EUDI Wallet and age verification: proving you are of age without exposing your identity

In short: the European digital identity wallet, provided for by the eIDAS 2.0 regulation (Regulation (EU) 2024/1183), will harmonise age checks across the Union. Thanks to selective disclosure, a citizen will be able to prove they are of age without revealing their date of birth or their full identity. For platforms that distribute sensitive content, this is the promise of reconciling compliance with data minimisation. Provided they anticipate the hybrid period, fallback methods and the risk of fraud, because proving an age is not always enough to prove who is presenting that age.

‍

Online age verification has become a political, regulatory and technical topic. Long reduced to a simple "I am over 18" box to tick, it is now at the heart of debates around the protection of minors. The European digital identity wallet offers a new answer: proving an age without exposing an identity.

‍

Why age verification is becoming a topic

‍

Regulatory pressure on the protection of minors online keeps growing. Platforms that give access to sensitive content are now required to put in place reliable age-control mechanisms (the well-known age-gating), rather than a simple declaration on one's honour.

‍

The problem is well known. Historical methods pit two hard-to-reconcile logics against each other:

• The tick box respects privacy, but is completely ineffective: any minor can click.
• Sending an identity document or a scan of a bank card is more reliable, but exposes sensitive personal data, creates high-risk databases and discourages legitimate users.

The demand from the market and from regulators is clear: age verification solutions that are both reliable and privacy-friendly. This is precisely what the European wallet addresses.

‍

How the wallet proves age without exposing identity

‍

The eIDAS 2.0 regulation harmonises electronic identification and age control across the Union. Each Member State will offer a digital identity wallet in which citizens will store verified attributes (identity, age, diplomas, licences, etc.).

‍

The key mechanism is called selective disclosure. It makes it possible to share only a specific attribute, without revealing the rest of the information contained in the wallet.

‍

The "of age / underage" example

‍

Take a user who wants to access a service reserved for people of legal age. With a classic identity document, they hand over their surname, first name, photo, document number and full date of birth. The platform therefore learns everything about them, when it only needs a single piece of information.

‍

With the wallet and selective disclosure, the journey changes radically:

• The user receives a request: "Is this person of age?"
• Their wallet answers with a simple verified attribute: "Yes, over 18".
• The platform learns neither the date of birth, nor the name, nor the full identity.

‍

The result: the platform obtains the proof it needs to comply, without ever collecting sensitive data. This is sometimes referred to as a "proof of age" attribute or zero-data age proof.

‍

Who is concerned

‍

Age verification through the wallet affects all players whose access depends on a legal age threshold. The first to be concerned are:

• Adult content platforms, on the front line of age-control obligations.
• The sale of alcohol and of restricted products (tobacco, e-cigarettes) online.
• Gambling and betting, sports betting and online casinos, already heavily regulated.
• Social media and digital services subject to growing requirements to protect minors.
• More broadly, any e-commerce service selling products reserved for adults.

‍

For these players, the wallet represents an opportunity: proving their compliance while reducing the amount of personal data stored, and therefore their exposure in the event of a security incident.

‍

The limits to anticipate

‍

The wallet does not solve everything, and its rollout calls for several points of vigilance.

‍

The hybrid period. Not all citizens will have a wallet immediately. For several years, part of the public will continue to show up without a digital wallet. Platforms will therefore have to plan alternative methods of age verification and not rely exclusively on the wallet.

‍

The fallback. A robust journey must include backup solutions for users who are not equipped, while guaranteeing the same level of reliability. The challenge is to prevent the fallback from becoming the loophole through which controls are bypassed.

‍

Fraud. Age control does not replace anti-fraud efforts. An "of age" attribute remains an attribute: it can be presented by a third party. A minor could, for example, use an adult's wallet. When the stakes are high (credit, account opening, large amounts), it remains essential to couple age proof with a check on the holder, that is, to make sure that the person presenting the attribute is indeed the one it belongs to. This is where fraud detection and identity verification come in.

‍

How to prepare

‍

For the players concerned, preparation does not mean waiting for the wallet to become widespread, but building journeys ready to welcome it right now. A few useful reflexes:

‍

• Map your obligations: precisely identify the points in your journey where an age threshold applies.
• Favour minimisation: request only the necessary attribute ("of age") rather than the full identity, in a privacy-by-design logic.
• Plan for hybrid mode: offer the wallet when it is available, and a reliable alternative method for everyone else.
• Calibrate the level of control according to the stakes: a simple age proof may be enough to access content, but a reinforced check on the holder becomes necessary as soon as the financial or fraud risk is high.
• Document every decision so as to be able to demonstrate compliance in the event of an audit.

‍

In conclusion

‍

The European wallet is a game changer for online age verification. By making it possible to prove "of age / over 18" without exposing the identity, it finally reconciles two long-opposed requirements: compliance and the protection of privacy. For adult content platforms, alcohol sales, gambling or social media, it is a valuable tool for proving legal age online while collecting less sensitive data.

‍

Still, age control is only one building block. During the hybrid period, platforms will have to deal with fallback methods, and above all never forget that proving an age is not proving a person. Coupling the wallet with dynamic fraud detection remains the best way to turn a regulatory obligation into a journey that is at once compliant, smooth and secure.

‍

Sources: Regulation (EU) 2024/1183 (eIDAS 2.0); European Commission, European Digital Identity Wallet (EUDI Wallet) framework and reference architecture (ARF).

‍