Age assurance has moved from a compliance checkbox to a core part of how social platforms, dating apps, and adult sites operate. Regulators in the UK, the EU, and Australia now expect far more than a date-of-birth field. They expect a system that can establish someone's age, resist the people trying to fool it, protect privacy, and stand up to an audit. This guide is the map. It explains what age assurance is, what the rules require, how the technology fits together, and where every article in our series goes deeper. Whether you lead the business, own trust and safety, build the product, or supply the identity layer, this is the place to start.

In a Nutshell

• Age assurance is the whole system that establishes someone's age, not the single check at the center of it.
• Regulators in the UK, the EU, and Australia now expect a defensible process, so a date-of-birth field or a one-off scan no longer passes.
• Age assurance breaks into four parts: the regulation you must meet, the playbook for your sector, the system you design, and the way you run and buy it.
• Age estimation, age verification, and parental controls are all tools under the same umbrella, and the right mix depends on your risk.
• This page maps the whole series and hosts pre-registration for the full 2026 guide.

What is age assurance?

Age assurance is the umbrella term for any method that establishes a person's age or age range online. It covers age estimation, which reads a likely age from a selfie, and age verification, which confirms age from an ID or a trusted record. Parental controls and self-declaration also sit under the umbrella, though they give the least confidence in the answer.

Assurance means confidence. A method only gives you a signal, and assurance is how far you can trust that signal given the risk you are managing. A dating app keeping minors out of an adult space needs more assurance than a news site personalizing a homepage, and the same tool can be right for one and wrong for the other.

In practice the methods form a spectrum. Self-declaration asks the user and trusts the answer. Age estimation reads a signal such as a face and returns a likelihood. Age verification checks a document or a trusted record and returns a firm result. Parental controls hand the decision to an adult. Most real systems combine several, starting with the least intrusive method that fits the risk and escalating only when the answer is not clear enough.

Why an age check is not a system

For years, age was a box on a signup form. The user typed a date of birth, the platform stored a number, and the problem seemed solved. That worked only because being wrong carried no real cost. That era is over.

An age check is one moment. Age assurance is everything around it: who gets checked, when, at what threshold, with what fallback when the answer is uncertain, against which attacks, with what data retention, and with what route to appeal. A single check answers none of that on its own. Effectiveness comes from the architecture, not the individual method. That is the thread running through every article below.

The gap shows up in small, ordinary failures. A teenager retries an estimate until the model guesses high. An adult with an unusual face is turned away with no way to appeal. A platform passes its check but keeps every image and becomes a breach waiting to happen. None of these is a failure of the check itself. Each is a failure of the system around it.

The four parts of the age assurance landscape

The series is organized into four parts. Regulation sets what you must achieve. The industry playbooks translate it for your sector. System design turns the rules into architecture. Running and buying covers how you evaluate vendors, then operate and prove the system once it is live. Read them in order, or jump to the part that fits your role.

What do the age assurance regulations require?

The rules are arriving fast, and they do not all say the same thing. The UK's Online Safety Act, the EU's emerging framework, and Australia's minimum-age regime differ on scope, acceptable methods, and privacy expectations. These articles cover each one, plus the identity infrastructure underneath them.

• The EU Age Verification App: Five Problems It Doesn’t Solve
• Ofcom's first age assurance report, what it means for social, dating, and adult platforms
• Ofcom and the ICO want the same thing, age checks that work and data you don't keep
• Australia's social media age ban, the technology works but does the system?
• eIDAS 2.0 and age assurance, age as a reusable digital attribute
• EU age verification laws by country, what changes at every border

The playbook for your sector

Adult sites, social platforms, and dating apps share the same architecture but carry very different stakes. Each playbook covers the method options, the conversion impact, and the privacy line for that sector.

• Age verification for adult sites, meeting the OSA without losing your audience
• Age assurance for social platforms, from minimum-age laws to age-appropriate design
• Age verification for dating apps, keeping minors out without killing signups

How to design the system

Once you know the rules and your sector, you design the system. These articles cover the thesis, how to set a threshold, the estimation-first waterfall, and the threat model that keeps attackers out.

• Your age check is not an age assurance system
• Challenge 25 is a policy, not a model, how to set an age-estimation threshold
• Building an age assurance waterfall, estimation first, then escalate uncertainty
• How fraudsters beat age checks, and how to stop them

How to run and buy age assurance

A system is only as good as how you operate and procure it. These articles cover reading benchmark results, using a buyer's guide, the metrics that predict failure, designing for the users you might exclude, audit packs, procurement, and a build tutorial.

• How to read NIST age estimation results without being misled by rankings
• How to use the age assurance buyer's guide, and what it can't tell you
• Age estimation after launch, the dashboard metrics that predict failure
• When age verification gets it wrong, designing for the users your system excludes
• What belongs in an age assurance audit pack, before the regulator asks
• How to procure an age-estimation vendor, questions that separate a demo from defensible assurance
• Tutorial, adding facial age estimation to your web app with YouAge

Where Youverse stands

We build the evidence layer these systems rely on. Most users will never start with a credential, so YouAge estimates age from a single selfie in under a second and stores no biometric data. Where stronger proof is needed, YouLive guards the input against presentation and injection attacks, independently tested to ISO/IEC 30107-3, so a real person clears the gate and a deepfake does not. YouID and YouAuth support reusable credentials bound to the person who created them, with no central biometric database. What stays yours is the decision, who to check, at what threshold, and what to do when the answer is uncertain. We make each piece of evidence trustworthy, and you own the architecture.

The full Age Assurance Guide, recompiled and expanded for 2026, launches later this year. Pre-register now and get it first the day it ships.

Frequently asked questions

What is the difference between age assurance and age verification?

Age assurance is the umbrella term for establishing someone's age online. Age verification is one method under it, deriving age from a verified date of birth or a trusted attribute. Age estimation, which predicts age from evidence such as a face, is another.

Which regulations require age assurance?

The UK's Online Safety Act, Australia's minimum-age regime, and a growing set of EU rules all require it for services that can expose minors to harm. Scope, acceptable methods, and privacy expectations vary by country, so the right approach depends on where you operate.

Does age assurance mean storing biometric data?

Not always. Many systems can answer the age question and discard the evidence. Some retention can be justified, for example to investigate fraud or to hold audit evidence, but the goal is to keep the minimum necessary, protect it, and avoid building a central biometric database. Regulators increasingly favor methods that keep as little as possible.

How do I choose an age assurance method?

Start with your harm level, legal scope, the cost of letting the wrong person in, the cost of excluding real adults, how often users return, and the fallback routes you can offer. The method follows from the risk, not the other way around.