Who's really in the room? How online communities can protect young people, establish trust and verify age without collecting more personal information than necessary.
Who’s really in the room? How can online communities protect young people, establish trust and verify age without collecting more personal information than necessary?
Online safety is entering a new phase.
Governments are demanding stronger protections for children. Platforms are under increasing pressure to restrict access to age-inappropriate content. At the same time, concerns about bots, fake accounts, impersonation and automated abuse are challenging our assumptions about who — or what — is participating online.
Age verification is becoming a central part of this debate.
But there is a difficult question at the heart of it: how do we establish that someone is old enough to access a service without requiring everyone to surrender their identity?
The answer matters. A poorly designed verification system can introduce new privacy risks even as it attempts to address existing safety problems. A carefully designed system, by contrast, can establish the information a service actually needs while minimising the personal information it receives.
The principle is simple: verify what is necessary, disclose as little as possible, and protect the person behind the proof.
At Cormonity, we believe safer digital spaces should be built around trust, proportionate safeguards and respect for the people who use them.
1. Why age verification is becoming a priority
The internet was not originally designed around a single, universal system for establishing the age of every participant.
Many services have historically relied on self-declared dates of birth, tick-box declarations or account settings. These approaches are easy to implement, but they may be inadequate where the law or the risks of a service require stronger assurance.
The consequences can be significant.
A child might access content intended for adults. A platform might fail to apply age-appropriate protections. A service could lack reliable information about which safeguards are needed for different users.
This has prompted governments and regulators to consider stronger age-assurance requirements, particularly for services that expose children to inappropriate content, harmful interactions or age-restricted products.
The European Union is developing a common approach to age verification, while the Digital Services Act (DSA) already establishes obligations relating to the protection of minors on covered online platforms.
In July 2025, the European Commission published DSA guidelines setting out proportionate measures intended to improve children's online safety, including protections against harmful content, cyberbullying, grooming, problematic and addictive behaviours, and harmful commercial practices.
The Commission's approach recognises an important distinction: age assurance is one part of a broader child-safety framework, not a substitute for safer design, effective moderation or platform accountability.
In 2026, the Commission's age-verification solution progressed towards implementation. Its technical approach is designed to allow people to prove that they meet a particular age threshold without disclosing their identity or other unnecessary personal details to the service they wish to access.
The direction of travel is clear. The challenge is to ensure that stronger protection does not become a justification for indiscriminate data collection.
2. Age verification, age assurance and identity verification are not the same thing
These terms are often used interchangeably, but they describe different approaches.
Age verification
Age verification establishes whether a person meets a specified age threshold. For example, a service may need to establish whether someone is over 18.
The service does not necessarily need to know the person's name, exact date of birth, address or identity-document number.
Age assurance
Age assurance is the broader category of methods used to determine or estimate a person's age or age range.
Depending on the context, methods may include self-declaration, document-based checks, trusted digital credentials, age estimation or third-party verification.
These approaches offer different levels of confidence and have different privacy, accessibility and accuracy implications. They should not automatically be treated as interchangeable.
Identity verification
Identity verification establishes that a person is who they claim to be, or that particular identity attributes are authentic.
That can be necessary for certain transactions or regulated services. It is not automatically necessary simply because an online service needs to establish whether someone is old enough to access it.
Consider the difference between two questions:
- Is this person over 18?
- Who is this person?
For many age-restricted services, the first question is sufficient.
Requiring an answer to the second question can introduce additional personal-data processing without necessarily improving the outcome.
Good age assurance begins by identifying the precise question that needs to be answered — and refusing to collect information that is not required to answer it.
3. The EU's privacy-preserving age-verification approach
The European Commission's age-verification blueprint offers a useful example of how this principle can work in practice.
The solution is designed around the idea that a person should be able to prove an age threshold without revealing their identity to the online service.
In simplified terms, the process works as follows:
- Obtain an age credential. A trusted process establishes the relevant age attribute using an eligible source, such as an electronic identity credential or identity document.
- Keep the proof separate from the service. The age credential is prepared so that it can be presented without transferring the underlying identity information to the service being accessed.
- Request proof of the required threshold. The online service asks whether the user meets the relevant age requirement.
- Present the proof. The user supplies a credential or proof confirming the required threshold.
- Verify the result. The service checks the proof's validity and receives the necessary age-related confirmation without needing the person's full identity.
For example, a service might receive a statement equivalent to “over 18: yes” rather than a name, date of birth and copy of a passport.
The European Commission describes its solution as privacy-preserving and compatible with the future European Digital Identity Wallet framework. Its design aims to prevent the service from learning the user's identity through the age-proof process.
The Commission's April 2026 recommendation encouraged Member States to make privacy-preserving age-verification tools available by the end of 2026. Availability and deployment depend on national implementation, so the EU-wide solution should not be assumed to be universally available to every user today.
This approach is significant because it demonstrates that age verification does not inherently require every website to collect and retain identity documents.
However, the design of the credential is only part of the story. The surrounding system must also be assessed for security, data retention, linkability, accessibility and the possibility of misuse.
Privacy cannot be guaranteed by a label alone.
4. France and the wider European debate
France illustrates why age-verification policy requires careful attention to both child protection and fundamental rights.
French law has established requirements for age verification on certain pornographic services, with technical standards addressing privacy protection. The French framework includes provisions for independent verification and strengthened confidentiality, including systems described as providing “double anonymity”.
In this context, the idea is to separate the service being accessed from the process used to establish the user's age, reducing the ability of either party to link the verification process to unnecessary identity information.
France's broader proposal to restrict social-media access for under-15s has also exposed the difficulty of implementing age rules at scale. In August 2026, the French Constitutional Council struck down the proposed blanket restriction, finding that it did not adequately protect freedom of communication and privacy.
This does not mean France has abandoned age verification. Requirements applying to specific age-restricted services, including pornographic content, are a separate matter from a general restriction on children's social-media accounts.
At EU level, the Digital Services Act and the Commission's privacy-preserving age-verification initiative form part of the broader effort to improve online safety. The Commission's September 2026 EU KIDS Act initiative adds another layer to the debate, but its proposals should not be confused with rules that are already fully in force across every Member State.
The lesson is that a legitimate child-safety objective does not remove the need for proportionality, legal clarity and privacy safeguards.
A policy must consider not only whether an age threshold is desirable, but also how it is implemented, what information is collected, who can access it and what happens if a person cannot complete the check.
5. The privacy trap: when verification becomes surveillance
Age verification becomes a privacy problem when the system collects more information than it needs, retains it unnecessarily or allows it to be reused for other purposes.
Several risks deserve particular attention.
Collecting identity documents when a threshold would suffice
A service that receives and stores a passport image, full name and date of birth has acquired more information than a service that receives a reliable proof of an age threshold.
That additional information creates responsibilities and potential exposure.
If a database is breached, the consequences may extend beyond the original purpose of the check. Identity documents can be difficult to replace, and personal information may be reused for impersonation or fraud.
Linking a person's activity across services
A verification system can become more intrusive if the same identifier or credential allows multiple services to recognise the same individual.
Even when each service collects relatively little information, a shared identifier can enable activity to be linked across contexts.
A privacy-preserving design should reduce unnecessary linkability and avoid turning proof of age into a universal tracking mechanism.
Retaining data after the check
If the purpose is to establish that a user meets an age threshold, retaining underlying identity information after verification may be unnecessary.
Retention should be justified by a specific legal and operational need, with clear limits and appropriate security controls.
Reusing information for unrelated purposes
Information collected to verify age should not quietly become material for advertising profiles, behavioural analytics, unrelated identity checks or other secondary uses.
Purpose limitation is not merely a technical preference. It is a core data-protection principle.
Excluding people who cannot use the system
A verification system may create barriers for people without conventional identity documents, compatible devices, reliable connectivity or the ability to complete a particular biometric or digital process.
A responsible implementation should consider alternative methods and accessibility from the beginning.
The goal is not simply to make verification difficult to bypass. It is to make it effective, proportionate and fair.
6. What GDPR requires from responsible age assurance
The European Data Protection Board (EDPB) adopted Statement 1/2025 on Age Assurance in February 2025.
The statement sets out principles for processing personal data when determining age or age ranges. It emphasises that age assurance must reconcile the protection of children with the protection of personal data and other fundamental rights.
The relevant principles include:
- Lawfulness, fairness and transparency: people should understand what is being checked and why.
- Purpose limitation: age-related information should be used for a specified, legitimate purpose.
- Data minimisation: only the information necessary for that purpose should be processed.
- Accuracy: the method should be sufficiently reliable for the decision being made.
- Storage limitation: personal information should not be retained indefinitely without justification.
- Security and confidentiality: appropriate technical and organisational safeguards should protect the data.
- Accountability and data protection by design: the organisation responsible must be able to demonstrate that safeguards are built into the system.
The EDPB also highlights the potential implications of age assurance for rights such as freedom of expression, information access, non-discrimination and privacy.
This matters because the best method depends on the use case.
A website restricting adult content has a different risk profile from an educational community, an online game or a service that needs to establish whether a child should receive a particular safeguard.
Organisations should assess the purpose, risk, legal basis, accuracy requirements and potential effects on users before selecting a method.
Age assurance should be proportionate to the risk — not automatically maximised regardless of context.
7. What does privacy-preserving verification look like in practice?
For platform operators, educators and community builders, the following principles provide a useful starting point.
- Ask only the question you need answered. If the requirement is to establish whether a person is over a threshold, design the process around that threshold. Do not automatically collect their full identity.
- Separate proof from identity. Where technically and legally appropriate, use credentials or independent verification services that allow the platform to receive the necessary age result without receiving the source identity documents.
- Minimise retention. Avoid storing raw identity documents or biometric material when they are not necessary. Define deletion rules, retention periods and access controls before implementation.
- Reduce linkability. Assess whether credentials, identifiers, logs or verification providers could be used to track the same person across multiple services or sessions.
- Provide accessible alternatives. Consider users who cannot access a particular device, document or verification method. Alternatives should maintain appropriate safeguards without imposing disproportionate barriers.
- Test accuracy and security. Measure false acceptance and false rejection rates, test for circumvention and assess the risk of impersonation or credential sharing. Independent assessment can help establish whether a system performs as intended.
- Explain the process clearly. Users should understand what is checked, who performs the check, what information the service receives, what is retained and how to seek help if verification fails.
- Review the whole system. A privacy-preserving credential does not make every surrounding component privacy-preserving. Consider the verification provider, platform, logs, analytics, customer support and any third parties involved.
These principles are not a substitute for legal advice or a full data-protection impact assessment where one is required. They are a practical framework for designing a proportionate system.
8. Age verification is not bot detection
The question “Who's really in the room?” also raises a wider trust issue: not every online interaction comes from a human.
Imperva's 2026 Bad Bot Report estimates that automated traffic represented more than 53% of web traffic in 2025 — the second year running in which bots outnumbered humans. It also estimates that malicious “bad bots” accounted for around 40% of all web traffic.
These figures require context. They reflect Imperva's analysis of web traffic, not every conversation, website visit or internet activity worldwide. Automated traffic includes legitimate crawlers and other useful systems, as well as malicious bots.
Nevertheless, the findings illustrate why online platforms need to distinguish between different kinds of activity.
A bot-detection system tries to assess whether traffic or behaviour is automated and whether it may be malicious. Age assurance tries to establish whether a person meets an age requirement. Identity verification tries to establish who a person is.
These are separate questions.
An adult may use an automated tool legitimately. A human user may behave suspiciously. A bot may be associated with a legitimate service. A valid age credential does not prove that every subsequent action is safe or authentic.
No single verification mechanism solves all these problems.
Trustworthy digital communities need layered safeguards: appropriate age assurance, account security, abuse detection, effective moderation, transparent rules and mechanisms for responding to harmful behaviour.
They also need to avoid treating every user as a potential threat by default.
9. Building online communities around trust, not surveillance
Safety and privacy are sometimes presented as opposing objectives.
That is a false choice.
A well-designed system can protect children, establish appropriate access controls and reduce unnecessary exposure of personal information. The technical and regulatory challenge is to implement those protections proportionately and ensure that the safeguards work in practice.
For community operators, the objective should be to establish the minimum information necessary to provide the right experience and enforce the relevant rules.
For platform designers, the objective should be to make safety and privacy part of the architecture, rather than features added after a problem occurs.
For policymakers, the objective should be to ensure that age requirements are clear, proportionate, enforceable and compatible with fundamental rights.
And for parents and educators, the objective should be to understand not just whether a service asks for age verification, but how the process works and what protections it provides.
At Cormonity, our ambition is to support safer online communities through learning, certification and thoughtful digital design. We believe that building trust requires both effective safeguards and respect for the people those safeguards are intended to protect.
The question should not be whether online spaces can be made perfectly risk-free. They cannot.
The question is whether we can make them safer without creating unnecessary surveillance, exclusion or new risks.
Conclusion: verify who needs verifying — and nothing more
Age verification is becoming an important part of the online-safety landscape. The European approach shows that it is possible to design systems that establish an age threshold without routinely disclosing a person's identity to every service they visit.
But implementation matters.
Excessive data collection, persistent identifiers, weak retention controls and inaccessible verification processes can undermine the very trust that safety measures are meant to establish.
The answer is not to abandon age assurance. Nor is it to require every person to identify themselves everywhere online.
It is to match the method to the risk, minimise the information collected, protect the proof, and make the system accountable.
Verify what is necessary. Protect what is personal. Design for trust.
Because a safer internet should not require us to surrender our privacy to participate in it.
Frequently asked questions
What is privacy-preserving age verification?
It is a method of establishing whether someone meets an age requirement while limiting the personal information disclosed to the service. Depending on the design, a service may receive confirmation of an age threshold without receiving the person's name, full date of birth or identity document.
Is age verification required under EU law?
Requirements depend on the service, the applicable law and the specific risk. The Digital Services Act includes obligations concerning minors' online safety, and certain age-restricted services have specific legal requirements. The EU's common age-verification solution is being implemented through a process involving Member States; it should not be confused with a universal rule requiring every website to identify every user.
What is the difference between age verification and identity verification?
Age verification establishes whether a person meets an age threshold. Identity verification establishes who a person is. A service may need the former without needing the latter.
Does the EU age-verification system reveal my identity to websites?
The Commission's solution is designed to let people prove they meet an age threshold without disclosing their identity or other personal details to the service they are accessing. The actual privacy outcome depends on implementation and the wider systems involved, so users and operators should review the relevant technical and privacy documentation.
What does GDPR say about age verification?
GDPR principles relevant to age assurance include lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability. The European Data Protection Board's Statement 1/2025 provides specific guidance on these principles in age-assurance contexts.
Is age verification the same as bot detection?
No. Age assurance assesses whether an age threshold is met. Bot detection assesses whether activity is automated and may be malicious. Identity verification establishes who someone is. Each addresses a different problem and may require a different method.
Can age verification guarantee online safety?
No. It can help enforce access restrictions, but it does not prevent all harmful content, harassment, impersonation, fraud or unsafe interactions. It should form part of a broader safety-by-design approach that includes moderation, privacy protections, security and accountability.
Sources and further reading
- European Commission — The EU approach to age verification. https://digital-strategy.ec.europa.eu/en/policies/eu-age-verification
- European Commission — EU age-verification solution FAQs. https://digital-strategy.ec.europa.eu/en/faqs/eu-age-verification-solution
- European Commission — Guidelines on the protection of minors under the Digital Services Act (14 July 2025). https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-protection-minors
- European Data Protection Board — Statement 1/2025 on Age Assurance (12 February 2025). https://www.edpb.europa.eu/our-work-tools/our-documents/statements/statement-12025-age-assurance_en
- French data-protection authority framework — Technical requirements for privacy-preserving age verification for certain pornographic services (Délibération n° 2024-20). https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000050385836
- Imperva — 2026 Bad Bot Report: Bots in the Agentic Age. https://www.imperva.com/blog/bad-bot-report-2026-bots-agentic-age/
- European Commission — EU KIDS Act initiative (17 September 2026). https://digital-strategy.ec.europa.eu/en/news/eu-kids-act-restrict-social-media-platforms-access-children-eu
Editorial note: This article is for general information and is not legal advice. Age-verification obligations and implementation timelines can vary by jurisdiction and service type. Organisations should consult the applicable legislation, regulatory guidance and qualified legal counsel before implementing a verification system. Last reviewed: October 2026.
Related
Share this post