Age assurance tech trial highlights providers for verification, estimation

Australia’s Age Assurance Technology Trial has published its final report, and while the organizers have been careful to frame the results as an examination of what’s possible rather than a recommendation on specific age assurance technologies, there are still some evident winners.

The report assesses firms based on the type of age assurance they provide. Age verification and age estimation are the two main biometric methods for checking age – the former somewhat more established than the latter. A few firms overlap in offering both.

Age verification vendors display ‘strong commitment’ to privacy

For age verification, 29 providers participated. Of those, 21 are assessed to be at Technology Readiness Level 8 or 9. These include collectives like Australian Payments Plus, the government agency Austroads, and many familiar providers: VerifyMy, AgeChecked, IDVerse, GBG, iProov, Yoti, Persona, Trust Stamp, Luciditi and Private ID, to name a few. DigiChek and ConnectID (from Australian Payments Plus) get nods for the consistency of their privacy practices as measured against their policies. Yoti is named as “one of the most privacy-forward platforms” in the trial.

(Notably, among those not included in the top tier is Google – although there were assumptions early on that it wouldn’t be a factor.)

“The evaluation found that independent age verification service providers demonstrated a strong and consistent commitment to privacy by design, data minimization and secure data handling.

These practices were embedded both at the technical architecture level and in the providers’ internal policies, aligning closely with the principles and requirements outlined in ISO/IEC FDIS 27566-1, the emerging international standard for age assurance systems.”

It’s not all roses, however. The report acknowledges that “ensuring equitable access to age verification services requires specific attention to the persistent digital identity and infrastructure gaps experienced by many First Nations communities in Australia.” And there is room to improve – or, rather, “scope for technological improvement and enhancing the management of risk in age verification systems particularly relating to access to reliable data.”

“Effective age verification depends not only on technical processing but also on the authenticity, accuracy and timeliness of the data used to verify a person’s date of birth.”

One request is for “explicit regulatory or statutory guidance” on certain issues, such as data retention, prohibited practices and “the lawful conditions under which law enforcement or coronial authorities may request access.”

Pace of technological change powering better age estimation

The age estimation trial assessed 13 participant companies. Among those, TRL 9 performers include Yoti (“fully deployed, real-world tested”), Unissey (“Fully integrated and tested across devices; ready for deployment”), Privately (“Fully on device system, tested and certified; no data transmission”), VerifyMy (“certified, flexible architecture with real deployments”) and Luciditi (“commercial deployments confirmed; well-integrated fallback methods”).

Among firms assessed at TLR 8 are Persona, which provides facial age estimation for Reddit, and Needemand, the startup offering age estimation based on hand gestures. However, deployments are a factor in assessing TLR, and both of these firms have signed clients in the wake of the UK Online Safety Act coming into effect.

Furthermore, since age estimation tech relies heavily on machine learning models trained on masses of data, the rapid development of algorithmic technology means tools are improving at a similar pace. Training data is getting better and more diverse, leading to better, fairer functionality across age, gender and ethnicity. Neural networks are getting smaller and faster.

“Providers also demonstrated that they were regularly improving their models by using feedback and updated versions to improve accuracy and reduce errors – particularly at critical policy thresholds (e.g. age 13 or 18).”

Report underlines importance of buffer thresholds for age estimation

A frequent criticism lobbed at age estimation is that, since it often estimates a range, it risks excluding legitimate users. For instance, if an age estimation tool can guess that a user is between 13 and 17, that doesn’t help in the case of a restriction to users who are 16 or older. A commentary in The Conversation says that means “people as young as 13 or 14 could be estimated to be 16 years of age, and gain access to platforms when they should be blocked. And some 16- and 17-year-olds could be marked under age and restricted.”

The report does not shy away from age estimation’s current shortcomings, acknowledging that buffer thresholds are important in light of the “inherent uncertainty in age estimation” – which, after all, is an estimate.

“Around 2-3 years on either side of the age gate lies a ‘grey zone’ where system uncertainty is higher,” the report says. However, while models “tend to be most uncertain at or near the threshold (e.g. distinguishing between a 17.8-year-old and an 18.2-year old),” accuracy improves as you move away from it. As such, “the likelihood of a false decision tends to zero outside a reasonable buffer.”

Which is to say, if you want to ensure users are 18, the buffer threshold should probably be set at 21.

The trial likewise acknowledges the existing problem with the 13+ age threshold. “For the 13+ gate, systems consistently underperformed at the nominal ages of 13, 14 and 15. False rejection rates (FNR) at these ages ranged from 22 percent (age 13) to 6 percent (age 15), meaning a significant number of eligible users were blocked.”

“Across all systems at the 13+ age gate, the aggregate TPR exceeded 95 percent only for users aged 16 and above. This implies that to meet a 95 percent accuracy threshold for certification, relying parties would need to set a conservative buffer, granting access only when the system estimates the user to be at least 16.

Finally, the report recognizes that “demographic performance disparities were still observed – particularly increased false positives for users with darker skin tones or aged 16-20, variability in model output by gender presentation or lighting conditions, and limited use of fairness benchmarks or mitigation strategies.”

Report provides basis for next phase of age check discussion, development

The overriding message for both technologies is that they can be done. However, for now, the takeaway should factor in risk levels. For high-risk use cases, age verification is the better tool. Meanwhile, age estimation can be effective in cases where the stakes are lower – and, while it’s imperfect, the core technology that powers it is getting stronger and more accurate by the day.

The AATT has generated a large amount of information and data on age assurance tech. In many respects, it can be seen as a launching pad for further discussion, feedback and refinement of age estimation tech, in particular. In the meantime, top providers have further established themselves as viable options in a growing market.

Article Topics

Age Assurance Technology Trial  |  age verification  |  AgeChecked  |  Australia age verification  |  biometric age estimation  |  GBG  |  IDVerse  |  iProov  |  Luciditi  |  Needemand  |  Persona  |  Private Identity  |  Privately  |  Trust Stamp  |  VerifyMy  |  Yoti