--- title: "Age Assurance: prove age without an ID" description: "Age estimation from two seconds of voice, on the user's device. No ID upload, no PII, nothing sent to a server. One integration for every major age verification law." source: "/age-assurance" updated: "2026-11-02" --- Age Assurance # Prove age without ever asking for an ID ISO/IEC 27566-1 and NY SAFE for Kids compliant age estimation from voice in about 4 seconds. No ID upload, no PII, nothing sent to a server. Meet every major age verification law with one installation. The problem ## ID uploads are beatable and a privacy liability either way. More laws now require age verification. The default check, an ID upload, adds too much friction. Faking an ID has never been cheaper, and every upload you store is a privacy liability. Beatable — and a liability ### A working fake ID costs $15 In 2024 reporters bought a synthetic ID for $15 and cleared a crypto exchange's onboarding with it. Its seller pleaded guilty in February 2026 to selling around 10,000 of them. Digital document forgeries rose 244% year on year. Friction ### More than half of people have quit a sign-up over an ID check 53% of people have abandoned a sign-up because the ID check made them uncomfortable (FullCircl, 2024). Promising to delete it changes little. Whatever you do collect is the most sensitive data you'll ever hold. Regulation ### The law is here Twenty-six US states gate adult content today. The UK, EU and Australia are enforcing. The question is no longer whether you check — it is what you make people hand over to do it. Regulatory overview ## Three tiers of law. One integration. Age assurance is regulated in three places at once — US federal privacy rules, a fast-moving patchwork of state statutes, and the UK, EU and Australian online-safety regimes. Almost none of them names a method. That gap is the case for a check that needs no ID. ### US federal #### COPPA, as amended In force. Full compliance since 22 April 2026. Under-13 data needs verifiable parental consent. You need a written retention policy with real deletion timelines — indefinite retention is now prohibited outright. The amended rule counts biometric identifiers as personal information, and it names voiceprints and faceprints specifically. For your team: an age check that stores a voiceprint or a selfie hands you a data-protection problem on top of your age problem. A check that keeps nothing does not. #### The FTC's age-verification policy statement 25 February 2026. Enforcement discretion — not a safe harbour. The FTC says it will not bring a COPPA action against an operator that collects data for the sole purpose of determining age without first getting parental consent. Six conditions attach: use the data only for age, delete it promptly, disclose only to vetted recipients under written assurance, give clear notice, keep it secure, and use a method that is reasonably accurate. It is discretion, not immunity. It lasts only until the Commission finishes its rulemaking on age verification. For your team: "reasonably accurate" and "delete promptly" are the two things you will have to prove. Publish measured accuracy. Keep nothing to delete. #### The federal bills None of them is law. The Kids Online Safety Act has never passed. It cleared the Senate in July 2024, died in the House, and was reintroduced in 2025. The House passed a kids-safety package in June 2026 and the Senate has not finished with it. The federal app-store bills are still bills. For your team: nothing federal compels an age gate today. Plan against state law and the FTC's conditions, and treat the federal layer as rules about the data rather than the check. No federal rule prescribes a method. The FTC asks only that yours be reasonably accurate — and that you can show it. ### US state #### Adult content 26 states. In force. Reasonable age verification before access to material harmful to minors. Most statutes accept a government ID or commercially reasonable transactional data, and stop there. The Supreme Court settled the constitutional question in Free Speech Coalition v. Paxton on 27 June 2025, upholding Texas's law under intermediate scrutiny. It reached material obscene to minors — not age gating for the internet at large. For your team: if you host adult material the gate is not optional and the constitutional defence is gone. Counts differ by a state or two between trackers, depending on whether they count enacted or in force. #### Social media Around 21 states. Many enjoined. Parental consent, curfews, feed limits, age verification — the mix varies by state, and so does whether the law is alive. Connecticut is fully enforceable. Florida, Mississippi, Ohio and Tennessee are on appeal with no live injunction. Texas, California and Nebraska are partly enjoined. Arkansas, Colorado, Georgia, Louisiana, Utah and Virginia are blocked pending appeal. For your team: the map moves every quarter. Build one check you can switch on per state, not a bespoke flow per statute. #### App stores Five states. Texas live, four more in 2027. App stores now have to check ages and pass that signal to your app. Texas is live. Utah, Louisiana, Alabama, and California follow in 2027. For your team: a store’s age signal is often just a birthday someone typed in. For anything that matters, you still need your own check. #### New York — SAFE for Kids Act Rules adopted 28 July 2026. Effective 25 January 2027. The rules will require at least one age-assurance method that does not need a government ID, an appeal route that accepts something other than a government ID, and annual certification of every method you offer. Certification has to hit numbers. Maximum false positives by age, and a floor on catching people who game the check: - **0.1%** ages 0–7 - **1%** ages 8–13 - **2%** ages 14–15 - **8%** age 16 - **15%** age 17 - **98%** circumvention detected New York will require a method that works without a government ID. No other state names a method at all. ### International #### United Kingdom Online Safety Act 2023. Ofcom enforcing. Highly effective age assurance is required on pornography, and on services carrying content harmful to children. Ofcom sets four criteria: technically accurate, robust, reliable and fair. Enforcement is real. Ofcom has reported 23 investigations covering 88 adult services, fines issued, and more than 69 million age checks completed in the second half of 2025. Ofcom certifies no providers. The duty to assess a method sits with the service deploying it — and Ofcom has said publicly that it has serious doubts about some age-inference models. For your team: there is no badge to buy. You pick a method and defend it with measurements, which is why we publish per-threshold error rates instead of a logo. #### European Union DSA Article 28. Commission guidelines, 14 July 2025. Platforms accessible to minors must take appropriate and proportionate measures for their privacy, safety and security. The guidelines ask for age assurance that is accurate, reliable, robust, non-intrusive and non-discriminatory. They are not binding. The Commission uses them to judge you anyway, and points to the EU age-verification app and the digital identity wallets as reference examples. For your team: proportionality is the test. Two seconds of speech that never leaves the handset is close to the least intrusive check available — which is the argument Article 28 actually rewards. #### Australia Online Safety Act, Part 4A. In force 10 December 2025. Age-restricted platforms must take reasonable steps to stop under-16s holding accounts. The eSafety Commissioner enforces it. The privacy regulator has added that steps are not reasonable unless you meet your privacy obligations too — so a heavy-handed ID sweep can fail the test it was meant to pass. For your team: Australia is the cleanest case for a non-ID method. You are required to check hard and to collect little, at the same time. #### France SREN law and Arcom's technical standard. The strictest and the most specific. Checks run per session rather than once at sign-up, and at least one option must meet double anonymity: the site never learns who the user is, and the verifier never learns which site they were visiting. For your team: double anonymity is an architecture requirement, not a vendor feature. An on-device estimate satisfies it by construction — there is no verifier to tell. #### Germany JMStV. Operating-system duties since 1 December 2025. Germany pushed youth protection down into the operating system: safe search on by default, age-gated app installation, parental blocking, adjustable age settings. Its closed-user-group rules for adult content still expect verification tied to a real identity. Germany is the one market where a non-ID estimate is a first filter rather than the whole answer. For your team: plan a fallback for Germany. We would rather tell you that than pretend one method clears every regime. #### Ireland Online Safety Code. In force since July 2025. Age assurance is required for pornography and gratuitous violence on video-sharing platforms, and self-declaration alone is treated as ineffective. Ireland is holding for an EU-wide digital age of majority rather than legislating its own, and is building a national wallet on the EU identity framework. For your team: the floor today is better than a checkbox, and it will rise toward the EU standard rather than away from it. Not one of these regimes names a product. Every one of them asks you to prove the method works. ## One call. Every jurisdiction. We translate each statute into a policy profile. The SDK adapts the threshold, what evidence is retained and how an appeal is routed, and writes the audit trail as it goes. Helix is designed against the four criteria set by Ofcom, the regulator that enforces the UK's Online Safety Act, and against New York's accuracy floors. Neither regulator certifies providers, so we hand you the measurements to make that assessment yourself. Current as of August 2026. This is an engineering summary, not legal advice. Statutes and injunctions move monthly. How it works ## Two seconds of speech. We estimate age from two seconds of speech, entirely on the user's device. There's no document to upload, no selfie to take and no server round trip. No biometric data leaves the handset, so there's no central database for an attacker to breach. That's also what lets one integration answer every regime above. ### Capture Two seconds of speech User reads a short prompt aloud. Features (formants, pitch, vocal-tract resonance) are extracted locally. Raw audio is discarded immediately. ### Estimate On-device age inference A model that runs entirely on the user's device estimates age from the extracted features — entirely client-side, no server round-trip. ### Prove Signed verdict, nothing stored Returns a signed pass/fail proof for the session. No biometric vector retained, no recording uploaded. Full audit trail for compliance. Integration ## Shipped in two lines of code. Ship compliant age gating in under 5 minutes. Install the SDK, call verify with a jurisdiction, and read the proof. Voice capture, feature extraction, and on-device inference are automatic — you get a single pass/fail. [Get the SDK](https://docs.helix.id/browser-sdk) Your server signs each start with @helix-id/node. `age-sdk.js` Drop the tag on any page ```js ``` Check age at the gate ```js Helix.open({ startUrl: "/helix/age", onSuccess: allowEntry }); ``` ## Ship compliant age gating without dropping users. We'll stand up a pilot in your lowest-friction surface and measure drop-off against your current ID-upload flow. You'll lose nothing. We'll prove it. The Helix stack ## Also available within a single integration. Three products, one SDK. Add Biometric Authentication and Synthetic Detection on the same integration you already use for Age Assurance. Biometric Authentication ### [Confirm the human](https://helix.id/biometric-authentication) A 4-second voice check that verifies a real person on-device. No PII stored, no SMS, no authenticator app. Synthetic Detection ### [Stop bots](https://helix.id/synthetic-detection) A voice check that tells real people from AI. Catches 99.6% of AI-generated voices from the newest voice engines.