Choose the age check that proves you are over 18 while sharing the least. Selfie age estimation, wallet or app tokens and phone operator checks reveal less than a document scan. Look for a named independent provider, a deletion promise and a yes-or-no result. Never pay for verification, and avoid any check delivered by email or pop-up.
Why privacy is the main worry
Age checks ask you to prove something about yourself at a sensitive moment. If the proof is stored, linked to your browsing or leaked, the damage can be lasting. That is why regulators in several countries now talk about privacy-preserving checks, not just effective ones.
Think of three questions as a buyer might: what does it cost me in personal data, how likely is it to work first time, and what happens to the data afterwards? The sections below help you answer them for each common method.
You do not choose which sites must check. You may, however, choose between methods, and that choice is the closest thing to a buying decision. Treat it like one.
The main methods compared
| Method | What you share | Privacy risk |
|---|---|---|
| Selfie age estimation | A live face image | Moderate; deleted afterwards, say providers |
| Document upload | ID image plus selfie | Highest if stored |
| Card or bank check | Payment details | Moderate; may not prove age |
| Phone operator check | Account confirmation | Low; no name shared |
| Wallet or app token | A yes-or-no proof | Lowest by design |
What can go wrong
The risks are practical. Providers can be breached, images can be kept longer than promised, and a poorly designed system can connect a verified identity to the sites a person visits.
A further risk is that people get used to uploading sensitive items on request, which makes scams easier. Security researchers have repeatedly warned that the more often a population is trained to hand over documents, the more profitable fake gates become. Regulators therefore stress clear design, visible provider names and short retention.
Facial estimation can also be wrong near the threshold, leaving some adults asked to try again. Regulators have noted that accuracy, bias and resistance to tricks such as photos of photos matter, and the UK regulator has said it has doubts about some age-inference models.
What good looks like
France's regulator set out one of the clearest privacy designs, called double anonymity. In plain terms, the checker should not learn which site you are visiting, and the site should not learn who you are. Users should be offered at least one method that meets this standard, and the level of data protection should be shown.
In the UK, Ofcom has said that highly effective methods can include facial age estimation, photo identification matching, open banking and mobile operator checks, while simple self-declaration is not enough. The regulator has also reported tens of millions of checks being completed across services in the second half of 2025, which shows how common they have become.
The European Commission has been developing an age verification app on similar principles, though timelines have been reported to move.
A checklist before you tap continue
- Is the provider named, independent of the site and described clearly?
- Does it say how long data is kept, ideally deleted straight away?
- Does the site receive only a pass or fail?
- Are you being asked for more than the check needs, such as a card number or a home address?
- Did you reach this page by typing the address or using a trusted bookmark?
It also helps to keep a separate email address for sign-ups, to use a password manager, and to avoid doing a check on public Wi-Fi. If the check fails, try another method rather than repeating the same one over and over, because repeated uploads multiply the number of copies of your data.
If any answer is no, stop and go back.
Finally, remember that you can usually decline. If a method feels too invasive, leaving the page is a legitimate choice, and no lawful check requires you to accept terms you do not understand. Taking a minute to read the data statement is always worth the time, even when a site makes it look optional.
Scams that copy age gates
Because many people now expect a check, criminals build fake ones. Typical signs include a fee, a countdown timer, a request to send documents by email, or a web address that differs from the one you typed.
If you already shared something, change affected passwords, tell your bank about any card data, and consider a credit freeze if identity documents were exposed. You can also use the report page here to flag a copycat.
Key takeaways
- Pick the method that shares the least while still proving you are over 18.
- App tokens and phone operator checks are generally lower-risk than document uploads.
- Look for a named provider, a deletion statement and a pass-or-fail result.
- France's double-anonymity design separates the checker from the website.
- Never pay for verification or send documents by email or chat.
Frequently asked questions
This article is general information, not legal, financial or medical advice. Details about third-party services are based on public information and may change.