Age assurance: What makes for the maturity of a technology or an industry?

profile picture Chris Field 7 min read

Last week, the Australian government decided against the eSafety Commissioner’s recommendation of a pilot before requiring adult sites to verify the ages of visitors. They said this was due to concerns about the privacy of people’s data and the maturity of age assurance technology.

So what exactly would constitute a mature technology? Is it something comparable to NASA’s Technology Readiness level? This suggests the technology needs to have gone through a thorough process of research and prototyping, before testing in a live environment and then ultimately rolling it out.

If that’s the case, we can say that Yoti and other age assurance providers have met the mature technology requirements. After all, some of the largest platforms in the world, including Facebook, Instagram and OnlyFans, have been verifying the ages of their users for over a year.

Or is the concern more around the maturity of the industry? A sensible set of questions to determine the maturity of an industry might include:

  • Is there a healthy ecosystem of providers?
  • Are there standards in place?
  • Has it been adopted by global organisations?
  • Are there independent audits with consistent measurement?
  • Has there been transparent benchmarking at scale?
  • Is there an established trade body?
  • Has any sectoral research been done?
  • Have there been any regulatory reviews in other jurisdictions?

We’ve answered these questions to help others trying to determine if age assurance is a mature technology and industry.


Is there a healthy ecosystem of providers?

The German government regulator (KJM) has reviewed and approved over 100 methods of age assurance over the last decade.

This includes approving several facial age estimation approaches. There are numerous different providers with a range of options. They have an agreed safety buffer of five years over the threshold age for users to access adult content.


Are there standards in place?

There has been a publicly available specification for age assurance since 2018 with PAS 1296:2018. In the UK, Minimum Standards for Age Assurance were drawn up as a bill and presented by Baroness Kidron in 2021. These were widely welcomed by industry in the UK. Additionally, there are international IEEE and ISO standards which work through the standards development process. The first of these is due to be completed in the coming months.


Has it been adopted by global organisations?

Global organisations such as Instagram, Facebook, OnlyFans, Yubo, NCR (National Cash Registers), Diebold and SuperAwesome have integrated our facial age estimation technology into their platforms.

Yoti, as one company alone, has delivered over 600 million age assurance checks for more than 100 customers in over 100 countries globally. When users around the world are presented with different ways to prove their age, over 80% opt for facial age estimation.


Are there independent audits with consistent measurement?

Independent audits are undertaken by bodies such as the Age Check Certification Scheme (ACCS) and NCC Group, as far back as 2020 and 2019 respectively.

Age assurance technology is developing quickly. As such, it is important to create an aligned approach to age assurance. This work has been commissioned by the Digital Regulators Cooperation Forum and undertaken by ACCS. The research also discusses what ‘state-of-the-art’ age assurance looks like:

“In terms of measurement, ‘state-of-the-art’ is best described as the layer of technology that sits between those technologies that are within existing scientific knowledge and research but may not yet be commercially viable services; and those technologies that are so embedded in everyday life and usage, they have become generally accepted rules of technology.”

a diagram titled "objective approach to state-of-the-art". It places state-of-the-art technologies on a scale, with "generally accepted rules of technology" on one end and "existing scientific knowledge and research" on the other. At the intersection of the two is a section labelled "state-of-the-art".
Source: Measurement of Age Assurance Technologies, Part 2 – Current and short-term capability of a range of Age Assurance measures. OFCOM. Figure 3.

Has there been transparent benchmarking at scale?

Accredited testing labs, such as iBeta, already test for liveness to NIST-specified levels. NIST has also started a regular global benchmarking programme for facial age estimation. Due to its scale, this benchmarking programme will include a statistically significant sample, which is likely to be over one million individuals. In comparison, the sample in Australia was based on just 14 individuals, aged 3 to 21.

We’ll soon be publishing an updated facial age estimation white paper as we continue to improve our accuracy and bias levels. We publish these levels transparently using the proposed standardised measurement approaches.


Is there an established trade body?

Age Verification Providers Association (AVPA) is a global trade body for independent providers of age assurance technology. They currently represent 26 industry provider members, many of which provide facial age estimation.


Has any sectoral research been done?

Market intelligence organisation Liminal conducts regular reviews and updates on the sector. In addition, the Future of Privacy Forum has materials describing the range of facial technologies. They make a clear distinction between 1:1 facial recognition, 1:many facial recognition, and facial analysis or characterisation.

Family Online Safety Institute (FOSI) has published a paper reviewing age assurance. In this, they state that “improving age assurance systems has the potential to significantly increase online safety for all users. It is an achievable goal that everyone can unite behind, and will take a combination of innovative technology, transparent and trustworthy practices, and thoughtful regulation that sets a floor for industry to meet and exceed. Every online ecosystem can benefit from having some type of age assurance. This includes e-commerce and online marketplaces, gaming, streaming, news, and other platforms that could offer safer and more age appropriate online experiences”.


Have there been any regulatory reviews in other jurisdictions?

Regulators around the world are reviewing age assurance with many referring to age verification and estimation approaches in regulation.

In the UK, the Information Commissioner’s Office’s (ICO) 2021-2022 regulatory sandbox concluded that “Yoti’s age estimation tool has demonstrated that it is, in some contexts, possible to use biometrics to make a decision about an individual or treat them differently without using that biometric data for the purpose of uniquely identifying that person”.

The ICO also concluded that our technology is distinct from facial recognition because it does not uniquely identify anyone, and “will not result in the processing of special category data”’.

The German Association for Voluntary Self-Regulation of Digital Media Service Providers (FSM) awarded Yoti’s facial age estimation with their Seal of Approval in 2020. They found that the technology meets the required level to regulate access to content for minors.

This year, the French data protection regulator, the CNIL, stated in a report that “it considers acceptable the use of age verification by validation of a payment card or a process of facial age estimation based on facial analysis without facial recognition”.


Facial age estimation is a privacy-preserving solution

In terms of the privacy concerns raised by the Australian government, Yoti (and many other providers) offer a range of privacy-preserving solutions. Facial age estimation simply takes an image of a user’s face, converts the pixels of the image into numbers and compares the pattern of numbers to patterns associated with known ages. As soon as the age has been estimated, the image is permanently deleted.

Our Digital ID app lets the user share only their age, or an ‘over 18’ proof of age credential, with no other personal information. Document verification checks can also be configured so that no personally identifiable information (PII) is passed on to the website needing to do the age check.

If you’d like to find out more about our age assurance solutions, please get in touch.

Keep reading

An image of a person holding smart phone in their left hand. On the phone's display is a Yoti Digital ID showing their verified credentials. In the person's right hand is their physical UK driving licence. The person is holding the two forms of ID next to each other.

From physical to digital: how we transform your ID

There can be hidden beauty in things taking on new forms. A caterpillar becoming a butterfly, water turning into wine, a physical ID transforming into a Digital ID. If you’ve ever wondered how we do it, wonder no more. As we continue to shape the future of digital identity, we’ll continue sharing our methods with you. After all, the Digital ID app is created for you, so it’s only right we let you in on the magic.   What is a Digital ID? A Digital ID is your ID on your phone and your data in your hands. It gives

5 min read
An illustration of a padlock with the Yoti logo sitting at the centre. Alongside this are three smaller icons showing that the app is free (represented by a crossed out pound sign), cannot be hacked (represented by a crossed out pickaxe) or seen by any third parties (represented by a crossed out eye)

How we keep your Digital ID private and secure

We’re committed to making the digital world safer for everyone. Yoti was created as we wanted to give every person a secure way of proving their age or identity. It’s quite literally why we exist. So it only made sense that we’ve built our Digital ID app with privacy and security at its core. We’re building technology that makes it easier and safer for you to go about your business, but that doesn’t mean we have to know your business. Just as the right to an identity is a fundamental human right, so is the right to privacy. And we’ll

6 min read

Effective facial age estimation: a privacy-preserving approach to age assurance

For platforms to deliver age-appropriate content, they need to know the age of their users. Age estimation technology can provide an inclusive and accessible solution. It’s possible to estimate a person’s age from a number of features, including their voice, face, palm or fingerprints. Some age estimation methods are very accurate. Others collect little or even no personal data. But very few can do both. When done to a high standard, effective facial age estimation can offer a high level of privacy and a high level of assurance.   Age estimation in the real world Consider the following situation: a

8 min read