§6.1.3.3 Age estimation

47. The Commission considers the use of age estimation methods, when provided by an independent third party or through systems appropriately and independently audited notably for security and data protection compliance, as well as when done ex ante if necessary to ensure the effectiveness of the measure, to be an appropriate and proportionate measure to ensure a high level of privacy, safety, and security of minors in the following circumstances: (a) Where, due to identified risks to minors’ privacy, safety and security, the online platform service’s terms and conditions or similar contractual obligations of the service require a user to be above a required minimum age that is lower than 18 to access the service, based on the provider’s assessment of risks for minors on the platform (45) (46). (b) Where the provider of the online platform has identified medium risks to minors on their platform as established in its risk review (see Section 5 on Risk Review) (47) and those risks cannot be mitigated by less restrictive measures. The Commission considers this will be the case where the risk is not high enough to require access restriction based on age verification but not low enough that it would be appropriate to not have any access restriction or to have access restriction that is not supported by any age assurance methods or is only supported by self-declaration. Self-declaration is not considered to be an appropriate age-assurance measure as further explained below. Good practice MegaBetting (48) is an online platform that allows users to bet on the outcome of real-world events. The provider restricts its service to users above 18 years, in line with national law. To ensure that its online platform is not accessible to minors, it relies on the EU age verification solution that only tells the provider whether the user is at least 18 years old. This information is created by a trusted issuer based on the national eID of the user and is received from an application on the user’s phone. The provider considers therefore that the system meets the criteria of being highly effective whilst preserving the privacy of the user. Poor practice SadMedia is a social media online platform. The provider of SadMedia decided to restrict its services to minors who are at least 13 years old. This was based on its assessment of medium risks that the platform could pose to minors’ privacy, safety and security. SadMedia’s terms and conditions set out this restriction. To enforce this restriction, the provider of SadMedia relies on an age estimation model that it developed, and that it claims can predict the age of the user with a margin of error of ± 2 years. As a result of this margin of error, many minors below the indicated age can access the service and many minors who meet the required age cannot access the service. SadMedia’s age assurance measure is not highly effective and therefore does not ensure a high level of privacy, safety and security for minors on its service. 48. Where the provider of an online platform accessible to minors has determined that access restrictions supported by age assurance are necessary to achieve a high level of privacy, safety and security for minors on their service, the Commission considers that it should offer on its platform more than one age assurance method, to provide the user with a choice between methods, provided that any such method meets the criteria outlined in Section 6.1.4. This will help to avoid the exclusion of users who, despite being eligible to access an online platform, cannot avail themselves of a specific age assurance method. In order to increase effectiveness and user-friendliness, the appropriate age assurance method should be carried out, where possible at account creation, and the age information then used to contribute to an age-appropriate experience on the platform, in addition to other protective measures mentioned in these guidelines. Furthermore, providers of online platforms should provide a redress mechanism for users to complain about any incorrect age assessments by the provider (49). Poor practice SadMedia uses an age estimation solution as one of a range of measures that aims to contribute to a high level of privacy, safety and security. When the age estimation system provides a negative result, indicating that the user is too young to use the service, a pop-up is presented to the user which states ‘Disagree with the result? Please try again!’ The user is then able to redo the age estimation test using the same method. In this example, the age assurance measure would not be considered appropriate or proportionate as no possibility is given to the recipient to use another age assurance method nor is a way of redress provided to the recipient to challenge an incorrect assessment.

← 6.1.3.2 · All articles · 6.1.4 →

Source: EUR-Lex (Cellar) · retrieved 2026-09-07