Check age with a proof that reveals only the age

How to do it

An ID upload hands you a full name, a number and a photo to protect, to answer a question that needs one bit. The Commission's guidelines of 14 July 2025 on Article 28 of the Digital Services Act name the EU age verification blueprint as a reference standard. They also name the EU Digital Identity Wallet. The W3C Digital Credentials API, a working draft, lets a page ask the browser for such a proof. Its protocols are OpenID for Verifiable Presentations and ISO mdoc. Verify the proof's signature and that it answers your own request, then store only the result, the method and the time. Where the browser lacks the API, show the same request as a QR code for a phone wallet. Ask only for the age claim, as Accept the EU Digital Identity Wallet where strong ID is needed says. Which platforms must check age is set in Protect minors on platforms they can reach.

Examples

JavaScript example

export async function requestAgeProof(signedRequest) {
  if (!('DigitalCredential' in window)) return { fallback: 'qr-code' };
  const credential = await navigator.credentials.get({
    digital: { requests: [{ protocol: 'openid4vp-v1-signed', data: signedRequest }] },
  });
  return fetch('/age-proof', { method: 'POST', body: JSON.stringify(credential.data) });
}

Python example

def record_age_proof(user, presentation, request_id: str) -> None:
    claim = verifier.verify(presentation, expected_request=request_id)
    user.age_check = {"over_18": claim["age_over_18"], "method": "wallet", "checked_at": now()}
    user.save()

How to check

A test runs the age check with a test credential. The user's row holds only the age result, the method and the time. A search of storage and logs finds no birth date, document number or document image from the check. A proof made for another request is refused.

Sources

• European Commission guidelines on the protection of minors
• W3C Digital Credentials

Related rules

• ACC-75 Get a parent's consent before relying on a child's consent in Accounts and identity
• ACC-72 Accept the EU Digital Identity Wallet where strong ID is needed in Accounts and identity
• CMP-70 Protect minors on platforms they can reach in Compliance and governance