Today, browsing the internet is like walking through an endless city with areas for all ages. However, there are corners unsuitable for children, whether due to adult content, gambling, or the sale of alcohol. This is where age verification comes in , a set of technological tools used to verify that someone entering a website is old enough to be there safely.
The idea isn't to pry into anyone's life, but to implement a smart filter that protects young people and prevents companies from getting into legal trouble. It's not just about ticking a box that says "I'm over 18," which we already know isn't very effective, but about applying robust and secure methods that guarantee legal and responsible access, adapting to the regulations in force in each territory.
The European Union's approach and the Digital Services Act
To avoid a chaotic mix of different rules in each country, the European Commission has promoted a harmonized approach . The goal is for EU users to be able to easily prove they are of legal age, and above all, without leaving a trace of their personal data across the internet. This initiative is a key component for implementing the Digital Services Act (DSA) , which aims to keep children safe online.
A technical solution, often called a mini-wallet , has been developed that will allow age verification without sharing ID cards or other sensitive information. This system is fully compatible with the future European digital identity wallets that will be deployed in all member states. The advantage of this model is its flexibility: although it currently focuses on those over 18, it can be adapted for different age ranges , such as those over 13, or even for specific services for retirees.
Regulations and principles in Spain: The role of the AEPD
In our country, this is a very serious matter. The General Law on Audiovisual Communication requires video service providers to implement systems that prevent minors from accessing harmful content, such as pornography or extreme violence. To guide this process, the Spanish Data Protection Agency (AEPD) and the Public Prosecutor's Office have promoted a State Pact focused on the best interests of the child.
The Spanish Data Protection Agency (AEPD) has established a very clear roadmap through a ten-point set of principles. The most important is that verification must be anonymous for the service provider; that is, the website must know that the user is of legal age, but it doesn't need to know exactly who they are. The aim is to avoid at all costs the profiling of users based on their browsing activity or the linking of their activity across different platforms.
- The system must guarantee that minors cannot be tracked or located.
- Accreditation should focus on demonstrating that one is a authorized person and not in proving that one is a minor.
- The patria potestad of parents and fundamental navigation rights.
Technical methods: From biometrics to digital wallets
To put this into practice, several technologies exist. Some companies use advanced biometrics combined with artificial intelligence to estimate age through anonymous facial scans. Other more traditional methods include uploading an official ID or using a credit card, where an authorization request is made to validate the card without charging anything.
Google, for example, has implemented the Credential Manager API in Android. This technology uses zero-knowledge proofs, a cryptographic method that allows users to say "yes, I am over 18" without revealing their name, exact date of birth, or any other personal information. This resolves the privacy dilemma, as the website receives a binary confirmation instead of a copy of the user's documents.
Account management and parental supervision
When we talk about personal accounts, such as Google accounts, the minimum age varies by country. If the system detects that a user may not be old enough, a 14-day grace period is usually given for the user to verify their age or set up parental controls. If this isn't done, the account may be disabled and the data deleted after a certain period.
For younger children, tools like Family Link allow parents to manage their children's digital activity . This isn't just about control; it's about providing a safe and educational environment where account settings are adapted to the child's maturity level, thus complying with child protection laws.
Challenges and the future of digital identity
Not everyone agrees on how to do this. Some propose that operating systems or app stores should verify age on everyone's behalf. However, this poses risks, as it would require sharing data with millions of developers who might not need that information, as is the case with a simple flashlight app.
The path forward points toward interoperability . This means users will have a single, secure digital credential, validated by a trusted source (such as the government), which they can use on any website without fear of being tracked. This governance and trust model is being developed in Europe to balance children's safety with adults' privacy.
Protecting minors online depends on a balance between strict laws, such as those enacted by the Spanish Data Protection Agency (AEPD) and the EU, and technologies that prioritize anonymity. From the use of digital wallets and biometrics to parental supervision, the goal is to create an ecosystem where legal age can be reliably verified without sacrificing personal identity or citizens' digital rights.
