How we check your age, and what happens to your data
Being asked your age shouldn't mean handing over your identity.
The Age center is where we explain how each Incode age check works, what happens to your data, and why a check sometimes can't confirm your age.
Why apps and services now have to ask your age, and what an age check actually asks for
Why are you being asked to prove your age?
Governments around the world have passed new laws that require apps, games and websites to check the age of the people using them. The rules differ from country to country, but they come back to the same few things.
- Protecting minors from harmful content
Keeping under-18s out of the content, purchases and spaces built for adults.
- The right experience for the right age
So a 13-year-old and an adult are not shown the same things online.
- Extra protection for young people’s data
Stricter limits on what can be collected from younger users, and how it can be used.
Age rules now reach 40+ jurisdictions
Select any highlighted country on the map for more details
United States
Ireland
United Kingdom
European Union
France
Brazil
India
Australia
How is an age check different from an identity check?
Proving you're old enough is a different question from proving who you are. Age assurance answers the first. Identity verification answers the second.
The check confirms whether you're old enough. Identifying you isn't its purpose.
The check confirms who you are, because some services are required to know.
Some age checks do use your ID. What makes it age assurance is what we do with it: we use it only to check your age, not to build a record of who you are.
It's what the service gets back once a check is done, and it's one of three answers.
- That you're old enough
A yes or no against the limit, like over 18.
- Your age
A single number, exact or estimated.
- Your date of birth
The full date, read from an ID or an official record.
Which one applies depends on the service, the age check method and the rule it follows.
The two kinds of age check, the methods behind them, and what each one asks you to do
What is the difference between age estimation and verification?
An age check is any way of working out whether you meet an age requirement online. There are two ways to do it: estimate your age, or verify it against a trusted source. Which one you are asked for depends on the service and the rules where you are.
Age estimation
Works out your approximate age without a document, for example by analyzing a selfie. No ID needed, and it is quick.
Age verification
Confirms your exact age against a trusted source, such as scanning an ID or checking an official record.
A check often starts with estimation, and moves to verification only when more certainty is needed. Either way, only an age result is shared.
Learn more: age assurance explained ↗What age checks does Incode offer?
The methods are grouped by what they use: your face, your ID, or details you already have. Each one is explained below.
Facial age estimation
We confirm a real person is taking the selfie, then estimate their age. What happens to your face depends on the method below.
On-device
A quick selfie confirms a real person and estimates your age, right on your phone.
Server-side
A quick selfie confirms a real person and estimates your age, on Incode's servers. Works on any device.
ID-based age checks
ID age verification
You share a photo of an ID and a selfie, so we can confirm your age and if the document is yours.
Digital ID age verification
Use a digital ID or wallet you already have, confirmed on your device.
Data-based age checks
When a selfie or ID is not the right fit, these use trusted signals or records.
Email age estimation
You enter your email address. How long that address has been in use, and the kinds of services it's registered with, indicate whether you're likely to be an adult.
Phone age verification
You enter your mobile number, along with details like your name or date of birth depending on the country. The check confirms they match the records held against that number.
Data-based age verification
Some countries and rules expect your age to come from an official source. That can be a government record, such as your CPF in Brazil, or details your bank already holds. You provide what's needed and it's checked against that source.
These checks confirm your age by comparing the details you provide against a trusted source. Phone age verification, for example, checks with your mobile carrier's records. Anything sent is encrypted, and the details you gave are deleted no more than 24 hours after the session.
How close an age estimate can get, when you will be asked for a second method, and what to do when a check does not go through
How accurate is an age estimate?
“I’m over the age requirement, so why was I asked for my ID after a selfie?”
Facial age estimation predicts your age from a selfie. Like any estimate, it comes with a margin, so it can read a little high or a little low.
How far off can it be?
On average, an estimate is off from someone's real age by a small number of years.
The average number of years an estimate is off by. The lower the number, the more accurate. An MAE of 2, for example, means estimates land within about two years of someone's real age on average.
Incode's MAE: ranges from 0.9 to 2 years depending on age group, with the highest accuracy in the 12 to 21 range. For a more detailed breakdown of our MAE by demographic, please reach out →
Example: with an MAE of 2 years, a 17-year-old could be estimated anywhere in a 15 to 19 range.
How does MAE affect my experience?
Because an estimate can fall a couple of years either side of your real age, a result close to an age limit is not certain on its own.
As an example, take an 18+ service where the goal is to keep minors out. It might add a buffer of 3 to 4 years, clearing you on a selfie alone only if you are estimated at 21 to 22 or above, rather than 18. In this scenario, someone estimated at 19 would be asked to confirm another way, usually an ID check.
For you, that can mean one extra step when you are close to the limit. In return, the chance of a minor being passed as an adult stays very low.
The buffer is not a fixed number. It depends on the service you are using and the rules where you are.
What happens when a check cannot confirm your age?
It moves to a second step rather than stopping there. A check begins with the lightest method that can answer the question, and only asks for more when that first step falls short. This is what that looks like.
Why might a check not confirm your age?
Any method can sometimes not confirm your age. Below are the most common reasons for each, and what they mean.
Facial age estimation
A facial age estimate may not be successful if:
- The estimate came out below the age required. Because estimation carries a margin, this can happen even when you are old enough. See how this works →
- We could not confirm a real, live person. To keep communities safe, the check confirms that a real person is taking the selfie live. Attempts to use someone else's photo, a video, or a deepfake are flagged, and the check will not pass.
ID verification
An ID-based age check may not be successful if:
- You do not meet the required age. The date of birth on your ID indicates you are below the minimum age the service requires.
- We could not match your selfie to your ID. The selfie taken during the check did not sufficiently match the photo on your document.
- We could not confirm your ID. The document could not be verified as genuine, or the document type is not supported.
Digital ID
A Digital ID age check may not be successful if:
- You do not meet the required age. The date of birth linked to your Digital ID indicates you are below the minimum age the service requires.
- Your Digital ID is not supported. The service may not accept that Digital ID provider or credential.
- Your Digital ID could not be validated. The credential may be expired, unavailable, or could not be verified.
Phone age verification
A phone-based age check may not be successful if:
- We could not verify your information. The details provided could not be matched or confirmed against the records used for the check.
- We could not confirm the phone is yours. Phone checks can include a one-time passcode (OTP). If the code is not completed, the check cannot be confirmed.
Data-based age verification
A data-based age check may not be successful if:
- We could not verify your information. The details you provided could not be matched with, or confirmed against, the records used for the check.
Email age estimation
An email-based age estimate may not be successful if:
- There is not enough history linked to the email. A recently created address, for example, may not have enough signals for a reliable estimate.
- The estimated age does not meet the requirement. The available signals point to an age below the minimum the service requires.
What if my age still can't be confirmed?
If the available age-check options can't confirm your age, you may still have other ways to access the service.
Depending on the service, you may be able to request an additional review, escalate your case, or ask a person to review your information.
The service you're trying to use determines which options you have and makes the final decision about access.
How we stop someone using another person’s face or ID, what happens to your data, and who checks that we do what we say
How do we stop someone using your face or ID?
An age check is only worth doing if it cannot be borrowed, copied or faked.
A check that can be faked protects nobody. It can fail in two directions, and both cause real harm.
This is the risk most people picture first. A young person reaches content, purchases or spaces meant only for adults, and the check that should have stopped them lets them straight through.
This is the risk people picture less often. A space built for children stays safe only while the check works in both directions, and a failure here usually surfaces long after it happened.
These are the ways people try to defeat a face-based check.
A synthetic face, generated to look like a real person.
A fake video fed straight into the camera feed instead of being shown to the camera.
A molded replica of someone else’s face, worn to the check.
A printed photo or cut-out held up in front of the camera.
A recording, or another screen, played back to the camera.
Four defenses run on every check that uses your face or your document.
Protected against impersonation
Each check includes protection against age spoofing, impersonation, and tampering.
A real person, in the moment
The check confirms a real, live person is taking the selfie. Photos, screen recordings, masks and deepfakes are detected, and will not pass.
The document has to be genuine
Where a check uses an ID, we confirm the document itself is real and unaltered, rather than a copy, a screenshot or an edit.
The face has to match the document
We compare the selfie you take with the photo on your document, so a genuine ID cannot be used by someone it does not belong to.
These defenses are tested by accredited outside labs rather than assessed by us. See how this is tested and certified below.
What happens to your data?
Privacy is built into how a check works, not added on top. However your age is checked, we analyze only what the check needs, and keep only the age result.
Five promises behind every check, whichever method you are asked to use.
Age, not identity
We assess your age, and only your age. The check doesn't perform identity analysis or build a profile of who you are.
Only what's required
We collect only what a good-quality age check calls for, enough to keep it accurate and hard to fake.
Minimal result
The result is limited to what the service's requirement calls for, and never more than that.
Deleted after the session
Any personal information processed off your device is deleted no more than 24 hours after the session, whether or not an age result is reached.
Not used to train models
Data from your age check isn't used to train or improve our models, and we forbid using it to enhance any model in age assurance.
Incode acts as a processor, not a controller. Here is the difference, and why it matters for you.
The service that asks you to prove your age. It decides that a check is needed, and why.
Runs the check on the service's instructions, and doesn't use your data for anything else.
In practice, the data is not ours to keep or reuse. It is used only to return the age result the service asked for, and is then deleted.
You provide what's needed
Only the details the chosen check calls for.
Sent securely
Anything that leaves your device is encrypted in transit.
Analyzed
Your details are analyzed to reach an age result.
Result returned
The service receives the age result it asked for.
Data deleted
The personal information you provided is deleted no more than 24 hours after the session. Only the age result is kept.
✓What we do
- Assess your age on your device where the method allows
- Use only what a given check needs
- Delete personal information no more than 24 hours after the session
✗What we don't
- Build a profile tied to your identity
- Track your browsing or behavior
- Keep your personal information after the session
Who tests and certifies this?
Our age checks are measured by outside labs and standards bodies, not only by us.
Independently audited and certified. See the full detail in our Trust Center.
An independent auditor checked, over time, that we actually follow strong security practices for handling data.
We meet the leading international standard for keeping information secure and managing security risks.
An accredited assessor reviewed our systems against the security standard the US government uses for its own cloud services, and the FedRAMP program office reviewed the findings. Full authorization is the next step.
A certification built specifically for age assurance. An independent body confirmed our checks work and handle your data responsibly.
The US standards body ran its own tests on how accurately our technology estimates age and recognizes faces, rather than taking our word for it.
An accredited lab tested how well our checks hold up against spoofing, like photos, masks, or deepfakes.
FAQs
Common questions about age assurance
Plain answers to what people ask most.
Still have questions? Talk to an expertWhy am I being asked to prove my age?
Many services are now required by law to check that users meet a minimum age before showing certain content or features. The service you're trying to access has to confirm you are old enough.
Is this the same as proving who I am?
No. Age assurance checks your age, not your identity. In most cases you can confirm you are old enough without revealing who you are.
Do I have to upload an ID?
Not always. Several methods work without a document, such as a quick selfie estimate or a check through your phone. Which method is used depends on what the service and the rule require.
What happens to my data after the check?
The personal information you provided is deleted no more than 24 hours after the session, whether or not an age result is reached. Only the age result is kept.
Is my selfie or information used to train AI?
No. Data from your age check is not used to train or improve our models. Where the method allows, your selfie is processed on your device and does not leave it.
What if the check gets my age wrong?
Age checks are not always exact. If you believe the result is incorrect, more than one method is usually available. Incode runs the check on behalf of the service you are using, so that service decides what happens next and is the place to raise it.
Is my information secure?
Anything that leaves your device is encrypted, and our security is independently audited and certified, including SOC 2 Type 2 and ISO/IEC 27001.
Do you sell or share my information?
No. Incode acts as a processor: your information is used only to carry out the age check the service asked for, and not for anything else.
Ask us anything about age assurance
Whether you were just asked to prove your age, you build a service that needs to, or you're researching the space, we'd love to hear from you.
Reach out