What is Age Verification in Practice? Experts’ Insight

Shufti October 8, 2025 11 minute read

01 Global Regulatory Developments and the Compliance Imperative
02 Addressing Circumvention of AV Laws through VPNs
03 Industry Readiness and Sector Trends
04 Technological Safeguards Against Fraud
05 Persistent Myths and Misconceptions
06 Conclusion

With the increasingly strict regulations enforced by governments of the global north, businesses have to deal with the twin problems of providing compliance with age verification regulations, with user privacy and preserving a smooth digital experience for end users. A recent webinar on September 30th, organized by Shufti with contributions by the experts of the Age Verification Providers Association (AVPA), Goode Intelligence, and the Information Commissioner’s Office (ICO), discussed the dynamic world of age verification.

The panel, which was moderated by Sofia Perez Flores, a Board Member of the World Compliance Association, featured Iain Corby, Executive Director of AVPA, Michael Murray, Head of regulatory strategy at ICO, Alan Goode, CEO of Goode Intelligence, and Tom Gadsden, VP Product Management at Shufti. The panelists discussed age verification along with its regulatory trends, industry preparedness, technology breakthroughs, and effective organizational approaches to the age verification landscape.

Global Regulatory Developments and the Compliance Imperative

Iain Corby highlighted that the introduction of Age Verification regulations is like a “tsunami” of legislation all over the world, emphasizing online safety. The UK Online Safety Act (OSA) has enforced exceptionally robust age assurance on adult content, gaming, and social media sites. In Europe, AV regulations on large platforms are being enforced through the Digital Services Act (DSA). Other significant rules are the 16-year-old minimum social media age in Australia, state-adult content AV regulations in the U.S., and the biometric verification in Brazil.

While answering a key question about privacy concerns in compliance with the age verification mechanism, Corby pointed out the necessity of having international standards. These standards can harmonize compliance across jurisdictions while allowing for local nuances. Absence of such harmonization has the potential to lead companies navigating dozens or even hundreds of different legal requirements within a given market.

“We were conscious that different jurisdictions were passing different laws. And so, we figured out one of the best ways to try to get some alignment was using international standards because these are things that people understand and apply around the world. There’s a good international infrastructure to share those standards.” AVPA’s Executive Director noted.

Corby stated that 10 million age checks are being done by their members each day, which underscores the need to simplify age verification.

Addressing Circumvention of AV Laws through VPNs

Michael Murray discussed the challenges posed by VPN usage and other circumvention methods. He highlighted the misuse of VPNs to bypass age verification. The UK media regulator survey indicated that 22% of children aged 8–17 lie about their age to be 18 or over on social media apps. Though Michael acknowledged the misuse of VPNs, he also highlighted that there are legitimate reasons to use VPNs, like privacy or security.

Even though VPNs are sometimes used to bypass age verification, Mr. Murray argued that the responsibility to enforce age limits remains with the business despite the existence of tools to bypass checks. Companies are able to flag the VPN users and conduct enhanced age checks to ensure that users meet the age requirements

He pointed out, “Organizations should remember that they continue to have responsibilities under the OSA and under the UK GDPR to have accurate and effective age assurance, whether that’s a VPN use or other methods of contravention.”

He recommended that companies and organizations should keep track of suspicious traffic, utilize geolocation verifications, and collaborate with age assurance service providers to establish measures that will achieve the desired outcome without compromising privacy. This proactive strategy will guarantee the fulfillment of compliance requirements without jeopardizing the secure digital experience of users.

Industry Readiness and Sector Trends

While addressing the compliance imperative, Alan noted that there has been a significant increase in the implementation of age verification mechanisms since July 2024. The AVPA statistics showed an additional 5 million age checks on pornographic websites daily. This influx of age checks was the result of the implementation of the Online Safety Act in the UK. Goode pointed out that the popular digital identity and age assurance apps also continue to lead the ranks in both Google Play and Apple App Stores, reflecting strong adoption by users.

In addition to adult content, he pointed out that the application of age verification is starting to grow in other sectors such as social media, video games, Internet gambling, online shopping, and entertainment, and is a major concern with age-restricted products and services.

“Deployment of age assurance solutions has greatly accelerated, and as regulations expand, adoption will continue to grow,” Goode noted.

The panelist observed that organizations are aligning their technology deployments with regulators’ recommendations, incorporating biometric verification, document authentication, and integrating the continuously changing requirements in the existing systems.

Technological Safeguards Against Fraud

As hyper-realistic deepfakes, synthetic identities, and AI-generated avatars are becoming ever more threatening, a solid AV system that implements several layers of age checks is required.

Tom Gadsden, VP Product at Shufti, elaborated on the technical aspects of the challenges mentioned above.

The technical aspect of the above-mentioned challenges was discussed by Tom Gadsden of Shufti. He described how Shufti uses biometric age estimation, document verification, and liveness detection to stop access by fraudsters at the expense of the user experience and privacy, and at the same time remains compatible with jurisdiction-specific needs, while providing accurate age verification mechanisms.

Tom noted that it is important to test AI among the various demographics so that everyone is not discriminated against and no group can be excluded on the basis of belonging to a particular group. The ability to verify in many ways, such as facial recognition, document, and electoral roll verification, enhances accessibility and minimizes the false acceptance rate.

“Providing a range of verification methodologies ensures that no single solution is relied upon exclusively, allowing for greater fairness, inclusivity, and security,” Gadsden explained.

Persistent Myths and Misconceptions

The panel discussed several misconceptions that are associated with age verification. The most widespread myth is that the verification procedure allows Regtechs to build up ‘honeypots’ of personal information of users. Iain Corby clarified that age verification is not identity verification:

“Age verification is not identity verification, first of all. So we simply tell people yes or no, are you over 18 or not? That should protect you from the website knowing who you are.”

He also discussed the importance of zero-knowledge proof to address this myth. It makes sure that the provider who checks the age of the user cannot track which site the particular user is visiting, even if the user uses the provider’s services to access that site.

The other common misperception that has been discussed is that using VPN renders age verification impossible. Both Corby and Michael Murray observed that VPN traffic can be monitored and flagged, and age verification providers can, at will, request verification of users who are allegedly trying to bypass restrictions.

Corby has emphasized that what can make the process of age verification ineffective is the fact that there are certain businesses that disable key verification features. He warned:

“We’re now trying to insist that our members have to be very, very clear with their clients… if they don’t use the full scope of services, then they’re not going to be compliant with the regulation.”

This underscores the importance of full-featured deployment and careful use of age verification systems to comply and protect users simultaneously.

Conclusion

The webinar highlighted that age verification is not only a regulatory imperative but also an ethical requirement. Businesses have the responsibility of adhering to the regulations and, at the same time, ensuring that they extend privacy to the users and offer them a smooth experience. Compliance is not a standalone task but must be done simultaneously with accurate processes and careful oversight, including full-featured application of age verification systems and monitoring for circumvention methods like VPNs.

Technologically and industrially, the use of multi-layered verification, biometric authentication, document authentication, and liveness detection is the way forward to prevent minors from illicit online material and to provide a firewall to potential fraud threats without being intrusive and inequitable. The adult content sites are at the forefront of compliance, and age verification will be required by social media, gaming, e-commerce, and entertainment sites under various regulations. The age assurance systems, if implemented successfully, will assist the businesses to safeguard children, fulfil the regulatory duty, retain user trust, and develop a safer digital environment.

Keep ahead in the line of age verification compliance, discover strong solutions, and safeguard your users today.