How Incode On-Device Age Estimation Remains Accurate, Secure, and Private

For years, the industry standard for handling facial data in age verification has been: process it, then delete it. Data minimization with immediate deletion. It's a responsible approach, and we still follow it in our server-based products. But for On-Device Age Estimation, we went further.

Why now? Because we’ve charted consumer preferences over the last five years and identified a very real and present pain point: for many users, the possibility of biometric data leakage is a hard “no.” It doesn’t matter how quickly that data is deleted after the fact.

So we asked: what if a user’s face never leaves the phone at all? Can we preserve the same or similar accuracy and security within an on-device model?

The solution we built exceeded my original expectations in terms of both privacy and accuracy. With Incode On-Device Age Estimation, a user’s selfie is never sent anywhere, and only minimal session metadata goes to our servers to confirm the capture is genuine (no personally identifiable information (PII) that could identify the user).

In this article, I’m going to detail how we achieved this feat.

The Constraints

When your model lives on a server, you have considerably more room to work with in terms of model size and compute. When it has to run on someone's device, including old phones and antiquated browsers, the device sets the ceiling. To accommodate those needs, we reduced the size of our On-Device Age Estimation model by 10x compared to our traditional server-side model.

So, the question became: how do you get a model that’s 10x smaller to operate at the same or a similar level of accuracy and security?

Accuracy isn't just a product metric here. It directly determines how often users get kicked over to document-based ID verification. The more accurate the age model, the fewer people have to dig out their digital ID. At scale, that's millions of unnecessary friction moments. We couldn't let the on-device constraint lead to greater friction.

How We Built an Accurate, Secure On-Device Model

We didn't try to build a tiny model from scratch. We used a technique called distillation, in which you take a large, highly accurate model and use it to teach a much smaller one. The small model learns to mimic the big model's judgment: how it reasons about age, not just what it outputs.

The catch: distillation only works as well as the teacher. If your large model is mediocre, the small one learns mediocrity. So everything depended on how good our server model actually was.

That's where years of R&D investment showed up. We run continuous experiments on model architectures, activation functions, loss functions, and transformer approaches. We don't assume we've found the best answer. We experiment with data sampling and augmentation. We track what's new in the field and try things. The model is never "done."

As a result, our on-age model has achieved 1.08–2.08 years mean absolute error (MAE) for both adult and youth age groups, compared to 0.95-1.87 MAE for our server-side model.

Engineering Bias Out

Most bias work in this space covers gender and ethnicity. We go further.

We also analyze  factors like tattoos, scars, skin conditions, and facial characteristics that most training datasets barely represent.

This is a continuous process of statistical analysis to surface performance gaps between groups, and real user feedback to catch what we miss.

What We Do and Don’t Collect

While we process facial biometrics on-device, we still have to make sure that the camera feed is real and not an injected deepfake. To do this, we send minimal metadata to the server.

For privacy-focused use cases, we deliberately chose not to collect users' IP addresses or fingerprint their device. What we send is session integrity metadata: signals about when and how the capture happened, and anomaly signals that help us tell a genuine live capture from a manipulated one.

Keeping Sensitive Data Where It Belongs

The on-device age estimation use case forced us to answer a hard question: could we protect user privacy at the deepest level, keeping sensitive biometric data on the end-user’s device, while holding the line on accuracy that businesses can rely on?

The answer required rethinking model architecture, engineering out bias for groups most datasets ignore, and being deliberate about the handful of signals we do send to the server. The result is a model that’s 10x smaller but performs like its server-side counterpart with privacy built into the architecture itself rather than bolted on as a policy.

This is what privacy-first identity verification looks like when it's taken seriously.

Ready to see how On-Device Age Estimation fits into your verification flow? Or, have questions about Incode’s On-Device Age Estimation model? Request a demo today.