Age verification has been the least defensible part of the online compliance stack for a decade: platforms either trust a self-declared birth date that anyone can falsify, or they collect a full identity document to answer a yes/no question, creating a data-protection liability disproportionate to the check itself. The EUDI Wallet resolves this tension directly. It can return a single boolean claim — over 18, over 21, over 16 — cryptographically signed by a government issuer, without disclosing the date of birth, name, or any other attribute.
Why self-declaration and document uploads both fail
- Self-declared birth dates have no verification behind them and are trivially false for a minor motivated to access a service.
- ID document uploads verify age accurately but over-collect: platforms end up storing scans of passports or ID cards purely to answer a single boolean question, which regulators increasingly view as disproportionate under GDPR data minimisation.
- Third-party age-estimation (facial analysis) tools introduce accuracy variance across age groups and skin tones, and raise their own biometric-data-processing obligations.
Every one of these approaches either fails the reliability test regulators are now writing into law, or fails the proportionality test data protection authorities are increasingly enforcing.
How selective disclosure solves it
The EUDI Wallet's credential formats — mdoc and SD-JWT VC — support selective disclosure: an issuer signs a full PID or attestation, but the holder's wallet can present only the specific claim a verifier requests, with the signature still validating. A request for "is the holder over 18" can be answered without the date of birth ever leaving the wallet, using zero-knowledge-style predicate proofs or, in simpler wallet implementations, an issuer-computed boolean attribute delivered inside a minimal disclosure. Either way, the platform receives exactly one bit of information plus a valid signature chain, not a document image.
The right answer to 'how old are you' is not a birth date. It is yes or no.
Sector-by-sector regulatory pressure
The push toward verified, non-self-declared age checks is already law or imminent in several regulated categories:
- Online gambling and gaming — most national gambling regulators already require verified age at registration and, in several Member States, at point of deposit or payout.
- Alcohol and tobacco e-commerce — national implementations increasingly require age verification at both order and delivery, not just at checkout.
- Adult content platforms — several Member States have passed or are drafting laws mandating robust age verification, moving away from simple checkbox declarations.
- Marketplaces and social platforms — the Digital Services Act's protections for minors are pushing very large online platforms toward age-assurance mechanisms stronger than self-declaration, especially for algorithmic content targeting and direct messaging features.
National rules differ on exact thresholds, on whether verification is required at registration versus at each transaction, and on which categories of content or product trigger the obligation — a platform operating across several Member States needs to treat the age threshold and trigger point as configurable, not hardcoded.
Implementation pattern
- Identify the exact trigger point: account creation, first purchase, each transaction, or content access — this determines where the age check sits in your flow.
- Request the narrowest possible claim: a boolean age-over-N attribute rather than the full date of birth, even though the wallet can supply either.
- Fall back gracefully for users without a wallet yet: keep an alternative verification path (video, document) available but make the wallet route the fastest and most private option offered.
- Log only the verification outcome and its cryptographic proof reference for audit purposes — never the underlying date of birth.
- Re-verify per session or per transaction where national rules require it, rather than relying on a one-time account-level flag.
The audit and liability upside
A signed attribute presentation is also a stronger audit trail than a self-declared checkbox: you can prove, to a regulator, that a specific request was answered by a government-backed signature at a specific timestamp, without having to retain or produce any personal data beyond the proof itself. That combination — better evidentiary value and lower data-protection exposure — is difficult to achieve with any pre-wallet age-verification method.
What this costs to build
Requesting a single attribute from a wallet is a small technical surface, but reaching it requires the same regulated-ecosystem machinery as any other wallet integration: Relying Party registration in each Member State you serve, access certificate management, and conformance with an evolving Architecture and Reference Framework. For an age check alone, most platforms will not want to build and maintain that infrastructure in-house. Arkadiz operates as the intermediary Relying Party across multiple wallets and Member States, so a platform can request a simple "over 18" or "over 21" claim through one integration instead of standing up a compliance function for a single boolean.
Getting started
Start with the single highest-risk age gate in your product — the one a regulator or payment processor is most likely to ask about — and replace it with a wallet-based boolean check before expanding to every touchpoint. It is the fastest way to demonstrate both reliability and data minimisation in the same rollout.