Age Assurance: EU Age Verification Rules for Kids Online

A mom in Ohio gets a notification: her 12-year-old's gaming account has been frozen. Not because he broke a rule. Because a new age check flagged him as "unverified" and locked him out until someone proves how old he actually is. No warning. No easy fix. Just a wall.

That's not a hypothetical. It's close to what's coming for millions of families in Europe, and honestly, it's a preview of what's coming everywhere else too. On September 17, 2026, the European Commission proposed something called the EU KIDS Act, and buried in the fine print is a plan for age assurance (checking how old someone is before letting them use a service) that will touch social media, app stores, video games, and AI tools all at once. Not just the sketchy corners of the internet. Everything.

TL;DRAge assurance is about to become part of ordinary internet life in the EU, and the real fight isn't whether kids need protecting, it's whether platforms will actually avoid scanning faces and IDs to do it, or just say they did.

Here's the part that should make you sit up: kids under 13 would face outright account bans on certain platforms. Older kids get "tiered" access, meaning what they can see and do depends on which age bracket they land in. And it's not just Instagram and TikTok anymore. App stores would have to check ages before letting anyone download an app. That's a much bigger net than most parents realize is being cast.

---

Why child verification is suddenly everyone's problem, not just social media's

For years, "age verification" meant typing in a birthday and clicking a box. Anyone with a calculator (or a kid who can count to 18) could get past that in about four seconds. Research cited around this proposal found that 78% of children between 10 and 15 routinely get around minimum age limits, precisely because self-reported birthdates are basically an honor system with zero enforcement. Regulators finally admitted the obvious: that system was never really working.

So now the EU is asking platforms to prove, not just ask, how old someone is. And that's where age assurance technologies come in, meaning the actual tools and methods, software estimating a face's age range, ID document checks, digital wallets, that companies would use to sort users into buckets. The Commission's own research arm laid out something like ten different methods in a taxonomy, each with different tradeoffs between how accurate it is and how much personal information it demands. That tradeoff is the whole story here.

Does "age assurance" mean the same thing as scanning your face?

No, and this is the part people get wrong immediately. Age assurance is the umbrella term for any method that checks someone's age, and face scanning is just one option under that umbrella, and arguably the one regulators like least. The EU's preferred path is something called the EUDI Wallet (a digital ID app on your phone that can prove you're old enough without showing your actual birthdate or face to the website). It's designed to answer a yes-or-no question, are you old enough, without spilling your identity everywhere. This article is part of a series, start with Deepfake Ai One Public Photo Is All Blackmailers Need.

Now, does age assurance sound like a "solved problem" once you slap a wallet app on it? It really shouldn't. The wallet doesn't exist at scale yet. Adoption is basically starting from zero across most of the EU's 27 countries, and platforms are being told to build compliance systems around a tool that most of their users don't have installed. That's like being told to accept a new form of ID that few of your customers actually carry.

---

What EU age assurance rules actually require from platforms and families

The Commission's guidance is oddly blunt for a regulatory document. It tells companies to avoid processing identity documents and biometric data (your face, voice, or fingerprints, the physical stuff that's uniquely you) wherever possible. That's a real stance, not just legal cover language. It means the EU is explicitly trying to prevent a future where every 14-year-old's face gets scanned and stored just to watch a video or download a game.

The tech industry has warned the proposal doesn't adequately specify implementation mechanisms, and the EUDI Wallets don't yet exist at scale, meaning platforms may simply restrict access to EU users rather than build the compliance infrastructure required.

reporting via Biometric Update

But here's the uncomfortable truth: telling a platform to be careful with your kid's data and giving that platform an actual working alternative are two different things. Compliance measures like keeping no identification on file, deleting facial images fast, processing images on the device instead of a server, and encrypting everything, those are all technically doable. They're just expensive and slow to build correctly. And a lot of the companies affected by this aren't Meta or Google. They're small game studios and app developers who will pick whatever tool is cheapest and fastest, and worry about regulators later.

Which age assurance measures give families the least invasive proof?

The measures that give the most privacy protection tend to be the ones that answer a single yes-or-no question rather than pulling a full identity file. A wallet-based check that confirms "over 16" without revealing a birthdate, name, or photo is a lower level of exposure than uploading a driver's license or letting an app scan your face. If you're a parent deciding what to allow, the fewer details a check demands, the better.

New Zealand reached age assurance conclusions through its own separate review process, landing on a similarly cautious posture, favoring proportional checks over blanket ID demands. That's a useful comparison point because it shows the EU isn't alone in wrestling with this. Different countries are taking different routes to the same destination, and almost none of them have landed on a single winning method yet. Previously in this series: Baby Passport Photo Why A Parents Hand Gets It Rejected.

Verification approach	What it actually demands from a child user
EUDI Wallet check	A yes or no signal on age; no face, no ID document, no birthdate shared with the platform
Facial age estimation	A live scan of the child's face processed to guess an age range, then ideally deleted
ID document upload	A copy of a passport, license, or national ID, including full name and exact birthdate
Self-declared birthdate	A typed number with zero verification, the method regulators say is failing 78% of the time

---

The gap between what age assurance promises and what platforms will build

Look, nobody's saying kids don't deserve safer spaces online. They absolutely do. The question CaraComp keeps coming back to is simpler: can a platform prove someone is old enough without demanding more personal information than the situation actually calls for? If you've ever wondered whether a website really needs your child's face or full identity just to let them scroll a feed, that's the exact tension this whole proposal is trying, and mostly failing so far, to resolve.

One thing you can actually watch for, right now, before any of this becomes law: check whether a platform asks for a yes-or-no age signal or a full identity document. That single detail tells you almost everything about how seriously a company is taking data minimization. If an app wants your kid's ID card to prove they're 13, that's a company choosing the easy, invasive path instead of building something better.

This matters most for age assurance decisions happening quietly in the background of everyday online apps. When a service relies on age verification that only asks a yes-or-no question, it collects far less than a service that demands a birthdate or photo, and that gap in security and children's exposure is exactly what regulators are trying to widen in the kids' favor.

What is the current level of certainty around EU verification enforcement?

There isn't much certainty yet, and that's the honest answer. The proposal sets goals and preferences, but the EUDI Wallet infrastructure it leans on is still being built out across member states, adoption is inconsistent, and platforms haven't publicly committed to specific tools. Expect a messy, uneven rollout where big platforms comply loudly and small ones quietly do the minimum, or nothing, until someone gets fined.

Here's what nobody's saying out loud: the EU didn't solve the age check problem. It just wrote down, very carefully, what a good solution would look like, and handed the actual building of it to companies who have every incentive to cut corners. Every family in Europe is about to become a test case for whether "protect the kids without hoovering up their data" is a real standard or just a nice sentence in a policy document. Watch which platforms ask for a simple yes or no, and which ones ask for a face. That's the tell.

age assurance: Frequently Asked Questions