| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| privacy:age_assurance [2026/09/15 16:57] – Review fixes: correct the 2019 age-verification denominator (a hand check of <=50 sites in 4 countries, not 6,843 from six vantage points); add Ofcom's July 2026 statutory report and the EC's Meta DSA finding; correct the Chrome Digital Credentials milest karel.kubicek.claude | privacy:age_assurance [2026/09/15 17:21] (current) – Second review round: retract a false claim that a cited paper's repository URL is broken (it is a de-hyphenation artefact in the corpus renderings), name the Zenodo record's actual title, bound three more negatives, and state the unguarded-figure class in karel.kubicek.claude |
|---|
| You want to know how many sites in your sample ask the visitor how old they are. The literature will not tell you, and this page is mostly about why, and about what you have to build and write down yourself. | You want to know how many sites in your sample ask the visitor how old they are. The literature will not tell you, and this page is mostly about why, and about what you have to build and write down yourself. |
| |
| Of the **5,855 papers** in the [[literature:corpus|publication corpus]] whose full text is on disk, **38** contain any of the phrases //age verification//, //age assurance//, //age gate//, //age estimation// or //age check// at all. Reading all 38: **one** has age assurance as its research question, **four more** measure it in a section, **six** hit it as an obstacle to a measurement about something else, and the rest are background, regulation text or a de-columning artefact. One of the five is about the web; the other four are about Android and iOS apps. | Of the **5,855 papers** in the [[literature:corpus|publication corpus]] whose full text is on disk, **38** use any age-assurance phrase at all — //age verification//, //age assurance//, //age gate//, //age estimation//, //age check// and nine further forms, including //verify their age// and //prove their age//; the exact pattern is on the provenance page. Reading all 38: **one** has age assurance as its research question, **four more** measure it in a section, **six** hit it as an obstacle to a measurement about something else, and the rest are neither: **20** mention it in passing — in background, in a regulation, as a category label, or as the name of an unrelated face-attribute task — and in **7** the phrase is a de-columning artefact (//voltage signal//) or a cited title in a bibliography. One of the five is about the web; the other four are about Android apps. |
| |
| Meanwhile the UK requires "highly effective age assurance" on pornography services since July 2025, the European Commission has shipped a reference age-verification app and preliminarily found Meta in breach of the DSA for accepting a self-declared birth date, the US Supreme Court upheld the Texas age-verification statute in June 2025, and Google Play has been returning per-jurisdiction age signals to Android apps since March 2026. **The deployment surface is moving several years ahead of the published measurement** — and the one large deployment measurement that does exist was produced by a regulator using statutory information notices, not by a crawl. If you are reading this because you want to measure it, you are not late; you are early. | Meanwhile the UK requires "highly effective age assurance" on pornography services since July 2025, the European Commission has shipped a reference age-verification app and preliminarily found Meta in breach of the DSA for accepting a self-declared birth date, the US Supreme Court upheld the Texas age-verification statute in June 2025, and Google Play has been returning per-jurisdiction age signals to Android apps since March 2026. **The deployment surface is moving several years ahead of the published measurement** — and the one large deployment measurement that does exist was produced by a regulator using statutory information notices, not by a crawl. If you are reading this because you want to measure it, you are not late; you are early. |
| ===== "Age gate" is eight things ===== | ===== "Age gate" is eight things ===== |
| |
| The single biggest source of incomparable numbers here is that the term spans a range from a button to a government identity credential. The ordering below is the one the field and the regulators both use — cost to the subject, and resistance to a determined minor, rise together. | The single biggest source of incomparable numbers here is that the term spans a range from a button to a government identity credential. The ordering below is this page's own: it is the axis {[yao2025_easy]}'s Table 2 sorts on, and it runs across the line Ofcom draws between methods capable of being highly effective and methods that are not. Cost to the subject and resistance to a determined minor rise together. |
| |
| ^ Mechanism ^ What the user does ^ What a crawler can observe ^ Counts as assurance under the UK rules? ^ | ^ Mechanism ^ What the user does ^ What a crawler can observe ^ Ofcom's January 2025 position ^ |
| | **Click-through interstitial** | clicks //"I am over 18"// | a DOM overlay and a click that dismisses it; usually a cookie | no | | | **Click-through interstitial** | clicks //"I am over 18"// | a DOM overlay and a click that dismisses it; usually a cookie | explicitly **not** highly effective (self-declaration) | |
| | **Self-declared date of birth** | types a birth date into a form | a form with a date control, submitted | no | | | **Self-declared date of birth** | types a birth date into a form | a form with a date control, submitted | explicitly **not** highly effective | |
| | **Template / knowledge check** | answers a maths question a child could not | a form; the question text | no | | | **Template / knowledge check** | answers a maths question a child could not | a form; the question text | not named either way | |
| | **Credit-card check** | enters card details | a payment SDK or an iframe from a PSP | only if the card requires the holder to be 18 | | | **Credit-card check** | enters card details | a payment SDK or an iframe from a PSP | named as capable — but an online payment that does not require the payer to be 18 is explicitly excluded | |
| | **ID-number lookup** | types a national ID number, checked against a register | a form and a third-party XHR | yes, as a digital identity service | | | **ID-number lookup** | types a national ID number, checked against a register | a form and a third-party XHR | named as capable, as a digital identity service | |
| | **Document upload with OCR** | photographs a passport or licence | a file input, a camera permission prompt, an upload | yes | | | **Document upload with OCR** | photographs a passport or licence | a file input, a camera permission prompt, an upload | named as capable, as photo ID matching | |
| | **Facial age estimation** | takes a selfie | a camera permission prompt, a vendor SDK or an iframe | yes | | | **Facial age estimation** | takes a selfie | a camera permission prompt, a vendor SDK or an iframe | named as capable | |
| | **Device or OS signal** | nothing — the platform asserts an age band | a platform API call, invisible from the network | yes, where the platform is a recognised source | | | **Device or OS signal** | nothing — the platform asserts an age band | a platform API call, invisible from the network | not named as such; the closest named method is a mobile network operator age check | |
| |
| Three consequences for a measurement: | Three methods Ofcom names are not rows above because they do not have a distinct crawl signature: **open banking**, **mobile network operator age checks** and **email-based age estimation**. If you are classifying what you observe, they will land in the ID-lookup or device-signal buckets. Ofcom's list is explicitly non-exhaustive, so "not named" is not the same as "excluded" — only the two self-declaration rows are actually ruled out. |
| |
| * **The first three are the ones that exist at scale, and the last five are the ones that regulators call age assurance.** Ofcom's January 2025 guidance names //"open banking, photo ID matching, facial age estimation, mobile network operator age checks, credit card checks, digital identity services and email-based age estimation"// as capable of being highly effective, and states that //"methods including self-declaration of age and online payments which don't require a person to be 18 are not highly effective"//.((Ofcom, //Ofcom publishes industry guidance on effective age checks//, published 16 January 2025. Ofcom's site returns HTTP 403 to this sandbox; quoted from the Internet Archive capture of 13 May 2026, https://web.archive.org/web/20260513043257/https://www.ofcom.org.uk/online-safety/protecting-children/age-checks-to-protect-children-online )) A 2019 prevalence figure for "sites with an age gate" is therefore a figure for a category the current rules explicitly exclude. Do not present it as a compliance rate. | Four consequences for a measurement: |
| | |
| | * **The cheap end is what the literature measured and the expensive end is what the regulator now counts.** Both halves of that are population-bound: the age gate is the most common mechanism among 1,165 verifying Android apps in a 2024 snapshot {[yao2025_easy]}, while Ofcom reports //"facial age estimation and photo ID matching the most commonly deployed"// among the 32 UK services it analysed in 2026. They are not the same population and neither is "the web". Ofcom's January 2025 guidance names //"open banking, photo ID matching, facial age estimation, mobile network operator age checks, credit card checks, digital identity services and email-based age estimation"// as capable of being highly effective, and states that //"methods including self-declaration of age and online payments which don't require a person to be 18 are not highly effective"//.((Ofcom, //Ofcom publishes industry guidance on effective age checks//, published 16 January 2025. Ofcom's site returns HTTP 403 to this sandbox; quoted from the Internet Archive capture of 13 May 2026, https://web.archive.org/web/20260513043257/https://www.ofcom.org.uk/online-safety/protecting-children/age-checks-to-protect-children-online )) A 2019 prevalence figure for "sites with an age gate" is therefore a figure for a category the current rules explicitly exclude. Do not present it as a compliance rate. |
| * **The last row is invisible to a network measurement.** Apple ships a ''DeclaredAgeRange'' framework in iOS, iPadOS and macOS 26.0 that hands an app an age range without a server ever seeing a request.((https://developer.apple.com/documentation/declaredagerange — platform availability iOS/iPadOS/macOS/Mac Catalyst 26.0, not beta; read from the documentation JSON on 2026-09-15.)) Google Play's Age Signals API //"started returning age signals for users in Brazil"// on 17 March 2026 and for Texas accounts created after 28 May 2026.((https://developer.android.com/google/play/age-signals , read 2026-09-15. The API is marked beta.)) On the web the equivalent is the W3C Digital Credentials API: Chrome **shipped** presentation support in Chrome 141 — the origin trial ran from 134 on desktop and 128 on Android and has closed — and lists issuance support against Chrome 155, which has not arrived; Chrome 153 was the stable release on 8 September 2026.((chromestatus.com features 5166035265650688 (presentation) and 5099333963874304 (issuance), read via the chromestatus API on 2026-09-15; stable-channel version from chromiumdash.appspot.com. Read the ''stages'' array, not the summary ''status'' field: the latter still reports "Origin trial, 141" for presentation, where stage 160 — ship — gives desktop and Android 141 and the trial stage gives 134 and 128.)) A crawler that instruments ''navigator.credentials.get'' can see that one; nothing on the network sees the two mobile ones. | * **The last row is invisible to a network measurement.** Apple ships a ''DeclaredAgeRange'' framework in iOS, iPadOS and macOS 26.0 that hands an app an age range without a server ever seeing a request.((https://developer.apple.com/documentation/declaredagerange — platform availability iOS/iPadOS/macOS/Mac Catalyst 26.0, not beta; read from the documentation JSON on 2026-09-15.)) Google Play's Age Signals API //"started returning age signals for users in Brazil"// on 17 March 2026 and for Texas accounts created after 28 May 2026.((https://developer.android.com/google/play/age-signals , read 2026-09-15. The API is marked beta.)) On the web the equivalent is the W3C Digital Credentials API: Chrome **shipped** presentation support in Chrome 141 — the origin trial ran from 134 on desktop and 128 on Android and has closed — and lists issuance support against Chrome 155, which has not arrived; Chrome 153 was the stable release on 8 September 2026.((chromestatus.com features 5166035265650688 (presentation) and 5099333963874304 (issuance), read via the chromestatus API on 2026-09-15; stable-channel version from chromiumdash.appspot.com. Read the ''stages'' array, not the summary ''status'' field: the latter still reports "Origin trial, 141" for presentation, where stage 160 — ship — gives desktop and Android 141 and the trial stage gives 134 and 128.)) A crawler that instruments ''navigator.credentials.get'' can see that one; nothing on the network sees the two mobile ones. |
| * **The privacy properties differ as much as the strength does.** A PoPETs 2026 framework paper working through digital identification systems gives age verification as its worked example of unlinkability — //"An age verification app generates one-time use credentials so that a user's sessions can not be linked"// {[woodruff2026_risk]} — which is what the EU blueprint is building and what a document upload is not. If you are classifying mechanisms, classify them on what the verifier learns and what the issuer learns, not only on how hard they are to fool. | * **The privacy properties differ as much as the strength does.** A PoPETs 2026 framework paper working through digital identification systems gives age verification as its worked example of unlinkability — //"An age verification app generates one-time use credentials so that a user's sessions can not be linked"// {[woodruff2026_risk]} — which is what the EU blueprint is building and what a document upload is not. If you are classifying mechanisms, classify them on what the verifier learns and what the issuer learns, not only on how hard they are to fool. |
| |
| * **3.67% of adult-only Android apps implement any age verification at all** — 1,165 of 31,750 apps carrying Google Play's "17+" tag, themselves drawn from 693,334 apps {[yao2025_easy]}. Of the 1,165, the weakest mechanism is the most common: the age gate is //"the most widely implemented method (31.84%)"//, and biometric verification //"the least utilized (8.48%)"//. The store rating is not the age the app enforces either: //"Despite being rated as 17+, 152 apps actually enforce an age limit of 21 years"//, and 309 set it at 16. | * **3.67% of adult-only Android apps implement any age verification at all** — 1,165 of 31,750 apps carrying Google Play's "17+" tag, themselves drawn from 693,334 apps {[yao2025_easy]}. Of the 1,165, the weakest mechanism is the most common: the age gate is //"the most widely implemented method (31.84%)"//, and biometric verification //"the least utilized (8.48%)"//. The store rating is not the age the app enforces either: //"Despite being rated as 17+, 152 apps actually enforce an age limit of 21 years"//, and 309 set it at 16. |
| * **20% of pornographic websites showed any age-verification mechanism** in 2019 from the USA, the UK and Spain, and **14%** from Russia {[vallina2019_porn]}. **Read the denominator before reusing this.** It is not the paper's 6,843-site corpus: the authors found their own keyword detector too false-positive-prone to trust — //"specially so in age-related keywords that appear often in the content of the websites"// — and so //"only investigate a subset of the top-50 most popular pornographic websites manually"//, in four countries. 20% is therefore at most ten sites, hand-checked. The mechanism was a warning and a button, and the paper's own assessment of it is the sentence to quote in your related work: //"if our automatic crawler manages to bypass the mechanism, a child could do it as well"//. | * **20% of pornographic websites showed any age-verification mechanism** in 2019 from the USA, the UK and Spain, and **14%** from Russia {[vallina2019_porn]}. **Read the denominator before reusing this.** It is not the paper's 6,843-site corpus: the authors found their own keyword detector too false-positive-prone to trust — //"specially so in age-related keywords that appear often in the content of the websites"// — and so //"only investigate a subset of the top-50 most popular pornographic websites manually"//, in four countries. 20% is therefore at most ten sites, hand-checked. The mechanism was a warning and a button, and the paper's own assessment of it is the sentence to quote in your related work: //"if our automatic crawler manages to bypass the mechanism, a child could do it as well"//. The one real verification product of the era went unobserved: //"we did not find any instance of AgeID being deployed during our study"//. |
| * **Deployment is conditioned on where you appear to be, and not monotonically.** In the same hand-checked set, **8%** of the sites that did not verify from the other countries did verify from Russia, and **12%** verified everywhere except Russia {[vallina2019_porn]}. A single-vantage crawl gets neither number — and neither does an automated one, on this paper's own account. | * **Deployment is conditioned on where you appear to be, and not monotonically.** In the same hand-checked set, **8%** of the sites that did not verify from the other countries did verify from Russia, and **12%** verified everywhere except Russia {[vallina2019_porn]}. A single-vantage crawl gets neither number — and neither does an automated one, on this paper's own account. |
| * **A deployed facial age-estimation model is not uniformly accurate.** Extracting the local vision models from the TikTok and Instagram Android apps, //"we evaluate the effectiveness of age verification. We find that age verification, if done using the model deployed by TikTok, is less effective for younger demographics"// {[west2024_picture]}. This is the only paper in the corpus that measures how well an age-assurance mechanism //works//, as opposed to whether it is present — although age is only one of its two case studies, and the paper is framed as an on-device-ML fairness audit rather than as an age-assurance study. | * **A deployed facial age-estimation model is not uniformly accurate.** Extracting the local vision models from the TikTok and Instagram Android apps, //"we evaluate the effectiveness of age verification. We find that age verification, if done using the model deployed by TikTok, is less effective for younger demographics"// {[west2024_picture]}. This is the only paper in the corpus that measures how well an age-assurance mechanism //works//, as opposed to whether it is present — although age is only one of its two case studies, and the paper is framed as an on-device-ML fairness audit rather than as an age-assurance study. |
| * **Self-report is not deployment.** 16% of 50 surveyed child-directed-app developers said they use age gates to obtain parental consent, and 6% said their own gate could be //"trivially bypassed by providing a birth year"// — and when the same authors tested those organisations' apps from Californian IP addresses they //"did not observe any mechanisms for obtaining verifiable parental consent"// at all {[alomar2022_developers]}. If your design is a developer survey, you need the crawl too. | * **Self-report is not deployment.** 16% of 50 surveyed child-directed-app developers said they use age gates to obtain parental consent, and 6% said their own gate could be //"trivially bypassed by providing a birth year"// — and when the same authors tested those organisations' apps from Californian IP addresses they //"did not observe any mechanisms for obtaining verifiable parental consent"// at all {[alomar2022_developers]}. If your design is a developer survey, you need the crawl too. |
| * **Where a measurement did classify mechanisms, it found many.** 137 expert-approved children's apps used //"a total of 13 different methods"// for age assurance, most commonly asking for a year of birth (12 apps) {[ekambaranathan2022_poster]}. A poster, n=137 — but it is the only mechanism taxonomy derived from observation rather than from regulation. | * **Where a measurement did classify mechanisms, it found many.** 137 expert-approved children's apps used //"a total of 13 different methods"// for age assurance, most commonly asking for a year of birth (12 apps) {[ekambaranathan2022_poster]}. A poster, n=137 — but it is the only taxonomy in the corpus derived from watching children's apps rather than from a regulator's list, and the only one at all outside {[yao2025_easy]}'s six Android categories. |
| |
| ==== The measurement that exists is the regulator's ==== | ==== The measurement that exists is the regulator's ==== |
| |
| The reason a web-side prevalence figure is hard to find in the literature is not that nobody has one. Ofcom published a statutory report on 16 July 2026 under s157 of the Online Safety Act 2023, and it is the largest deployment measurement of age assurance in existence.((Ofcom, //Report on the use of age assurance//, presented to Parliament under s157 of the Online Safety Act 2023, published 16 July 2026, 92 pp. Fetched on 2026-09-15 from the UK government's asset host, ''assets.publishing.service.gov.uk/media/6a56377e2f6185941a9a6493/Report_on_the_use_of_age_assurance.pdf'', because ofcom.org.uk 403s this sandbox. All figures below are verbatim from that PDF.)) Its method is the part to notice: | The reason a web-side prevalence figure is hard to find in the literature is not that nobody has one. Ofcom published a statutory report on 16 July 2026 under s157 of the Online Safety Act 2023, and it is the largest deployment measurement of age assurance this page has been able to find.((Ofcom, //Report on the use of age assurance//, presented to Parliament under s157 of the Online Safety Act 2023, published 16 July 2026, 92 pp. Fetched on 2026-09-15 from the UK government's asset host, ''assets.publishing.service.gov.uk/media/6a56377e2f6185941a9a6493/Report_on_the_use_of_age_assurance.pdf'', because ofcom.org.uk 403s this sandbox. Every quoted phrase and every figure below is taken from that PDF, not from secondary coverage of it.)) Its method is the part to notice: |
| |
| <WRAP important> | <WRAP important> |
| * On the mechanism the platforms built themselves, the report records //"serious doubts about the efficacy of some age inference models, which analyse a user's activity and behaviour on a platform to estimate whether they are a child or an adult"//. | * On the mechanism the platforms built themselves, the report records //"serious doubts about the efficacy of some age inference models, which analyse a user's activity and behaviour on a platform to estimate whether they are a child or an adult"//. |
| |
| Set that against the corpus: the field's most-cited web figure is 20% of at most fifty sites, hand-checked in 2019. The gap is not that the phenomenon is unmeasurable. It is that **the only instrument that currently works at scale is a legal power**, and the resulting numbers are unauditable by anyone outside the regulator. That is the research opportunity: an independent, crawl-based estimate of the same quantities, with a published detector and a published error rate, does not exist. | Set that against the corpus: the only web-side figure in it is 20% of at most fifty sites, hand-checked in 2019. The gap is not that the phenomenon is unmeasurable. It is that **the only instrument that currently works at scale is a legal power**, and the resulting numbers are unauditable by anyone outside the regulator. That is the research opportunity: no independent, crawl-based estimate of the same quantities — with a published detector and a published error rate — appears in these seven venues, and none was found outside them either. |
| |
| ==== When, and where ==== | ==== When, and where ==== |
| * 2025 and 2026 are provisional venue-years: CCS 2026 and IMC 2026 have not been held, and IEEE S&P and WWW 2026 abstracts are not in the selection source. See [[Literature:Corpus]]. | * 2025 and 2026 are provisional venue-years: CCS 2026 and IMC 2026 have not been held, and IEEE S&P and WWW 2026 abstracts are not in the selection source. See [[Literature:Corpus]]. |
| |
| PoPETs carries 17 of the 38 candidates and every other venue is in single figures. The shape worth noticing is that the mentions are growing and the measurements are not: 17 of the 38 candidates are from 2025–2026, and one of them measures anything. | PoPETs carries 17 of the 38 candidates and every other venue is in single figures. **17 of the 38 candidates are from 2025–2026**, which is 44.7% of the candidates against 20.2% of the corpus — the topic is being talked about more. Only one of those 17 measures anything, but with one to two measurement papers per year across the whole window, that is a small-//n// observation and not a trend. |
| |
| ===== Age assurance as an obstacle, not an object ===== | ===== Age assurance as an obstacle, not an object ===== |
| |
| Six of the 38 papers are not about age assurance at all. They ran into it. This is currently the most common way age assurance appears in the corpus, it is the thing least likely to be in anyone's related-work section, and it is probably why your own crawl will care. | Six of the 38 papers are not about age assurance at all. They ran into it. That is more papers than measure it, it is the thing least likely to be in anyone's related-work section, and it is probably why your own crawl will care. |
| |
| * **It removes categories from your population.** An app-store study across Google Play and the App Store reports that //"some potentially interesting app categories, such as dating apps, require age verification to install them. We could not provide any of the available verification measures at the required scale"// {[breuer2026_ad]}. That is a sampling frame silently cut down by a deployment decision. | * **It removes categories from your population.** An app-store study across Google Play and the App Store reports that //"some potentially interesting app categories, such as dating apps, require age verification to install them. We could not provide any of the available verification measures at the required scale"// {[breuer2026_ad]}. That is a sampling frame silently cut down by a deployment decision. |
| |
| <WRAP tip> | <WRAP tip> |
| If your crawl is about something else, the cheap insurance is one boolean per page load: //did anything block the first interaction//. Record the overlay, the final URL and the cookies set before you interacted, and you can answer an age-gate question later without re-crawling. Not recording it is how the six papers above ended up describing the obstacle in prose rather than measuring it. | If your crawl is about something else, the cheap insurance is one boolean per page load: //did anything block the first interaction//. Record the overlay, the final URL and the cookies set before you interacted, and you can answer an age-gate question later without re-crawling. None of the six papers above recorded it, which is why each describes the obstacle in prose and none of them can say how often it happened. |
| </WRAP> | </WRAP> |
| |
| |
| ^ Method ^ Platform ^ How it works ^ Known weakness ^ | ^ Method ^ Platform ^ How it works ^ Known weakness ^ |
| | {[vallina2019_porn]}, IMC 2019 | web | a Selenium crawler parses the landing page for floating elements containing //"Yes"//, //"Enter"//, //"Agree"//, //"Continue"// or //"Accept"//, inspects the text of the parent and grandparent elements, and clicks | keyword- and language-bound; finds the interstitial it was told to look for, and no other kind | | | {[vallina2019_porn]}, IMC 2019 | web | a Selenium crawler parses the landing page for floating elements containing //"Yes"//, //"Enter"//, //"Agree"//, //"Continue"// or //"Accept"// //"in 8 languages"//, inspects the text of the parent and grandparent elements, and clicks | keyword-bound: it finds the interstitial it was told to look for and no other kind. The paper says it validates the method in §7.2; what §7.2 actually does is replace it with a manual check, and no false-positive or false-negative figure is reported | |
| | GUARD {[yao2025_easy]}, USENIX 2025 | Android | static extraction of UI elements, taint analysis from age-related inputs, then dynamic path exploration to reach the flow | needs the binary; the paper says its accuracy //"heavily relies on taint analysis, which might not be perfect"//, and reports 3 false positives and 2 false negatives on 100 hand-checked apps from each side of its own classification | | | GUARD {[yao2025_easy]}, USENIX 2025 | Android | static extraction of UI elements, taint analysis from age-related inputs, then dynamic path exploration to reach the flow | needs the binary; the paper says its accuracy //"heavily relies on taint analysis, which might not be perfect"//, and reports 3 false positives and 2 false negatives on 100 hand-checked apps from each side of its own classification | |
| |
| |
| * **The gate is not an HTTP status.** It is a DOM overlay served with a 200, exactly like the block pages [[Design:Blocking and geodifference]] deals with, and the same three habits apply: record the status, the final URL, the body hash and the first couple of kilobytes of every response, so a later pass can find the interstitial you did not know to look for. | * **The gate is not an HTTP status.** It is a DOM overlay served with a 200, exactly like the block pages [[Design:Blocking and geodifference]] deals with, and the same three habits apply: record the status, the final URL, the body hash and the first couple of kilobytes of every response, so a later pass can find the interstitial you did not know to look for. |
| | * **The gate is almost always a third party, which is the most promising thing about it.** Ofcom found that //"Almost all analysed pornography services relied exclusively on third-party vendors, with only one analysed pornography service using an in-house solution"//, and that services //"receive minimal outcome signals from third-party age assurance providers"//. A mechanism supplied by a handful of vendors is detectable the same way a tracker is — by the third-party origins loaded before the first interaction — which puts the method within reach of the machinery on [[Privacy:Requests]] and [[Programming:Filter lists]] rather than requiring a bespoke DOM heuristic. Nobody has published such a vendor list; the certification schemes the services named to Ofcom (the UK Age Check Certification Scheme, NIST testing, ISO-based certifications) are where to start building one, and the resulting list is the artefact this field is missing. |
| * **It can be a redirect chain instead.** Some deployments send the visitor to a separate verification origin and back. If your pipeline keeps only the final URL, the hop is the only trace, and if it keeps only the initial URL the gate is invisible. | * **It can be a redirect chain instead.** Some deployments send the visitor to a separate verification origin and back. If your pipeline keeps only the final URL, the hop is the only trace, and if it keeps only the initial URL the gate is invisible. |
| * **It sets state before consent.** A gate that remembers you clicked "I am 18" is a cookie or a ''localStorage'' entry written before any consent interaction, and often on the first load. It is therefore a confounder for [[Privacy:Consent]] and for anything in [[Privacy:Cookies]] that counts pre-consent storage — and, separately, a signal you can detect: a first-party cookie written at the moment an overlay was dismissed. | * **It sets state before consent.** A gate that remembers you clicked "I am 18" is a cookie or a ''localStorage'' entry written before any consent interaction, and often on the first load. It is therefore a confounder for [[Privacy:Consent]] and for anything in [[Privacy:Cookies]] that counts pre-consent storage — and, separately, a signal you can detect: a first-party cookie written at the moment an overlay was dismissed. |
| * **It defeats stateless crawling.** Stateful and stateless crawls disagree here by construction, because the whole point of the gate's cookie is to not show it twice; see [[Programming:Stateful stateless]]. | * **It defeats stateless crawling.** Stateful and stateless crawls disagree here by construction, because the whole point of the gate's cookie is to not show it twice; see [[Programming:Stateful stateless]]. |
| * **Language.** The 2019 keyword list is English. Any prevalence claim over a multilingual sample inherits the language coverage of its keyword list, which is the problem [[Programming:Multilingual support]] is about. | * **Language.** The 2019 keyword list covers eight languages — English, Spanish, French, Portuguese, Russian, Italian, German and Romanian, chosen as //"the most common default languages in our list of pornographic websites"// {[vallina2019_porn]}. That is a list tuned to one sample, not a general one, and any prevalence claim over a multilingual population inherits the language coverage of its keyword list; see [[Programming:Multilingual support]]. |
| | |
| | ===== What already exists, so you do not rebuild it ===== |
| | |
| | Four artefacts, all checked on 2026-09-15. No dataset of age gates and no filter list for them was found, in the corpus or outside it; this is what there is. |
| | |
| | ^ Artefact ^ What it is ^ State ^ |
| | | GUARD {[yao2025_easy]} | the Android age-verification detector: static UI extraction, taint analysis, dynamic path exploration | ''zenodo.org/records/14688696'', HTTP 200. The only published age-assurance detector whose code you can run — but **the record is titled //Drexel-SePAL/AgeScope: v1.0.1-1// (2025-01-21)**, not GUARD, so searching for the paper's name will not find it. | |
| | | ''500-labels-resources'' {[west2024_picture]} | code and data for extracting and evaluating the on-device vision models, including the age model | ''github.com/wi-pi/500-labels-resources'', HTTP 200. | |
| | | ''kids_websites.csv'' {[moti2024_targeted]} | **the 2,004 hand-verified child-directed websites**, as a plain URL list — the only reusable population artefact for the children's-privacy denominator | ''github.com/targeted-and-troublesome'', HTTP 200. The list is ''urls/kids_websites.csv'' in the ''targeted-and-troublesome-crawler'' repository: 55,481 bytes, **2,004 distinct URLs**, matching the paper exactly; last pushed 2025-02-04. Note the org name has a hyphen before //troublesome//: the corpus extraction and every ''.txt'' rendering of the PDF drop it, because the URL breaks across a line at ''targeted-and-'' and the de-hyphenation swallows it. | |
| | | DiffAudit {[figueira2024_diffaudit]} | implementation and datasets for the age-tiered differential audit | ''athinagroup.eng.uci.edu/projects/childrens-privacy/'', HTTP 200. | |
| | |
| | Two things that do **not** exist and that you will need: |
| | |
| | * **A population of sites plausibly in scope of an age rule.** {[vallina2019_porn]} built its 6,843 from three curated adult directories plus **Alexa's Adult category** — and Alexa was retired in 2022, so that construction cannot be repeated. Whatever you build instead is a methodological contribution in its own right, and belongs in the paper rather than in a footnote. [[Design:Website selection]] and [[Design:Website classification]] are the general machinery. |
| | * **A hostname list for verification vendors.** None was found, and it is the single highest-leverage thing to build, for the reason in the detection section: the gate is nearly always a third party. The certification schemes the UK services named to Ofcom — the Age Check Certification Scheme, NIST testing, ISO-based certifications — are a seed list of vendors to resolve to hostnames, and [[Programming:Filter lists]] is how to express the result. |
| |
| ===== The denominator question ===== | ===== The denominator question ===== |
| //"Sites with an age gate"// is not a quantity. Three things have to be fixed before it becomes one, and the corpus shows what happens when they are not. | //"Sites with an age gate"// is not a quantity. Three things have to be fixed before it becomes one, and the corpus shows what happens when they are not. |
| |
| - **Which population.** The two academic figures that exist are over at most fifty hand-checked pornographic sites {[vallina2019_porn]} and over an app store's "17+" tag {[yao2025_easy]}. Neither is a sample of the web, and neither generalises to a Tranco slice. If your population is a ranking list, say what fraction of it could plausibly be in scope of any age rule at all — most of it cannot — or your denominator will swamp your numerator. | - **Which population.** The two academic figures that exist are over the hand-checked porn sample {[vallina2019_porn]} and over an app store's "17+" tag {[yao2025_easy]}. Neither is a sample of the web, and neither generalises to a Tranco slice. If your population is a ranking list, say what fraction of it could plausibly be in scope of any age rule at all — most of it cannot — or your denominator will swamp your numerator. |
| - **Which jurisdiction you appeared to be in.** Not where your VPS is: where the site thought you were. The 20%-vs-14% and the 8%/12% asymmetry in {[vallina2019_porn]} are the whole finding, and they come from repeating the same manual check from four countries. Since 2025 this has become sharper, not softer: the UK duty applies to services //likely to be accessed by UK children//, Texas's statute to Texas visitors, and Google Play returns age signals for Brazil and for Texas accounts specifically. Read [[Design:Crawling location]] before choosing, and verify the vantage rather than assuming it. | - **Which jurisdiction you appeared to be in.** Not where your VPS is: where the site thought you were. The 20%-vs-14% and the 8%/12% asymmetry in {[vallina2019_porn]} are the whole finding, and they come from repeating the same manual check from four countries. Since 2025 this has become sharper, not softer: the UK duty applies to services //likely to be accessed by UK children//, Texas's statute to Texas visitors, and Google Play returns age signals for Brazil and for Texas accounts specifically. Read [[Design:Crawling location]] before choosing, and verify the vantage rather than assuming it. |
| - **What you counted as a gate.** Per the table at the top of this page, a click-through and a document upload are both "an age gate" in ordinary speech and are different measurements. Publish the mechanism breakdown or publish a rule, and expect a reviewer to ask which of the eight rows you included. | - **What you counted as a gate.** Per the table at the top of this page, a click-through and a document upload are both "an age gate" in ordinary speech and are different measurements. Publish the mechanism breakdown or publish a rule, and expect a reviewer to ask which of the eight rows you included. |
| |
| <WRAP todo> | <WRAP todo> |
| * **The population is adult content.** A crawl of pornographic or nudification services fetches, caches and possibly redistributes material that may be illegal to hold in some jurisdictions your co-authors or your infrastructure are in, and that has real people in it who did not consent to being in your dataset. The one 2025 paper in this area handled it by deciding data-sharing case by case and consulting outside its own institution {[gibson2025_analyzing]}; the corpus contains no general guidance. | * **The population is adult content.** A crawl of pornographic or nudification services fetches, caches and possibly redistributes material that may be illegal to hold in some jurisdictions your co-authors or your infrastructure are in, and that has real people in it who did not consent to being in your dataset. Two papers in the corpus write down how they handled it and they are worth copying from: {[gibson2025_analyzing]} decided data-sharing case by case and consulted outside its own institution, and {[vallina2019_porn]} has an ethics section for a porn crawl — landing pages only, no interaction beyond the gate, illegal content reported. Neither is a general norm and none of the 38 candidates offers one. |
| * **Getting past the gate means submitting identity data — real or synthetic.** Clicking "I am 18" is one thing. Uploading a synthetic identity document to a live verification vendor is potentially a criminal offence in several of the jurisdictions now mandating these checks, and submitting a real researcher's document or face puts an identifiable person into a commercial vendor's pipeline for the duration of your study. One PoPETs 2025 study did the latter, in three countries {[mai2025_more]}. Nothing in the corpus establishes a norm for either, and the seven venues contain no guidance on it. | * **Getting past the gate means submitting identity data — real or synthetic.** Clicking "I am 18" is one thing. Uploading a synthetic identity document to a live verification vendor puts you in front of forgery and identity-document law, which does not obviously disapply for a research purpose; this page does not attempt a legal answer and you should get one before you build that pipeline. Submitting a real researcher's document or face instead puts an identifiable person into a commercial vendor's system for the duration of your study. One PoPETs 2025 study did the latter, in three countries {[mai2025_more]}. None of the 38 candidates states a norm for either. |
| * **Publishing a bypass is publishing a bypass.** The one paper whose subject is age verification is largely an account of how to defeat it, and disclosed to Google Play {[yao2025_easy]}. Note that Ofcom's guidance expects services not to //"host or permit content that directs or encourages users to attempt to circumvent an age assurance process"// — the same expectation a regulator has of a site is not automatically the right rule for a research paper, but you should decide which you are doing, in writing, before you publish a working circumvention. | * **Publishing a bypass is publishing a bypass.** The one paper whose subject is age verification is largely an account of how to defeat it, and disclosed to Google Play {[yao2025_easy]}. Note that Ofcom's guidance expects services not to //"host or permit content that directs or encourages users to attempt to circumvent an age assurance process"// — the same expectation a regulator has of a site is not automatically the right rule for a research paper, but you should decide which you are doing, in writing, before you publish a working circumvention. |
| * **Measuring children means not measuring children.** The cleanest example in the corpus injects images from public datasets into the app's camera and states //"while we analyze the age estimation of computer vision models, we do not collect any data on children"// {[west2024_picture]}. If your method needs a minor's face, your method is wrong; find the synthetic or public-dataset construction first. | * **Measuring children means not measuring children.** The cleanest example in the corpus feeds images from public datasets into the app's own model with Frida, never through a camera or a real account, and states //"while we analyze the age estimation of computer vision models, we do not collect any data on children"// {[west2024_picture]}. If your method needs a minor's face, your method is wrong; find the synthetic or public-dataset construction first. |
| </WRAP> | </WRAP> |
| |
| That second denominator is where the methodological interest is, and the corpus has four good constructions of it: | That second denominator is where the methodological interest is, and the corpus has four good constructions of it: |
| |
| * **The platform's own programme.** {[reyes2018_somebody]} analysed 5,855 Android apps enrolled in Google Play's Designed for Families programme — apps that had agreed to COPPA compliance as a condition of listing — and observed 235 of them (4.0%) actually reaching GPS coordinates, with 28% touching permission-protected sensitive data. The denominator is exact and checkable, and it is emphatically not "children's apps". | * **The platform's own programme.** {[reyes2018_somebody]} analysed 5,855 Android apps enrolled in Google Play's Designed for Families programme (no relation to this corpus's 5,855 full-text papers — a coincidence, and an unfortunate one) — apps that had agreed to COPPA compliance as a condition of listing — and observed 235 of them (4.0%) actually reaching GPS coordinates, with 28% touching permission-protected sensitive data. The denominator is exact and checkable, and it is emphatically not "children's apps". |
| * **A trained classifier over a general crawl.** {[moti2024_targeted]} fine-tuned a multilingual model on page ''%%<title>%%'' and ''%%<description>%%'' metadata, ran it over Common Crawl, and hand-verified 2,004 child-directed websites in 48 languages; crawling them from five vantage points, about 90% embedded at least one tracker and about 27% carried targeted advertising. | * **A trained classifier over a general crawl.** {[moti2024_targeted]} fine-tuned a multilingual model on page ''%%<title>%%'' and ''%%<description>%%'' metadata, ran it over Common Crawl, and hand-verified 2,004 child-directed websites in 48 languages; crawling them from five vantage points, about 90% embedded at least one tracker and about 27% carried targeted advertising. |
| * **Store metadata plus a rating scheme.** {[sun2023_seen]} and {[alomar2025_effect]} key on store categories, PEGI and Teacher Approved badges — cheap, and it inherits the label's error, which is the thing {[chen2013_this]} measured and found unreliable. | * **Store metadata plus a rating scheme.** {[sun2023_seen]} and {[alomar2025_effect]} key on store categories, PEGI and Teacher Approved badges — cheap, and it inherits the label's error, which is the thing {[chen2013_this]} measured and found unreliable. |
| * **The service's own age-tiered accounts.** {[figueira2024_diffaudit]} audits what an online service sends when the account is registered as a child versus an adolescent versus an adult — a differential design that needs no child-directedness classifier at all, because the service's own age tier is the treatment. | * **The service's own age-tiered accounts.** {[figueira2024_diffaudit]} audits what an online service sends when the account is registered as a child versus an adolescent versus an adult — a differential design that needs no child-directedness classifier at all, because the service's own age tier is the treatment. |
| |
| Also here: {[medjkoune2023_marketing]} on ad targeting that reaches children, and {[alomar2025_effect]} on what changed when the platforms tightened their policies. If you are writing about children's privacy rather than about age gates, start from those and from [[Design:Mobile and app measurement]], because two thirds of this literature is Android. | Also here: {[medjkoune2023_marketing]} on ad targeting that reaches children, and {[alomar2025_effect]} on what changed when the platforms tightened their policies. If you are writing about children's privacy rather than about age gates, start from those and from [[Design:Mobile and app measurement]]: **25 of the 36** COPPA papers carry the ''mobile'' platform tag and only **9** carry ''web'', so this is mostly an Android literature. |
| |
| ===== The regulatory surface, dated ===== | ===== The regulatory surface, dated ===== |
| | 29 Jul 2025 | Australia | The day of effect for the social-media minimum age was set by instrument, under the Online Safety Amendment (Social Media Minimum Age) Act 2024.((Federal Register of Legislation C2024A00127 (Act, made 10 December 2024) and F2025N00628 (day-of-effect instrument, made 29 July 2025). Queried through the register's API on 2026-09-15; the instrument's own text would not extract, so the calendar day of effect is not asserted here.)) | | | 29 Jul 2025 | Australia | The day of effect for the social-media minimum age was set by instrument, under the Online Safety Amendment (Social Media Minimum Age) Act 2024.((Federal Register of Legislation C2024A00127 (Act, made 10 December 2024) and F2025N00628 (day-of-effect instrument, made 29 July 2025). Queried through the register's API on 2026-09-15; the instrument's own text would not extract, so the calendar day of effect is not asserted here.)) | |
| | 10 Oct 2025 | EU | Blueprint v2 added passport and ID-card onboarding and support for the Digital Credentials API.((https://digital-strategy.ec.europa.eu/en/news/commission-releases-enhanced-second-version-age-verification-blueprint , published 10 October 2025, read 2026-09-15.)) | | | 10 Oct 2025 | EU | Blueprint v2 added passport and ID-card onboarding and support for the Digital Credentials API.((https://digital-strategy.ec.europa.eu/en/news/commission-releases-enhanced-second-version-age-verification-blueprint , published 10 October 2025, read 2026-09-15.)) | |
| | | 25 Mar 2026 | UK | Ofcom and the ICO published a joint statement on age assurance, aligning the Online Safety Act duty with data-protection law; it asks for methods that are //"risk-based, flexible, tech-neutral and future-proof"//.((//Age Assurance: A Joint Statement by Ofcom and the Information Commissioner's Office//, 25 March 2026, 14 pp. ofcom.org.uk 403s this sandbox but ico.org.uk does not: https://ico.org.uk/media2/5ybpmabf/ofcom-ico-joint-statement.pdf , fetched 2026-09-15.)) | |
| | 17 Mar 2026 | Brazil | Google Play began returning age signals to apps for Brazilian users under the Digital ECA.((https://developer.android.com/google/play/age-signals , read 2026-09-15.)) | | | 17 Mar 2026 | Brazil | Google Play began returning age signals to apps for Brazilian users under the Digital ECA.((https://developer.android.com/google/play/age-signals , read 2026-09-15.)) | |
| | 29 Apr 2026 | EU | The Commission adopted a recommendation urging Member States to make the app available by the end of 2026.((https://digital-strategy.ec.europa.eu/en/news/commission-urges-member-states-rollout-eu-age-verification-app , published 29 April 2026, read 2026-09-15.)) | | | 29 Apr 2026 | EU | The Commission adopted a recommendation urging Member States to make the app available by the end of 2026.((https://digital-strategy.ec.europa.eu/en/news/commission-urges-member-states-rollout-eu-age-verification-app , published 29 April 2026, read 2026-09-15.)) | |
| | 28 May 2026 | US (Texas) | Google Play age signals began for Texas accounts created after this date, under SB 2420.((Same Android developer page, read 2026-09-15.)) | | | 28 May 2026 | US (Texas) | Google Play age signals began for Texas accounts created after this date, under SB 2420.((Same Android developer page, read 2026-09-15.)) | |
| | 16 Jul 2026 | UK | Ofcom's first statutory report on the use of age assurance, with the deployment figures above. | | | 16 Jul 2026 | UK | Ofcom's first statutory report on the use of age assurance, with the deployment figures above. | |
| | | 17 Jul 2026 | UK | **The target moves from pornography to social media.** The government's fact sheet confirms a ban on certain social media for under-16s, with livestreaming and stranger contact switched off by default for 16- and 17-year-olds; regulations //"laid before the end of the year, and the changes should be implemented in Spring 2027"//.((//Fact sheet: New rules to protect children online//, DCMS and DSIT, updated 17 July 2026, https://www.gov.uk/government/publications/fact-sheet-new-rules-to-protect-children-online/fact-sheet-new-rules-to-protect-children-online , fetched 2026-09-15.)) | |
| | 11 Sep 2026 | Australia | An enforcement-strengthening amendment Act was made.((Federal Register of Legislation C2026A00083, made 11 September 2026; queried through the register's API on 2026-09-15.)) | | | 11 Sep 2026 | Australia | An enforcement-strengthening amendment Act was made.((Federal Register of Legislation C2026A00083, made 11 September 2026; queried through the register's API on 2026-09-15.)) | |
| |
| The measurement consequence of the whole table is one sentence: **since 2025, the same URL fetched from two countries is two different experiments**, and since March 2026 the same Android app on two devices may be as well. | The measurement consequence of the whole table is one sentence: **the same URL fetched from two countries is two different experiments** — which the 2019 paper already showed — and since 2025 the difference is something the law requires rather than something a site chose, while since March 2026 the same Android app on two devices may differ too. |
| | |
| | There is a second consequence for anyone choosing a population now. Every academic figure on this page, and Ofcom's own 2026 report, is about **pornography and adult-only apps**. The UK duty is due to extend to ordinary social media for under-16s in Spring 2027 — the fact sheet says the changes //"should be implemented in Spring 2027"//, not that they will be — and Ofcom has already recorded //"serious doubts"// about the age-inference systems those platforms currently use. A crawl designed today against adult sites will be measuring one half of the problem by the time it is published, and the page cannot tell you which half is larger because nobody has measured the other one. |
| |
| ===== What to report ===== | ===== What to report ===== |
| |
| - **The population, and why it is in scope of any age rule.** Not "the Tranco top 10k" — say what fraction of it plausibly hosts age-restricted content and how you decided. | - **The population, and why it is in scope of any age rule.** Not "the Tranco top 10k" — say what fraction of it plausibly hosts age-restricted content and how you decided. |
| - **Which of the eight mechanisms you counted**, and the rule that separates a gate from a cookie banner, a paywall and a login wall. All four are dismissable overlays. | - **Which of the eight mechanisms you counted**, and the rule that separates a gate from a cookie banner, a paywall and a login wall — all of which can present as a full-page overlay on the first load. Nobody has published such a rule; the features to build one from are a date-of-birth or age input, the tokens //18// and //21// near a confirm control, the eight-language keyword set {[vallina2019_porn]} widened to your own sample, a third-party verification origin, and a first-party cookie written at the moment the overlay is dismissed. A cookie banner names a purpose and a paywall names a price; a gate names an age. |
| - **Your vantage points**, plural, and the verification that each one presented as the country you intended — [[Design:Crawling location]] has the methods. | - **Your vantage points**, plural, and the verification that each one presented as the country you intended — [[Design:Crawling location]] has the methods. |
| - **Statefulness.** Whether the crawler carried the gate's own cookie between loads, and what it did to your counts. | - **Statefulness.** Whether the crawler carried the gate's own cookie between loads, and what it did to your counts. |
| ===== Methodology and limitations of these figures ===== | ===== Methodology and limitations of these figures ===== |
| |
| Every corpus figure on this page comes from ''scripts/report_age_assurance.mjs'', which prints the probe, the hand verdict for all 38 candidates, and a verbatim-quote check of every per-paper number against the source PDFs. The script, its unedited output, the full verdict map, the discarded probe variants and the external sources that were rejected are on **[[provenance:privacy:age_assurance]]**. Corpus-level caveats — venue scope, the selection funnel, the provisional 2025–2026 years, extraction stability — are on [[Literature:Corpus]]. | Every corpus figure on this page comes from ''scripts/report_age_assurance.mjs'', which prints the probe, the hand verdict for all 38 candidates, and a verbatim-quote check of **25 anchor sentences** against the source PDFs. A second script, ''scripts/aa_quotespans.mjs'', pulls every quoted span out of this page's own source and checks each one. Neither reads the prose around a number. **Every figure stated in the page's own words rather than inside quotation marks is hand-checked, not guarded** — that is most of the paraphrased denominators, Ofcom's 25%-to-43% and 64-of-100, the artefact file sizes and dates, and the survey bases. An earlier draft tried to enumerate them and the list was incomplete twice; the class is the honest statement. The script, its unedited output, the full verdict map, the discarded probe variants and the external sources that were rejected are on **[[provenance:privacy:age_assurance]]**. Corpus-level caveats — venue scope, the selection funnel, the provisional 2025–2026 years, extraction stability — are on [[Literature:Corpus]]. |
| |
| Five limitations belong on the page itself: | Five limitations belong on the page itself: |
| |
| - **Five papers is not a literature.** Every corpus number in the //What has actually been measured// section is a single study's result about a single population, and none of them has been replicated. Treat them as existence proofs and as related work, not as base rates. The 2019 web figure in particular is at most fifty sites checked by hand. | - **Five papers is not a literature.** Every corpus number in the //What has actually been measured// section is a single study's result about a single population, and none of them has been replicated. Treat them as existence proofs and as related work, not as base rates. |
| - **The regulator's figures are self-reported under compulsion, not measured.** Ofcom's 69 million, 25%→43% and 64-of-100 come from information notices to 32 services plus Ofcom's own children's-experience survey, not from a crawl. They are the best deployment numbers that exist and they are not independently checkable; the report says so about circumvention itself. | - **The regulator's figures are self-reported under compulsion, not measured.** Ofcom's 69 million, 25%→43% and 64-of-100 come from information notices to 32 services plus Ofcom's own children's-experience survey, not from a crawl. They are the best deployment numbers that exist and they are not independently checkable; the report says so about circumvention itself. |
| - **The candidate set is a phrase probe, so it under-recalls by construction.** A paper that measured age gates without ever using any of the five phrases is invisible to it. Widening the probe to mechanism words — //date of birth//, //identity verification//, //facial age//, //parental gate// — added no new measurement papers, but that is a bounded negative, not a proof. | - **The candidate set is a phrase probe, so it under-recalls by construction.** A paper that measured age gates without ever using one of those fourteen phrases is invisible to it. Widening the probe to mechanism words — //date of birth//, //identity verification//, //facial age//, //parental gate// — added no new measurement papers, but that is a bounded negative, not a proof. |
| - **The corpus is seven venues.** CCS, IMC, NDSS, PoPETs, USENIX Security, TheWebConf and IEEE S&P, 2010–2026. Age assurance is published heavily at CHI, SOUPS, ACM FAccT and in law reviews, and none of those is in the corpus. The **absence measured here is an absence from the security and measurement venues**, which is the claim worth making and the only one supported. It is not an absence of knowledge about deployment — see the regulator's report. | - **The corpus is seven venues.** CCS, IMC, NDSS, PoPETs, USENIX Security, TheWebConf and IEEE S&P, 2010–2026. The usability, policy and legal literature on age assurance sits largely outside these venues — CHI, SOUPS, FAccT and law reviews are not in the corpus, and this page cannot speak to them. The **absence measured here is an absence from the security and measurement venues**, which is the claim worth making and the only one supported. It is not an absence of knowledge about deployment — see the regulator's report. |
| - **The regulatory table is not a legal analysis** and is not exhaustive. It names, for each row, one primary source read on 2026-09-15. | - **The regulatory table is not a legal analysis** and is not exhaustive. It names, for each row, one primary source read on 2026-09-15. |
| - **One candidate was judged from its title and summary only**, because its full text is not in the mount; it is named on the provenance page. | |
| |
| ===== Read first ===== | ===== Read first ===== |
| |
| - Ofcom's //Report on the use of age assurance// (16 July 2026) — read this **before** the papers. 92 pages, the only large deployment measurement that exists, and the clearest statement of what a crawl would have to reproduce. | - Ofcom's //Report on the use of age assurance// (16 July 2026) — read this **before** the papers. 92 pages, and the largest deployment measurement this page could find anywhere; it is also the clearest statement of what a crawl would have to reproduce. |
| - {[yao2025_easy]} — the only paper whose research question is age assurance. Read §2.2 for the mechanism taxonomy and §7 for the bypasses. | - {[yao2025_easy]} — the only paper whose research question is age assurance. Read §2.2, //Age Verification in Adult-Oriented Apps//, whose Table 2 is the mechanism taxonomy, and §6, //Attacking Apps with Age Verification//, for the bypasses. |
| - {[vallina2019_porn]} — §7.2 is the web case, the multi-vantage design, and the honest assessment of what the detector could and could not see. | - {[vallina2019_porn]} — §7.2 is the web case, the multi-vantage design, and the honest assessment of what the detector could and could not see. |
| - {[west2024_picture]} — the only measurement of whether a deployed mechanism works (in one of its two case studies), and a clean template for the ethics of measuring an age model without measuring children. | - {[west2024_picture]} — the only measurement of whether a deployed mechanism works (in one of its two case studies), and a clean template for the ethics of measuring an age model without measuring children. |
| - {[alomar2022_developers]} — read it for the self-report-versus-observation gap, which will bite any survey design here. | - {[alomar2022_developers]} — read it for the self-report-versus-observation gap, which will bite any survey design here. |
| - {[reyes2018_somebody]} — the reference construction for a children's-privacy denominator, and the paper most of the 11 title-probe candidates turned out to be about. | - {[reyes2018_somebody]} — the reference construction for a children's-privacy denominator, and the kind of paper several of the age-assurance title probe's candidates turned out to be. |
| |
| <bibtex bibliography></bibtex> | <bibtex bibliography></bibtex> |
