Summary

• An independent study commissioned by the European Commission finds age assurance can be compatible with fundamental rights when appropriate safeguards are applied.
• Costs are expected to remain manageable for most online services, helped by competition, technical standards, and shared European infrastructure.
• The researchers recommend faster deployment of the EU age-verification blueprint and accessible alternatives, including manual enrolment for people unable to use standard methods.

Online age verification is unlikely to impose excessive costs on most smaller European businesses if common technical infrastructure and competitive third-party services become widely available, according to an independent study commissioned by the European Commission.

The research, published on 4 November, examines the financial impact of age assurance alongside risks to privacy, non-discrimination, freedom of expression, and access to information. It concludes that effective age checks can be compatible with fundamental rights, although that outcome depends on how systems are designed and implemented.

The study was commissioned to inform policy development associated with the proposed EU KIDS Act and an accompanying staff working document. It does not assess the proposed legislation itself or determine whether individual age-verification providers comply with existing or future requirements.

Researchers identify the EU’s age-verification blueprint as a potentially affordable foundation for a more consistent European approach, particularly because its development has benefited from public funding and its technical design is intended to protect privacy.

Businesses face more than verification fees

Age assurance covers different methods of establishing whether a person meets an age requirement. Some approaches verify age using an identity credential, while others estimate age using information derived from a user or their interaction with a service.

The distinction affects both cost and privacy. A service may need to establish whether someone is over a specified threshold without knowing their name, address, full date of birth, or other information that is unnecessary for the decision.

Introducing an age check also involves work beyond paying a supplier for individual transactions. Online businesses may need to integrate software, change registration processes, introduce procedures for failed checks, train support staff, and review how information is collected and retained.

For a large platform, these requirements may be absorbed into established identity and security operations. A smaller service with limited technical staff may find even a relatively straightforward integration more demanding, particularly where its customers operate across several European countries.

The Commission’s study concludes that new costs are unavoidable but likely to remain modest for most services. Competition among third-party vendors, technical standards, and improvements in interoperability are among the factors expected to reduce expenditure over time.

Ready-made verification systems could allow smaller businesses to meet requirements without developing their own identity infrastructure. However, cost estimates will still depend on the number of checks performed, the assurance level required, the service’s existing technology, and how users respond when verification fails.

Businesses serving multiple jurisdictions may also benefit from greater consistency. Where national requirements differ, a provider can face separate technical integrations or compliance arrangements for users in different countries, increasing the cost of operating across the single market.

A common European framework could reduce that fragmentation, although agreement on technical standards will not eliminate every difference between the services and activities for which age checks are required.

Proving eligibility without revealing identity

The study places particular emphasis on protecting fundamental rights because an age-verification system can create risks even when it successfully prevents underage access.

Collecting identification documents or biometric information may expose users to unnecessary data processing if a service only needs confirmation that they meet a particular age threshold. Retaining that information can also increase the consequences of security breaches.

Privacy-preserving approaches seek to separate the evidence used to establish age from the limited information supplied to the service requesting verification. In principle, a provider could receive confirmation that a user is above a threshold without obtaining the identity details behind that confirmation.

Whether a particular implementation delivers that outcome depends on the architecture, the credentials accepted, and the information exchanged between the parties involved. A system described as privacy-preserving still needs scrutiny of its security controls, data retention, and potential for linking activity across services.

The researchers recommend alignment with the General Data Protection Regulation, high standards of security, and technical measures designed to minimise unnecessary information sharing.

Age-estimation methods raise a different set of questions. Their results may vary according to the characteristics of the person being assessed, the quality of the available information, and the conditions under which a check takes place.

Where a method produces incorrect results, an eligible user may be denied access or a younger user may pass a check intended to protect them. Businesses therefore need evidence of effectiveness as well as procedures for correcting mistakes.

The study also examines potential interference with freedom of expression and access to information. Verification requirements that impose excessive friction can deter lawful access, particularly when users are required to reveal more personal information than the service needs.

Accessibility requires alternatives

Not everyone can complete the same verification process. Some people lack particular identity credentials, have limited access to suitable devices, or face difficulties using digital identification systems.

These barriers can affect adults as well as children and may disproportionately exclude people whose circumstances are not accommodated by the standard technical design.

The Commission’s researchers consequently recommend effective alternative enrolment routes, including manual options at national and local level. Such arrangements would allow people who cannot use a conventional digital process to establish eligibility through another supported method.

Providing alternatives has an operational cost, because manual checks may require staff, physical locations, or additional support processes. Nevertheless, a verification system that is inexpensive for the provider but excludes eligible users cannot be assessed solely on its transaction price.

Choice and transparency are also relevant. People should be able to understand what information is being requested, why the check is necessary, and what options exist when the preferred method is unsuitable.

Businesses implementing age assurance will need to consider those questions alongside technical integration and compliance, particularly where their services are used by people with different accessibility needs.

Shared infrastructure faces an implementation test

The EU’s age-verification blueprint is intended to provide a common technical approach that can be adopted across member states. Its open design and publicly supported development could reduce the expense of establishing compatible services, while allowing businesses to use providers rather than maintain the entire system themselves.

The study recommends accelerating its deployment, although the existence of a blueprint does not demonstrate that every national system is operational or that all online services can immediately adopt it.

Interoperability will be important if credentials issued or supported in one jurisdiction are to work reliably with services operating elsewhere. Different identity systems, technical standards, and implementation schedules could otherwise preserve some of the fragmentation the common approach is intended to reduce.

Evidence from Britain’s age-assurance requirements provides a separate example of the difficulties involved. Ofcom’s early monitoring under the Online Safety Act has examined how providers implemented checks and the factors affecting their effectiveness, while stopping short of final conclusions about the arrangements in use.

The EU study similarly does not establish that age verification will always be effective, inexpensive, or free from discriminatory consequences. It identifies conditions under which businesses could implement checks with proportionate costs and stronger protections for users.

Further policy development will determine the obligations ultimately placed on online services. The practical costs will become clearer as verification technologies are deployed more widely, suppliers compete, and businesses establish how often users require alternative methods.

The research supports a common European approach, but its conclusions depend on continued investment in interoperability, security, accessibility, and realistic implementation arrangements for the businesses expected to operate the systems.