Age-assurance procurement checklist

An age-assurance procurement must start with the service's actual risk and threshold, then test effectiveness, privacy, fairness, accessibility and redress. Buying the most intrusive method is not automatically safer or more compliant.

For: trust-and-safety, privacy, procurement, product and legal teams. This is independent information, not legal, compliance or security advice.

Purpose and proportionality

• State the protected group, risk, threshold and decision.
• Record why age assurance is necessary and which less intrusive options were considered.
• Decide whether the service needs an age band, over-threshold result or exact date.
• Separate legal requirements from platform policy.

Method and performance

• Method type and evidence used.
• Accuracy around the relevant threshold.
• False-adult and false-child outcomes.
• Demographic and environmental evaluation.
• Fallback for uncertain results and unsupported users.
• Resistance to spoofing, injection and repeated attempts.

Privacy and rights

• Data fields seen by issuer, provider and online service.
• Biometric processing and purpose.
• Retention, deletion, reuse and training-data policy.
• Linkability across services or sessions.
• Child-appropriate transparency and complaint/appeal route.

Delivery and contract

• SDK/API/hosted-flow support and accessibility.
• Latency, uptime and capacity.
• Pricing for attempts, retries, manual review and minimums.
• Subprocessors, incident notice and audit evidence.
• Change control, portability and exit.

Pilot scorecard

Measure protective effectiveness alongside completion, abandonment, uncertainty, appeal time, accessibility and privacy. Test with users near the threshold and with people lacking the expected document or device.

Evidence and limits

MyID separates enacted rules, official implementation material, testing and vendor claims. A source can establish what its publisher says; it does not prove that every product, deployment or interpretation works as claimed. Where Irish implementation remains unsettled, this page says so.

• EDPB Statement 1/2025 on Age Assurance
• European Commission approach to age verification
• Coimisiún na Meán Online Safety Code
• General Data Protection Regulation

Sources checked 22 August 2026. Re-check the linked primary material before making a consequential decision.

Next useful pages

• Methods hub
• Provider directory
• DPIA questions