?expand_more
That depends on the rule you set. In KYCAID, you choose whether the required age is reached on the date of birth itself or on the following day, and every check is validated against your rules.
How fast is a check?expand_more
A check takes 11 seconds on average.
Run your first age check today
Start in the sandbox and go live when you are ready. No monthly minimum, no contract to start.