Age assurance vs age verification vs age estimation

Which age check are you actually asking your users to do?

A teenager opens a new app and is asked to prove they are old enough to use it. What sits behind that prompt varies more than the user can tell. One method asks for a passport. Another reads a face through the device camera and estimates an age from it. A third relies on a record the person set up elsewhere, letting them straight through. To the user it all feels like the same request. To a product or compliance team choosing what to build, the differences decide conversion, cost and whether the check meets the law.

Age assurance, age verification and age estimation get used as if they mean the same thing. They do not. Getting the vocabulary right is the first step to choosing a method that keeps the right people out without turning away the people you want.

What is the difference between age assurance, age verification and age estimation?

Age assurance is the umbrella term. It covers age verification, age estimation or both. Verification establishes a person’s age against an authoritative source, such as an identity document or bank record, and aims at an exact date of birth. Estimation infers a likely age or age range without an official record.

What age assurance means

Age assurance is the broad category for any method used to work out how old an online user is. Ofcom describes it as covering methods “which include age verification, age estimation or a combination of both”. The Online Safety Act 2023 uses the same pairing when it refers to “age verification or age estimation (or both)”.

The point of the umbrella term is that a service does not have to pick a single technique. It can verify some users and estimate the age of others, or combine the two in one flow. When a regulator or a supplier talks about age assurance, they mean the whole family of approaches. They are not pointing at one specific check.

What age verification means

Age verification establishes a person’s age to a high degree of certainty by checking it against a source that already holds it. That source might be a passport or driving licence, a bank record, or a mobile network account. The output is precise. It ties back to a real date of birth or a confirmed age held by an authority.

For the person being checked, verification usually means presenting something they own or an account they already have. They photograph a document, or confirm their identity through a provider that has verified them before. The trade-off is certainty. Because the answer comes from an authoritative record, there is little ambiguity about the result.

What age estimation means

Age estimation infers a likely age or age range rather than confirming an exact figure. Facial age estimation is the most common example. Software analyses an image from the device camera and returns an estimated age, without ever knowing the person’s real date of birth.

Estimation returns a range with a confidence level, not a single certain number. That makes it fast and low-friction for the user, who only has to look at the camera for a moment. It also means the result carries a margin, which matters most around a threshold such as 18. We cover how that margin behaves at the 16-to-18 boundary in how accurate is age verification.

Age assurance terms at a glance

What makes an age check “highly effective”?

Under the Online Safety Act, an age check has to clear a defined bar. Ofcom sets that bar with four criteria. A method must be, in Ofcom’s words, “technically accurate, robust, reliable and fair in order to be considered highly effective”. The statutory standard behind this is that a check must be “highly effective at correctly determining whether or not a particular user is a child”.

Each criterion has a specific meaning:

• Technical accuracy asks whether a method can “correctly determine the age of a user under test lab conditions”.
• Robustness asks whether it holds up “in actual deployment contexts”, once real users and real attempts to get around it are involved.
• Reliability means the age output “is reproducible and derived from trustworthy evidence”.
• Fairness means the method “avoids or minimises bias and discriminatory outcomes” and works for all users.

The label attaches to a method in a specific deployment, not to a brand or a product in the abstract. The same technique can be highly effective in one setting and fall short in another, depending on how it is implemented and who is using it.

Which methods count, and which do not

Ofcom names kinds of age assurance that are capable of being highly effective. The list is open banking, photo ID matching, facial age estimation, mobile network operator age checks, credit card checks, digital identity services and email-based age estimation. This describes what can work. It is not a register of approved or certified products. Nothing on the list is guaranteed to pass in every deployment, and methods outside it are not automatically ruled out.

Here is how these map onto the two approaches. Five are verification-type: open banking, photo ID matching, mobile network operator age checks, credit card checks and digital identity services. Digital identity services typically carry a verified age, though some can carry an estimated one. Two are estimation-type: facial age estimation and email-based age estimation.

Ofcom is equally clear about what does not clear the bar. Self-declaration, where a user simply ticks a box to confirm their age, is not highly effective. A general “you must be over 18” term in the small print is not accepted either. A payment method that does not require the person to be 18, such as a standard debit card, does not qualify. Credit card checks appear in the effective list because a UK credit card already requires the holder to be 18 or over. The distinction rests on whether the payment itself proves the age threshold. Paying alone does not.

Different age thresholds also change which methods suit which job. An 18 check, a 16 check and an under-16 check each carry different tolerances, which we cover in why 18, 16 and 13 need different age checks.

Where OneID fits across the vocabulary

OneID is a UK digital verification services provider, certified under the UK’s Digital Verification Services Trust Framework. It runs both approaches through a single API. Verification comes through document authentication, bank-verified identity, mobile network operator checks and digital identity credentials. Estimation comes through on-device facial age estimation.

Of the seven kinds Ofcom lists, OneID covers five: open banking, photo ID matching, facial age estimation, mobile network operator age checks and digital identity services. Four of those are verification-type and one is estimation-type, which is what doing both looks like in practice. Its age assurance is built for Online Safety Act compliance.

Fallback routing sits underneath. If one method is not available to a given user, another can take its place, so more people finish the check rather than dropping out. For the person being verified, that can mean a confirmation in a few seconds instead of hunting for a passport. For the business, it means fewer abandoned sign-ups at the point where age has to be proven.

If you want to see how these checks apply to the current rules on younger users, start with the social media age limit and how age checks would work. If your concern is how much data a check has to collect, read can you prove your age without handing over your ID.

FAQ

Is age assurance the same as age verification? No. Age assurance is the umbrella term. It includes age verification, age estimation or a combination of both. Verification is one method that sits within age assurance. The two terms do not mean the same thing.

What is the difference between age verification and age estimation? Verification establishes age against an authoritative source, such as an identity document or a bank record, and aims at an exact age or date of birth. Estimation infers a likely age or age range without an official record, and returns a range with a confidence level rather than a certain figure.

Does facial age estimation count as age verification? No. Facial age estimation is an estimation method. It analyses an image to infer a likely age without confirming a real date of birth, so it returns a range rather than an exact verified age.

What does “highly effective age assurance” mean? It is Ofcom’s standard for age checks under the Online Safety Act. Ofcom’s four criteria are that a method must be “technically accurate, robust, reliable and fair”, and highly effective at correctly determining whether a user is a child. The label applies to a method in a specific deployment, not to a brand.

Are Ofcom’s seven methods approved or certified? No. Ofcom lists them as kinds of age assurance capable of being highly effective. It describes what can work. It is not a certification. A listed method still has to perform to the standard in the specific way it is deployed.

Is self-declaration a valid age check? Not under the Online Safety Act. Ofcom states that self-declaration of age is not highly effective. Neither is a general “must be over 18” contractual term, nor a payment method that does not require the person to be 18.