The four main approaches
Document upload
You send a photo of a passport or license, often with a selfie. The verifier sees your full legal identity: name, birthdate, document number, face. If that database leaks, everything leaks at once.
Face age estimation
An AI model estimates age from a selfie. No documents — but a biometric image is processed, and accuracy has a margin of error around ±1.5–3 years near the 18 boundary, so borderline users get pushed to document checks anyway.
Credit card
A card authorization as a proxy for adulthood. Weak signal (teens hold cards; many adults don't), and it links your browsing to a financial identity.
Zero-knowledge / token attestation
A trusted issuer (government wallet, OS, bank) proves the single bit "over 18: yes" cryptographically. The site learns nothing else; the issuer doesn't learn which site asked. The EU's digital identity wallet and similar systems are built on this idea.
Why the design matters: breach math
Suppose a verification provider serves 50 million users and suffers one breach.
• Document-upload model: 50M records × (name + birthdate + ID scan + face + site used) — a permanent identity-theft dataset tied to sensitive browsing.
• Zero-knowledge model: 50M records × (an anonymous "yes over 18" token) — approximately nothing to steal.
Same legal compliance, different worst case. This is the core of the policy debate: the goal (keeping minors out) can be met with architectures that don't build surveillance-grade databases as a side effect. The 2024 AU/UK trials and EU eIDAS 2.0 both push toward the token model for exactly this reason.
Questions to ask any verifier
Who stores the raw data, and for how long? Is verification unlinkable (can the issuer see which sites you visit)? Is there an offline or on-device path? Is the age signal a single bit or a full identity record? Systems that answer "no retention, unlinkable, one bit" can satisfy regulators while leaving nothing worth breaching.