Three Age Assurance Methods: Self-Declaration, Document Checks and AI Estimation
Short answer. Self-declaration, document checks and AI age estimation approach the age question in three different ways: asking users to state their age, examining evidence of identity or date of birth, and estimating age from measurable characteristics. Each produces a different level and type of assurance, and none should be treated as interchangeable. The appropriate method depends on the age threshold, the consequences of an incorrect decision, privacy requirements and the applicable regulatory standard.
- Self-declaration records what a user says about their age, without independently establishing it.
- Document checks examine evidence such as a passport or driving licence, but document authenticity and the identity of the person presenting it are separate questions.
- AI age estimation produces an estimate or age range, not a confirmed date of birth.
- Ofcom identifies technical accuracy, robustness, reliability and fairness as four criteria for highly effective age assurance in its UK guidance.
- A service should choose its method according to the risk and explain what happens when a check is inconclusive.
Age assurance, verification and estimation are different terms
Age assurance is the umbrella term for approaches used to determine whether someone falls within an age category or meets a particular age threshold. It includes methods that rely on information supplied by the user, evidence from identity documents and algorithmic estimates. The result might be a declared date of birth, an age range such as 18-24, or a simple answer to a question such as whether someone is over 18.
Age verification generally means establishing an exact age or confirming that a person meets a defined threshold. Age estimation means producing an approximate age or age range. The distinction matters when a service must make a decision at a particular boundary. An estimate of 19 years, for example, is not the same kind of evidence as a verified date of birth showing that a person has passed their eighteenth birthday. The Information Commissioner's Office explains these distinctions in its age assurance opinion.
- Self-declaration: the user supplies their own age information.
- Document checking: evidence is examined to establish an age or identity.
- Age estimation: a system calculates an approximate age or age range.
- Combined assurance: more than one method is used in a sequence or together.
Method card: self-declaration
What it asks of the user: a person enters a date of birth, selects an age category or confirms that they meet a stated minimum age. A typical registration screen might ask users to enter their birth date and continue after selecting an acknowledgement that they are at least 18. The service receives a declaration and can use it to apply an age-related experience.
What it cannot establish: without additional evidence, the method cannot independently establish whether the supplied information is accurate. A user can enter a different birth date, and the interface has no independent basis for distinguishing an accurate declaration from an inaccurate one. The method records an answer rather than verifying the underlying fact.
Known failure modes: false declarations, accidental date-entry errors, shared devices and repeated attempts using different dates can undermine the result. A date picker may prevent invalid calendar dates, but it does not establish that the person selected their real date of birth. Ofcom's UK Online Safety Act guidance explicitly states that self-declaration is not capable of being highly effective at determining whether someone is 18 or over.
Where regulators mention it: the ICO includes self-declaration among possible age assurance approaches under the Children's Code. Its use must be considered in relation to the risks of the service and the level of certainty required. A declaration may contribute to a lower-risk process, but it should not automatically be treated as sufficient for a high-risk adult-only service.
Method card: document checking
What it asks of the user: the person provides evidence from an identity document, such as a passport, national identity card or driving licence. Depending on the process, the user may enter information manually, upload an image of the document or submit it through a specialist verification provider. Some systems also compare the document photograph with a live image of the person presenting it.
What it can establish: a properly designed process can examine a document's recorded date of birth and determine whether it indicates that the holder meets an age threshold. When photo matching and other authenticity measures are included, the process can provide additional evidence that the person presenting the document is its legitimate holder. These are distinct checks, and the exact capabilities depend on the system.
Known failure modes: expired or unsupported documents, poor image quality, damaged photographs, inconsistent names, fraudulent documents and mismatches between the document holder and the person submitting it can create problems. People without accepted documents may also face an access barrier. Collecting a full identity document introduces privacy and security considerations because it can reveal information that the age decision does not require.
Where regulators mention it: Ofcom includes photo-identification matching among the methods capable of being highly effective at establishing whether someone is 18 or over, subject to the process meeting its wider criteria. The ICO also discusses hard identifiers, including passports, as possible approaches to age assurance. A document upload alone should not be assumed to satisfy every requirement of an effective identity check.
Method card: AI age estimation
What it asks of the user: depending on the implementation, the person may provide a facial image, a short video or information that a system can analyse. Facial age estimation uses a computational model to estimate an individual's age from facial characteristics. Other approaches may use patterns in information supplied to a service. These approaches should not be confused with identity verification, which asks who a person is.
What it can establish: an estimation system can produce an approximate age, a range or a classification against a threshold. For example, a system might classify a user as likely to be above or below 18. The output is an estimate with uncertainty, not proof of the user's exact date of birth. A result close to the threshold requires particular attention because a small estimation error can change the access decision.
Known failure modes: estimation accuracy can vary across age groups, lighting conditions, image quality and population characteristics. Some users may be incorrectly classified as adults or children. Accessibility, facial differences and technical limitations can also affect completion. A service needs a route for users to challenge an inaccurate result and an alternative method for people who cannot use the estimation process.
Where regulators mention it: Ofcom identifies facial age estimation as a method capable of being highly effective at the 18 threshold when implemented to the required standard. The ICO's age assurance guidance addresses AI-based approaches and calls for attention to accuracy, transparency, bias and data protection. Where biometric information is processed, the applicable data protection requirements require separate consideration.
The comparison depends on the decision being made
Consider a service that restricts access to adults aged 18 and over. A date-of-birth field can record a declaration, but it does not independently establish the user's age. A document check can examine a recorded birth date and, with suitable additional measures, help establish that the person presenting the evidence meets the threshold. An estimation system can classify a person as likely to be an adult, but its output remains an estimate.
These methods also differ in the information they require. A declaration may need only a date of birth. A document process can involve identity details and an image. Facial estimation may involve processing a biometric image or related information. The service should consider what it needs to collect, how long it needs to retain it and whether the final result can be communicated without keeping the original evidence.
- For a low-risk age-appropriate experience, a declaration may be one part of a proportionate approach.
- For an adult-only restriction, the required level of assurance may be substantially higher.
- For an estimation process, define a challenge age and an alternative route.
- For a document process, distinguish checking the document from matching the presenter.
- For every method, document the treatment of errors, appeals and personal information.
What Ofcom and the ICO expect from the wider process
Ofcom's guidance under the Online Safety Act describes four criteria for highly effective age assurance: technical accuracy, robustness, reliability and fairness. Technical accuracy concerns performance under controlled conditions; robustness concerns how the process works in actual deployment; reliability concerns whether its output is reproducible and based on trustworthy evidence; fairness concerns discriminatory or biased outcomes. The regulator also discusses accessibility and interoperability as important implementation principles.
The ICO approaches age assurance through children's rights and data protection. Its guidance emphasises proportionality, transparency, data minimisation and the need to explain how information is used. It also recommends giving users a way to challenge an inaccurate assessment. The ICO and Ofcom have different statutory responsibilities, so their guidance should be read in its relevant legal context. General information here is not legal advice.
Sources and the next decision
The primary sources for this subject include the ICO's Age Assurance Opinion for the Children's Code, its guidance on age assurance and the Age Appropriate Design Code, and Ofcom's Age Assurance Duties under the Online Safety Act. These documents describe different regulatory purposes and should be consulted in their current versions. Ofcom's list of methods capable of being highly effective is not a guarantee that every implementation of those methods meets the required standard.
A practical starting point is to write down the exact age decision the service needs to make, the consequences of a wrong classification and the minimum information required. Then compare each candidate method against those requirements, including its failure route. Before selecting a supplier or building an internal process, record the applicable regulatory standard and the evidence needed to demonstrate that the complete process meets it.
Questions readers ask
What is the difference between age assurance and age verification?
Age assurance covers the full range of approaches to determining age. Age verification is the more specific activity of confirming an exact age or whether someone meets a defined threshold.
Can a credit card establish that someone is 18?
The answer depends on the card product and the check performed. Ofcom distinguishes credit card checks from ordinary online payment methods that do not require the holder to be an adult.
What happens when an age estimation result is uncertain?
A service can use a challenge-age approach, request another form of assurance or provide an appeal route. The appropriate response should be explained before users submit their information.
Does an age check need to identify a person's name?
Not always. Some age assurance systems can return an age threshold result or age band without disclosing the person's full identity to the service. The available privacy-preserving options depend on the provider and legal context.