EU Digital Services Act and age assurance

What Article 28 says

Article 28(1) requires providers of online platforms accessible to minors to put in place appropriate and proportionate measures for a high level of privacy, safety and security of minors on their service. Article 28(2) bans advertising based on profiling when the platform is aware with reasonable certainty that the user is a minor. Nothing in the article requires verifying the age of every user.

For age checks, paragraph 3 is the one to read closely: complying does not oblige a platform to process additional personal data to work out whether a user is a minor. Paragraph 4 lets the Commission issue guidelines on applying paragraph 1, and it did.

Article 19 exempts micro and small enterprises from the section Article 28 belongs to, unless the Commission has designated their platform a very large online platform (guidelines paragraph 8). That exemption is the DSA's alone: footnote 9 of the guidelines recalls that the Audiovisual Media Services Directive requires every video sharing platform, whatever its size, to run age verification for content that may impair minors' development.

The guidelines' legal weight

The Commission published its guidelines in the Official Journal on 10 October 2025 as C/2025/5519. Paragraph 12 calls them a significant and meaningful benchmark for how the Commission will apply Article 28(1), while warning that following them in part or in full does not automatically mean compliance. National Digital Services Coordinators may draw on them as well. A review is due when needed and at the latest after 12 months (paragraph 92), so check for a newer version before relying on any detail here.

When verification is the proportionate answer

Paragraph 37 points to age verification in four situations. The first is a product or service posing a high risk that less restrictive measures cannot mitigate, such as pornography, gambling or the sale of alcohol, tobacco, nicotine products or drugs. The other three are terms that require users to be 18 or older because of identified risks to minors; other identified risks that verification mitigates better than anything less intrusive; and a minimum age set by law.

Below 18 or for medium risks, paragraph 47 accepts age estimation when an independent third party provides it or the system is independently audited. Where no verification method meeting the criteria is readily available yet, paragraph 38 lets estimation stand in for verification, for a period that should not run beyond the first review of the guidelines. A tickbox asking users to confirm their age does not count: the Commission does not consider self declaration appropriate, because it falls short on robustness and accuracy (paragraph 52).

The EU age verification app

The Commission released the EU age verification app as a blueprint on 14 July 2025, built on the same technical specifications as the EU Digital Identity Wallet, with Denmark, France, Greece, Italy and Spain the first member states to take it up. The guidelines call it the EU age verification solution and say that, once finalised, it will provide a compliance example and a reference standard (paragraphs 43 to 45). Other verification methods may be used if they are compatible with that standard and meet the guidelines' criteria.

Its proof says only that the person is 18 or older, and paragraph 44 describes the method as privacy preserving, data minimising, not traceable and interoperable.

Checking age without storing an ID

The guidelines give no recipe, but these steps follow from them, each with the paragraph behind it.

1. Assess, then publish what you found

   Before restricting access by age, work out whether a restriction is appropriate and proportionate for your service or whether less far reaching measures would do (paragraph 31). Paragraph 32 asks you to publish the result whichever way it goes.

2. Judge the method on five criteria

   Accuracy, reliability, robustness, non intrusiveness and non discrimination are the tests in paragraph 49. A method that minors can get around easily fails them (paragraph 51).

3. Ask for the age threshold and nothing else

   Paragraph 49(d), following the European Data Protection Board and Article 28(3), says you should process only the age attributes strictly necessary for the purpose. Paragraph 39 adds that verification should not entitle you to store personal data beyond the user's age group.

4. Keep the check apart

   Treat age verification as its own process, unconnected to the rest of your data collection, as paragraph 39 puts it. Paragraph 49(d) goes further: the data used to ascertain age cannot be stored or used for other purposes.

5. Prefer double blind tokens

   The guidelines favour anonymised age tokens issued by an independent third party on the basis of government issued identity (paragraph 41). Under paragraph 46 a double blind method tells the platform only whether the threshold is met, while the proof provider never learns which service asked.

6. Offer a choice and a way to complain

   Offer more than one method that meets the criteria, so eligible users are not shut out. Paragraph 48 also asks for a redress route for anyone who thinks their age was assessed wrongly.

7. Stay responsible for any provider you use

   Using a third party does not move the responsibility. Under paragraph 53 the platform still answers for whether the method works and has to explain its use to minors in language they understand.

• Start an age check from code: the developer docs
• Every operation, in the API reference
• Or ask your agent, through the MCP server
• What a Tessio check record holds