The question behind the product
Asking for a date of birth, or worse a photo ID, answers a yes or no question by collecting a database's worth of information you then have to secure, and a document you then have to store or discard correctly.
Every one of those records is a liability the moment it exists: a breach target, a data-minimisation problem waiting to be flagged, and often not even the strongest verification method available to you.
AgeVerify answers the same question with a cryptographic proof that reveals only that one fact, from a credential the user already holds, verified in seconds.
Nothing is left over to protect, to store, or to eventually explain.
The compliance crisis
Manual ID checks expose a customer's entire ID document (name, photo, date of birth, and number) just to prove a single fact.
Manual checks cause "ID fatigue" and long queues.
Revealing names, addresses, and exact DOBs exceeds what GDPR data minimisation requires.
Weak checks now draw real penalties: the UK's first age-assurance fines landed in 2025, more followed in 2026, and the EU is enforcing minor-protection rules under the DSA.
Why now
Age assurance moved from guidance to enforcement across 2025, and the wallet infrastructure it points at arrives on a dated schedule. Here is what binds today, what is still landing, and what is only a trend.
Ofcom enforces age assurance for services hosting pornography, gambling, and other age-restricted content. Self-declaration is explicitly insufficient, and the guidance points to methods it calls highly effective. Penalties reach 18 million pounds or 10 percent of global turnover, whichever is greater.
Minor-protection guidelines took effect in July 2025, and the ban on targeted advertising to minors has applied since October 2025. The Commission has opened formal proceedings against several platforms over age assurance. Germany, France, and Spain layer their own requirements on top, so there is no single unified EU standard yet.
A prototype is being piloted in five member states, Denmark among them. It signals the direction platforms here are being steered toward. It is a pilot, not a finished or universally deployed system.
Member states must offer a wallet by December 2026 and obligated private sectors must accept one about a year later. AgeVerify's wallet flow is built to the same standards, so it is ready as that infrastructure arrives at scale.
Guidance from the UK ICO and the Irish DPC increasingly stresses that age assurance must be effective for its purpose and proportionate to it. That reasoning favours cryptographic proof over document uploads, but it names no method and mandates none.
Several jurisdictions outside Europe are moving toward mandatory age assurance for minors on social platforms, Australia's under-16 ban being the clearest example. Evidence of where this is heading, not an EU requirement.
How it works
The user scans your QR code and approves the request in their AltID wallet. The wallet presents a signed credential over OpenID4VP, and selective disclosure means only the claims you asked for are shared. No ID document is ever uploaded.
Your service receives only the boolean over-18 proof. There is no date of birth, CPR number, name, or document to store, leak, or breach, which is exactly what GDPR data minimisation asks for.
Your service checks the signature, validates the credential against the query it asked, and verifies the presentation has not been tampered with. Then the flow continues.
Where it applies
Ranked by how much regulatory pressure is on them today, not by how many sectors we could list.
Adult and age-restricted content, including social
The most directly regulated category right now, and the one where proving over 18 without learning anything else is a materially different privacy posture than holding a birthdate. A breach at a platform that collected them is catastrophic in a way a zero-knowledge proof cannot be.
Age gating is already a hard licence condition
The sector already carries heavy identity checks, and often applies full document-grade verification to what is fundamentally a yes or no age question. A lighter age check sits alongside whatever KYC the licence requires, rather than replacing it.
Online and delivery, where no one checks ID at a counter
Today this is a self-declared checkbox, which does not hold up, or a document upload at checkout, which is disproportionate for a single threshold. Selective disclosure suits it: some thresholds vary by product, so a concrete value can be shared without the document behind it.
Also relevant for Gaming, where loot-box rules are still emerging · Events and venues, on speed and fraud rather than regulation · The narrow financial products where age alone is the gate
Technology and integration
We run it. The fastest way to a working age gate, with no infrastructure of your own in the path.
A container in your own environment, so the verification service runs inside your perimeter.
Your hardware, your network, your keys. For teams whose review will not accept a hosted dependency.
W3C Verifiable Credentials and Decentralized Identifiers, the same standards the EUDI Wallet is built on. Nothing here is proprietary to us.
Why Partisia?
Built on three decades of MPC expertise and academic pedigree from Aarhus University, our platform is engineered for enterprise scale. Deploy via Cloud, Docker, or on-prem to ensure your business is compliant, secure, and ready for the future of digital identity.
Book a demo
30 minutes is enough to see how AgeVerify proves age without exposing an identity document. Tell us about your use case and we'll be in touch within one business day.
Trouble loading the form? Email us at info@partisia.com and we'll get back to you within one business day.