The Data-Breach Cost Hiding in Privacy-Preserving Age Verification

"Privacy-preserving age verification" has become a label vendors print on a product page. It names an intention; it does not describe an architecture. A service can advertise privacy preserving age verification and still route a photo of a user's passport through a third-party provider that stores a copy for months. The label and the data path are two different things, and only the path protects the users behind the check.

The privacy of an age verification check is not settled by which method verifies age, but by who holds the personal data and who learns the result. Privacy preserving age verification, done properly, means the checking party receives one yes-or-no answer about the user's age and keeps none of the underlying documents or reusable records. Most age verification hands a full copy of an identity to whoever asked. That gap is where a future data breach is built.

What 'privacy-preserving age verification' actually promises

Privacy preserving age verification has a precise meaning. Age assurance is the umbrella term regulators use for any process that establishes the user's age or age band, and it includes several method families. Within it, "privacy-preserving" is not a fourth method but a property of where the data goes.

To verify age, a service needs one fact: whether the user is over an age threshold before it grants access. Age verification does not require names, photographs, document numbers, or exact dates of birth. A privacy preserving age verification design keeps the data path short — the checking party asks one question, the system returns proof of age as a yes-or-no result, and it keeps nothing reusable. Methods that verify age this way collect less by design.

Two services can both verify age correctly and differ entirely on privacy. One collects government-issued IDs, sends them to a vendor, and stores the result; the other receives a signed attestation that the user's age clears the threshold and keeps no IDs. Both meet the same age verification requirement, and both confirm the person is one of the adults the threshold admits, yet only the second is a privacy preserving age check that minimises what the checker keeps.

Age assurance is not one method: verification, estimation, inference

ISO/IEC 27566-1:2025, the first international standard for age assurance systems, published December 2025, refuses to treat age assurance as one technique (10). The standard includes several method families — age verification against an authoritative source, age estimation, age inference, and successive validation — because each answers the age question differently. Each carries a different privacy cost, and these verification methods differ in what they collect.

Age verification checks an authoritative record — a document, a credential, or a government register — and returns a confirmed result. Age estimation does not verify; estimation methods estimate an age band from a signal such as a face. Facial age estimation runs facial analysis on a selfie and returns an age range, not a precise age. For example, the system can estimate that a face falls in a 25-to-30 band without a document, though facial analysis adds an accuracy band and biometric-data questions. Age inference derives age from other data a service holds to determine whether the user clears a threshold.

None of these methods is privacy preserving or privacy-invasive on its own. A document-based method can keep nothing; a facial estimation system can store every image users submit. Ofcom's Part 3 rules frame acceptable age assurance as "age verification, age estimation or a combination of both" (4), so privacy posture cuts across all method families — even traditional methods.

Why age verification laws push platforms toward uploading an ID

The pressure that produces the ID-upload default is statutory. Age verification laws across several countries and jurisdictions require companies to check the user's age and admit only adults to adult content or other age-restricted content. The UK's Online Safety Act 2023 makes services that host pornography run highly effective age assurance; France, Australia's social media age restrictions, and US state laws in Texas and California impose comparable mandates on access to adult content online. The FTC's amended Children's Online Privacy Protection Rule, with full compliance required by 22 April 2026, expands "personal information" to include government-issued and biometric identifiers (7).

Faced with a legal duty to verify age and personal liability for getting it wrong, companies reach for the method easiest to defend: requiring users to upload government-issued IDs. Collecting IDs produces an audit trail, and it is the age verification method most companies use. It is also the most privacy-hostile way to answer a yes/no question, because it routes passports and driving licences through the service and often a third-party vendor. Age verification laws require an age check; companies hear a duty to collect and store IDs.

These mandates land on businesses. The websites that publish adult content, the app stores that distribute age-restricted apps, and the platforms that host uploads all carry the compliance duty, and many face penalties or litigation. The businesses in scope must comply, and to comply most reach for the government issued ID upload — a government id that keeps minors out while letting adults through.

The Online Safety Act and 'highly effective' age checks

Ofcom's Part 3 guidance, published 16 January 2025, sets the bar for age verification under the Online Safety Act at "highly effective age assurance" (4). A method is highly effective, Ofcom says, when it is "technically accurate, robust, reliable and fair" and "easy to use and work for all users". Providers must handle personal data in line with data protection law. These criteria weigh accuracy and reliability to ensure a dependable result; they do not mandate an ID upload, and accept estimation among the options a service can use to control access.

Every criterion measures whether the age verification works, not who keeps the evidence. A platform can pass every "highly effective" test with a design that uploads and stores a copy of every user's passport, because data handling is delegated to separate data protection law. The duty to protect children from harmful content is real, and the duty to protect minors online is not in question. It does not create a duty to build an identity honeypot, and young users are not served by one.

The real question: who holds the data and who learns the result

Once age verification is legally required, the design question is not which method a platform picks but what data gets collected, who stores it, and who learns the result. A copy-of-ID flow collects far more personal data than the purpose needs, shares it with at least one third party, and keeps it as a reusable record. Each extra user enlarges its database of IDs and concentrates the privacy risks in one point of data collection.

The ICO's toolkit for age assurance warns that data collected for age verification "should not be re-used for purposes such as profiling for advertising" (6). Once a third-party provider holds those passport images, they face onward sharing and misuse. Document-upload age verification concentrates sensitive personal information — sensitive data with real value to steal — where the security risks and the data security burden grow with every user verified.

These risks are not hypothetical. CDT argues that age verification systems which store identity documents create civil-liberties risks — risks to fundamental rights, to free expression, and a standing surveillance risk — and that privacy preserving designs should minimise what the verifying party keeps (11). New America's Open Technology Institute contrasts document-upload flows with methods that let a service learn only whether users clear a threshold (12). Both point to the shift from high-risk retention to data minimisation — the shift that separates traditional KYC from a Zero-Knowledge KYC architecture.

Data minimisation and the copy-of-ID problem

Data minimisation is the principle that a service should collect and keep only the minimum personal data needed for the task, limited to that specific purpose. It is one of the standards in the ICO's Age Appropriate Design Code, which requires online services to "collect and retain only the minimum amount of personal data" for the element a child is engaged in (5).

A copy of a passport answers one question and creates a hundred more. It reveals a holder's full name, nationality, document number, and exact date of birth to confirm one fact. A yes/no age question is not an identity question. It is a single-bit question wearing an identity document's clothes. A design narrowly tailored to that purpose strips the answer back to the one bit that is needed.

How a zero-knowledge proof answers a yes/no age question

A zero knowledge proof is a cryptographic method that lets one party prove a statement is true without revealing the data behind it. Applied to age, zero knowledge proofs let users prove "over 18" is true without disclosing their date of birth, name, or source document. The checking party learns one fact — the age threshold is met — and nothing more.

The W3C Verifiable Credentials Data Model 2.0, published 15 May 2025, notes that zero knowledge schemes let a holder prove a claim without revealing the credential — its example derives "the presented value over the age of 15" from a credential "containing the claim date of birth", "in a manner that is cryptographically verifiable" (8). That is the yes/no age answer, produced from a date-of-birth claim the verifier never sees — and it builds on how a verifiable credential attests to a single claim.

European age verification frameworks require this pattern. Regulation (EU) 2024/1183 — eIDAS 2.0 — requires the EU Digital Identity Wallet to enable "selective disclosure of attributes", so users prove their age "without revealing their full identity or other personal details" (2). The wallet is built so a service "allows users to prove they are over 18 without sharing any other personal information" (1): it provides a cryptographic proof, and the service "receives only the age confirmation and no other identifying information" (3), following the EU Digital Identity Wallet's selective-disclosure model. These cryptographic proofs work across EU member states.

Underneath sits a three-party model: an issuer verifies the user's identity once and signs a credential, the user holds it, and a verifier receives only a derived proof. NIST's SP 800-63-4 points the same way, describing subscriber-controlled wallets that share only the credentials a service needs (9). These standards form one spine, and the age verification pattern a Zero-Knowledge KYC attestation implements gives a platform a verified age_over_18 or age_over_21 result without the document or date of birth behind it.

Comparing the three privacy postures of age-assurance methods

Comparing age verification solutions on accuracy alone misses the axis that decides privacy. The useful comparison ranks age assurance methods by who holds the personal information and who learns the result, not by how precisely each measures the user's age. Each approach differs on how much it requires users to hand over for access — really a question of user trust and user privacy.

The document-upload posture maximises what the checking party learns and what a third party keeps. Age estimation reduces that exposure but retains biometric data in many builds and returns an accuracy band — vendors that offer estimation can estimate an age without a document, yet the biometric image often stays on a server. Only the attestation posture supports blind, tracking-free proof: it can prevent tracking, preserve anonymity, and hold nothing reusable. It is also the more accessible route, with less friction and no upload for access. Privacy preserving methods are not the ones with the friendliest policy; they are the privacy preserving approaches where the data path makes an incident irrelevant.

What a verifier-private age attestation looks like in practice

This is the approach we take at Verifyo, and the one we offer to platforms running an age check. A platform integrating our REST API runs age verification and receives, for its users, an age_over_18 or age_over_21 boolean with a verification status — a secure, verified result and nothing more. It never receives its users' documents, their dates of birth, or a reusable record of their personal data. The booleans derive from a document-based identity verification done once at Level 1; the attestation provides the result, not the document.

Scope must be stated precisely, because a privacy preserving claim only holds if it is honest about its edges. Verifyo runs age verification at Level 1 and issues the attestation at verification time. It does not verify a physical residence address — the country-of-residence field is self-declared, not verified — and Verifyo does not run ongoing transaction monitoring or continuous re-screening of an existing attestation. Those are separate problems handled by separate tools. For the question privacy preserving age verification has to answer — is the user over 18, or over 21 — the platform gets the result and holds none of the underlying personal data.

Because the attestation is derived once and reused across integrated platforms, users verify age a single time rather than uploading IDs to every service that asks for access. That is what ensuring compliance without hoarding data looks like: for the companies and businesses that must comply with age verification laws — the websites and platforms in scope — the solution has to ensure the age check works while keeping the personal data it never needed out of its own systems.

Choosing an age check that survives a data breach

The "privacy-preserving" label is not what protects users; the data path is. One age verification check hands a reusable copy of an ID to a third party; another returns a single verified result and keeps nothing. The method matters less than where the personal data ends up.

For anyone evaluating age verification solutions, the test is narrow. Ask who holds the personal data after the age verification completes, and what the platform learns beyond the age result. The method that carries the fewest retention risks, and protects users' rights while it does so, is the one to prefer. As selective wallets and issuer-signed attestations gain momentum and emerging standards converge, the privacy preserving age verification worth adopting is the design that answers the age question and becomes nobody's next data breach.

Sources

1. European Commission. EU age verification solution. Blueprint published 14 July 2025; feature-ready 15 April 2026. https://digital-strategy.ec.europa.eu/en/policies/eu-age-verification
2. Regulation (EU) 2024/1183 (eIDAS 2.0 / European Digital Identity Regulation). Official Journal, 30 April 2024. https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L_202401183
3. European Commission (EU Digital Identity Wallet). The Age Verification Manual — EUDI Wallet use case. 2026. https://ec.europa.eu/digital-building-blocks/sites/spaces/EUDIGITALIDENTITYWALLET/pages/930450954/The+Age+Verification+Manual
4. Ofcom. Part 3: Guidance on highly effective age assurance (Online Safety Act 2023). Final guidance published 16 January 2025; statement version 24 April 2025. https://www.ofcom.org.uk/online-safety/protecting-children/age-checks-for-online-safety
5. ICO. Age appropriate design: a code of practice for online services (Children's Code). In force since 2 September 2020. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/age-appropriate-design-a-code-of-practice-for-online-services/
6. ICO. Age assurance (data protection audit framework — age appropriate design toolkit). https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/age-appropriate-design/age-assurance/
7. US Federal Trade Commission. Children's Online Privacy Protection Rule — final amendments. Federal Register 22 April 2025; effective 23 June 2025 (full compliance by 22 April 2026). https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule
8. W3C. Verifiable Credentials Data Model v2.0 (W3C Recommendation). 15 May 2025. https://www.w3.org/TR/vc-data-model-2.0/
9. NIST. SP 800-63 Digital Identity Guidelines, Revision 4. 2025. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63c-4.pdf
10. ISO/IEC. ISO/IEC 27566-1:2025 — Age assurance systems — Part 1: Framework. Published December 2025. https://www.iso.org/standard/88143.html
11. Center for Democracy & Technology. Mitigating Risk to Rights with Age Verification: Privacy-Preserving Guardrails. 2025. https://cdt.org/insights/mitigating-risk-to-rights-with-age-verification-privacy-preserving-guardrails-that-should-accompany-deployments-of-age-verification-approaches
12. New America (Open Technology Institute). Exploring Privacy-Preserving Age Verification. 2025. https://www.newamerica.org/insights/exploring-privacy-preserving-age-verification/