Document-based age verification

A document can provide authoritative date-of-birth evidence, but an online service rarely needs every field printed on it. Design the flow to validate the age result while minimising identity disclosure and retention.

For: age-assurance product, privacy, fraud and procurement teams. This is independent information, not legal, compliance or security advice.

Two architectures

Direct document check	Reusable/derived proof
Service/provider sees evidence during the access event	Issuer checks evidence during enrolment
May expose name, DOB, number and portrait	Relying service can receive only over-threshold result
Repeated at each service	Can be presented again subject to trust/status

Document controls

• Supported evidence and validation depth.
• Expiry and age calculation rules.
• Ownership or control where needed.
• Forgery, replay and injection protections.
• Handling of unsupported, damaged or foreign documents.

Minimise the record

Decide whether the relying service needs the date of birth, an over-age result or simply evidence that a check passed. Avoid retaining full images for convenience, and prevent unrelated identity, profiling or advertising use.

Fallback

People may not have the expected document, compatible device or ability to capture it. Offer another effective route and avoid repeatedly collecting high-value identity evidence after technical failure.

Evidence and limits

MyID separates enacted rules, official implementation material, testing and vendor claims. A source can establish what its publisher says; it does not prove that every product, deployment or interpretation works as claimed. Where Irish implementation remains unsettled, this page says so.

• EDPB Statement 1/2025 on Age Assurance
• EU Age Verification Solution Q&A
• General Data Protection Regulation

Sources checked 22 August 2026. Re-check the linked primary material before making a consequential decision.

Next useful pages

• Wallet proof of age
• Facial estimation
• Privacy principles