Common views shared by members of the AVPA

The Age Verification Providers Association is a politically neutral trade body.  We represent all elements of the age-assurance ecosystem, not favouring one approach or technology over another, and including both B2C and B2B organisations. 

Members nevertheless broadly share some common views on issues relevant to the sector.  In summary, we support independent, technology-neutral and evidence-based age assurance that is proportionate to risk, certified to common international standards, interoperable, privacy-preserving, accountable and inclusive, and delivered through an open and competitive market.

Foundations

Age Assurance Methods

We recognise a wide range of methods of age assurance, from traditional database and ID document-based age verification checks through to biometric age estimation and age inference from non-age related information about a user.

We are technologically neutral, but recognise that different forms of age assurance achieve differing levels of assurance in the context in which they are used. 

Regulators should specify the required outcome or level of assurance for each classified risk level rather than mandate particular technologies. 

For higher-risk use-cases with a specific, legally-enforceable age limit, age estimation and inference can provide equivalent confidence to regulators and courts as age verification: 

• age verification requires appropriate measures to establish the authenticity of the evidence relied upon and, where necessary, sufficiently bind that evidence to the user presenting it;
• age estimation will generally require an appropriate threshold or buffer, determined by independently measured performance and the acceptable false-positive rate for the use case; and
• age inference may require a greater number of data points to be effective, making it potentially more appropriate for existing users.

Age verification is necessary when a specific date of birth is a requirement. 

Age versus identity

Age can be derived from a digital identity, but age is not simply a subset of identity as it can be ascertained without ever knowing a user’s full identity e.g. with voice or facial estimation.

Quality and assurance

Measurement

We adopt a common approach to measuring the accuracy and effectiveness of different methods of age assurance, grounded in relevant international standards. Measures may include false-positive and false-negative rates and, for estimation techniques, measures of estimation error, distribution and performance around the relevant age threshold. 

Accuracy can be combined with other factors to meet specified standard levels of assurance. For example, other aspects that contribute to the strength of the age check include:

• the prevention of fraudulent use (spoofing), 
• the strength of authentication (ensuring the user claiming the age is the person to whom the evidence of age belongs).  
  • reused age checks and evidence derived from another source require appropriate measures to bind the result to the user presenting it. 
  • where biometric age estimation is performed live, the assessment is inherently associated with the person presenting themselves at that moment. 
• the minimisation of bias across protected characteristics.

Standards 

We support common international standards for age assurance to maintain the quality, reputation and integrity of the ecosystem.

We support a co-regulatory approach, where regulators recognise certification against international standards provided by accredited auditors.

We encourage the use of test purchasing, both face-to-face and online, to provide assurance that technology and processes are working effectively together, and to demonstrate due diligence.

Effectiveness in practice

Positioning of age controls

We support a layered approach to child protection, recognising no technology will be 100% effective.

We recognise the benefits of app-store and OS level signals set by parents when implementing legislation requiring parental consent or controls.

Where upstream age signals are relied upon to meet regulatory requirements, they should be subject to equivalent requirements for assurance, independent assessment and accountability as other forms of age assurance. 

The service exposing the risk is uniquely placed to assess risk and control access, so should generally be responsible for the access decision. It may rely on upstream or reusable age signals that it knows meet the required level of assurance, but simply declaring an age rating and leaving filtering to the browser or OS does not discharge that responsibility. 

Circumvention

Determining age enables relying parties to apply age-appropriate protections. It does not replace safer design, moderation, parental controls, law enforcement or other safeguarding measures.

We acknowledge that no technology is immune from attack, but are confident technology can mitigate known and emerging risks to maintain a highly effective age assurance ecosystem.

We support the application of age assurance in proportion to the level of risk, with the highest-risk use-cases requiring the most rigorous checks to prevent circumvention, including presentation and injection attacks, collusion and credential sharing.  

Device binding using native authentication can provide an effective and proportionate protection against credential sharing where it meets the required assurance level. 

Binding, as with all requirements, should be outcome-based not technologically specific. . 

Claims about the effectiveness, privacy and accuracy of age assurance should be based on independently verifiable evidence and comparable testing.

Geolocation

Location assurance is part of a layered approach and should be proportionate and privacy-preserving.

VPN circumvention is a risk to be addressed in proportion to the harm, and any position on VPNs should respect their legitimate privacy and security benefits for users of all ages.

Privacy and data

Data minimisation

Age assurance should disclose no more information than is necessary for the relevant purpose. Where a relying party only needs to know whether a user is above or below an age threshold, it should not ordinarily receive the user's identity, date of birth or the evidence used to establish their age.

Personal data used for age assurance should not be retained or repurposed beyond what is strictly necessary to provide, improve and audit the service or comply with applicable legal obligations  including full transparency about the limited extent of any legitimate data retention after age has been established. 

Privacy

Privacy should be designed into age assurance systems rather than treated as a trade-off against effectiveness. 

We encourage the inclusion of at least one option for “doubletriple-blind” interactions so that, as a result of the age assurance process:

1. Relying parties do not receive any personal data from users,
2. Age assurance providers and credential issuers, including government, cannot know which relying parties an individual user accesses,
3. The operating system, app-store or any other underlying platform also cannot know which relying parties an individual user accesses.

Market and ecosystem

Competition 

We champion an open and competitive global market in the provision of age assurance.  For this reason, we oppose market-dominant platforms using control of operating systems, app stores or other essential infrastructure to establish themselves as exclusive or privileged providers of age assurance to relying parties. 

Where such platforms provide age signals, these should support an open, competitive ecosystem and should not prevent relying parties from using independent providers. 

A user or relying party should not ordinarily be forced to use a single age assurance provider simply because that provider controls an OS, app store, identity wallet or other infrastructure.

We also support independent provision of age assurance in general because: 

• Relying parties may be dependent on users being a certain age to earn revenue; 
• Independent providers can be more easily regulated, 
• Independent providers create organisational separation of any personal data if it is temporarily used in an age assurance process, 
• Independent providers have more to lose as their entire business reputation rests on the legitimacy of their age checks.

If a relying party does wish to conduct its own checks “in-house” we believe it should be subject to the same level of independent audit and be required to achieve the same certification as we encourage our members to secure.

Interoperability and reusability 

Interoperability allows you to use the same age check across multiple relying parties. We encourage interoperability between providers to improve the user experience and reduce the need for users to repeat age checks.

Interoperability networks should ensure that participating providers meet equivalent standards when stipulated and clearly communicate the levels of assurance delivered.

Interoperability should enable age assurance to be reused without requiring a persistent identifier that allows different relying parties to link an individual's activity across services.

Any regulatory framework needs to envisage and technically enable one or more commercial models that will support a sustainable market to deliver age assurance. 

Government ID and state wallets

Government-issued credentials and state-provided digital identity wallets are a high-assurance source of evidence.

They should not be mandated as the sole or privileged route to compliance for private sector use-cases.

Independent providers, certified if legally required, should be able to consume such credentials and build services upon them.

Roles and inclusion

Accountability

Relying parties should remain responsible for selecting and applying an appropriate level of age assurance and overall compliance with legal and regulatory obligations.

Age assurance providers should be accountable for the performance of their services and the assertions they provide, with responsibilities between providers, intermediaries and relying parties clearly established through applicable law, standards and contractual arrangements. 

Where an age assertion is reused or passed between organisations, responsibility and liability should be clear throughout the chain, including the level of assurance associated with the assertion.

Enforcement and safe harbour

We support robust enforcement, including against offshore non-compliant relying parties, because non-enforcement punishes compliant relying parties and displaces users to riskier sites.

A relying party that uses a certified provider at the required level of assurance should benefit from a presumption of compliance.

Accessibility and inclusion 

No single method works for everyone. Users should normally have access to alternative methods so people without, for example, passports, credit histories, smartphones or suitable biometric characteristics are not excluded. 

Policy and organisational

Policy neutrality

We support the UN Convention on the Rights of the Child, and the right to freedom of expression in accordance with applicable constitutional provisions and statutes.

We see age verification, age inference and age estimation as being a key building block to governments and regulators achieving their online safety objectives, and support the development of consistent legislation and regulation around the world, to allow age checks to be applied consistently and efficiently.

We do not lobby for age-restrictions to be adopted for specific use-cases or at particular ages, except for adult content where we share that industry’s position that its content should not be accessed by minors.

We correct material misinformation about the capabilities, limitations, privacy and effectiveness of age assurance, whether that misinformation is advanced in support of or opposition to a particular policy. 

AVPA representation

These common views provide the basis on which authorised representatives may speak publicly on behalf of the AVPA.

They do not require every member to agree with every statement in full, nor to hold identical views on individual legislation, regulatory proposals, technical implementations or commercial models.

Authorised representatives may apply and interpret these principles in responding to developments, including where an immediate response is required. Where an issue would establish a materially new policy position that cannot reasonably be derived from these principles, the Association will consult the co-chairs, executive committee or members as appropriate at the earliest opportunity and before confirming any formal position.

Any submission to a regulator, legislator or standards body that takes a substantive, new position on technical architecture or method, including binding, storage or biometric processing, will be circulated to members with a comment window of at least five working days. Where a statutory deadline makes that impossible, it will be circulated when it is submitted. Members may have dissent recorded, and the Association will not describe a position as a common view where members have dissented. 

The Association does not comment on the individual commercial, legal or regulatory matters of its members, and does not endorse individual members’ products or services.

Updated 20 October 2026