A screen appears before the camera does: "Confirm that you are 18 or older." Three options. Upload an ID document. Let yourself be filmed for three seconds for an age estimate. Go through a third-party provider using a bank account or a mobile operator. The adult picks one, clicks, and gets into the service. Then nothing — no information at all about what became of the file they sent.
This is the blind spot in the age verification debate. There is plenty of discussion about the obligation itself: who imposes it, on which sites, with what penalties. An article published on this blog set out the legal framework for 2026: what Arcom, London, the EU and Moscow require. But the question adults actually ask themselves — in French as much as in Russian — comes afterwards: where do my documents go, how long do they stay there, and who holds them?
The four families of checks, and what they collect
Not all methods are equivalent, and the difference lies not in their advertised "security" but in the amount of information they put into circulation.
1. Uploading an identity document
The most widespread, and the most talkative. You photograph an ID card, a passport or a driving licence. The document contains your date of birth — the useful piece of information — but also your full name, your place of birth, your photo, a document number, sometimes an address, and a machine-readable MRZ strip.
In other words: to prove a single binary fact (adult / minor), you hand over some fifteen identifying attributes. This is exactly what the GDPR calls a failure of data minimisation (Article 5(1)(c)), and it is why Arcom and the CNIL advise against this method whenever an alternative exists.
2. Facial age estimation
A short video capture or a photo is analysed by a model that estimates an apparent age, without trying to identify you. Serious systems state a margin of error and apply a "buffer margin": to make sure no one under 18 gets through, they require an estimated age of 23 or 25.
Work by the American NIST on age estimation (the Face Analysis Technology Evaluation programme, age strand) shows average deviations in the region of two to three years depending on the algorithm, with uneven performance across age groups and shooting conditions. The practical consequence: an adult of 19 or 20 may be refused, and will have to switch to another method.
The crucial point to check: is the image processed on your device or sent to a server? And is it deleted immediately after the calculation? The most rigorous providers document deletion within a few seconds, with no biometric template created.
3. The trusted third party and "double anonymity"
This is the architecture Arcom has written into its technical reference framework. The principle: split the knowledge.
- An age proof provider (bank, mobile operator, digital identity provider) knows who you are, but has no idea which site you want to visit.
- The 18+ site receives a cryptographic token saying "this person is an adult", but has no idea who you are.
Neither party holds the complete picture. The token is single-use or very short-lived, and must not make it possible to link several visits together. Arcom's reference framework, published in October 2024 and applied since January 2025, describes this model as the target for any pornographic service accessible from France; the SREN law (May 2024) gave it the power to issue formal notices and to order blocking.
4. Weak signals: bank card, existing account, SMS
Often presented as verification, these are really just clues. A bank card is not reserved for adults in France (minors can have withdrawal and payment cards). A mobile number proves nothing about its holder's age. These methods are legally weak, but they have a very real side effect: they tie your browsing to a means of payment, which is anything but anonymous.
A simple rule: the more convenient a method is for the platform, the more expensive it generally is for your privacy. The exception is double anonymity, which is both protective and painful to deploy — which explains how slowly it is being adopted.
How long is the data kept?
There is no single retention period. Three regimes overlap.
| Type of data | Expected practice | Legal basis / reference |
|---|---|---|
| Photo of identity document | Deletion after the check, ideally within minutes | Minimisation + storage limitation, GDPR art. 5 |
| Facial image for estimation | Immediate deletion, no template stored | Arcom 2024 reference framework; CNIL doctrine on biometrics |
| Age proof token | Short-lived, single use | Arcom reference framework (double anonymity) |
| Record proving the check took place | Technical data with no identity (timestamp, method) | Obligation to demonstrate compliance |
| Connection logs (IP, timestamp) | Variable, often 12 months | National electronic communications law |
The nuance many readers miss: a platform may legitimately keep the record that a check was carried out without keeping the identity document. Those are two different things. If a privacy policy blends the two into the same vague sentence, that is a red flag — just like the criteria listed in our method for spotting a serious 18+ chatroulette.
Reading a privacy policy in seven minutes
You don't need to be a lawyer. Look for seven things, in this order, using your browser's find-in-page function (Ctrl+F).
- The word "age" or "verification". If it appears nowhere even though the site displays a check, the policy has not been updated: bad sign.
- The name of the processor. A verification provider must be named (Yoti, Veriff, VerifyMy, AgeChecked, Persona… or a local player). "A trusted partner" is not a name.
- A figure for the retention period. "As long as necessary" means nothing. Look for days, months, minutes.
- Where the servers are located and whether transfers outside the EU are mentioned. If there is a transfer, a mechanism must be cited (standard contractual clauses, adequacy decision).
- The legal basis. For a legal obligation to check age, it is generally Article 6(1)(c) of the GDPR (legal obligation), not consent.
- A DPO contact, i.e. a data protection officer, with an address that is not a generic inbox.
- The deletion procedure. A form, a dedicated email address, a stated response time.
For this kind of reading, many people print things out or annotate them: a fine-tip highlighter is more than enough if you keep a paper copy of your steps, and it saves you from re-reading everything each time.
Your rights, in practice
In France and across the European Union, the GDPR gives you levers you can pull directly, even with an 18+ service.
- Right of access (art. 15): ask for the list of data held and where it came from. The controller has one month to reply, extendable to three months for complex requests.
- Right to erasure (art. 17): demand deletion. Careful, it is not absolute: if a legal obligation requires keeping proof of the check, that proof may survive — but there is no reason whatsoever for your identity document to stay.
- Right to restriction (art. 18): useful while a dispute is ongoing.
- Complaint to the CNIL: free, online, no lawyer needed. The CNIL can question the publisher on your behalf, including one established outside France if the service targets French users.
Within the EU, the DSA (applicable since February 2024) additionally requires an identifiable single point of contact, which makes the absence of anyone to talk to hard to defend. In the United Kingdom, the Online Safety Act gives Ofcom oversight of the "highly effective age assurance" that came into force in July 2025, while the ICO oversees the data side.
And in Russia, Kazakhstan, Belarus?
The reasoning changes in nature. Russian federal law 152-FZ on personal data has, since 2015, required the data of Russian citizens to be stored on servers located in Russia, and Roskomnadzor maintains both the register of data operators and the register of blocked resources. Identification via the unified state account is encouraged, if not required, on a growing number of services.
The practical consequence for a Russian-speaking adult is twofold: on one hand, an age check via a national identifier is technically robust; on the other, it links an 18+ visit to an administrative identity, which is precisely what European double anonymity is trying to avoid. Add the restrictions on calls and the rules governing circumvention tools — a topic we covered factually in our article on throttled messaging apps and VPN rules — and it becomes clear why the same obligation produces very different effects from one country to another.
There is no equivalent of the CNIL to turn to in these jurisdictions for a foreign service. The trade-off therefore has to be made upfront: pick a less talkative method, or walk away.
Reducing your exposure without cheating
None of these precautions is about getting around a check. They are about limiting its collateral effects.
Prefer, where the choice exists, local estimation or a token. Between "send us your passport" and "three seconds of camera processed on the device", the second option puts vastly less information into circulation.
Never send a raw document by email or messaging app. An identity document that travels through a conversation stays in the history of two devices and one server. If you need to archive your own copies, an encrypted external hard drive is a more sensible medium than a "Downloads" folder.
Mask what is not being asked for. For an age check, only the date of birth and the validity of the document matter. Many providers accept a partially redacted image. If you are preparing a scan, use your system's annotation tools to black out — genuinely black out, not lay down a semi-transparent rectangle — the document number and place of birth.
Keep uses separate. A dedicated email address, unconnected to your work or family accounts, limits cross-referencing. A password manager helps you maintain several distinct login identities without writing them down on paper.
Take care of the hardware layer. A webcam with a physical cover, or failing that an adhesive webcam cover, settles in one gesture the question of the camera left open after facial estimation. It is trivial, and it is the most reliable measure there is.
Check the address before uploading. Verification pages are imitated on a massive scale. A fake age check screen is a simple way to obtain a complete identity document. Read the domain name, not the logo.
What will probably change by 2027
Three trends are taking shape.
The European identity wallet (EUDI Wallet). The eIDAS 2 regulation, which came into force in May 2024, provides for every member state to offer a digital identity wallet with a selective disclosure function: proving "adult" without revealing the exact date or the name. The timetable aimed for availability from the states around the end of 2026, with actual rollout spread out afterwards. This is the tool that would make passport uploads obsolete.
Standardisation of age proof tokens. The more formats converge, the less excuse sites have to collect documents themselves.
Growing pressure on intermediaries. App stores, operating systems and browsers are increasingly designated as the "natural" place for the check, which would shift collection towards players who already hold your identity — with a benefit for the user that is far from obvious.
Key takeaways
Age verification is not a box to tick: it is a data transfer, and its scale depends entirely on the method chosen. Between a facial estimate processed locally and a passport uploaded to an undocumented server, the gap in risk is considerable, for an identical result in compliance terms.
Before validating a verification screen, three reflexes are enough: identify the provider, find a retention period expressed as a figure, and check that someone exists to handle a deletion request. If any one of the three is missing, the question is no longer your age but the publisher's seriousness — and at that point, better to close the tab. As for the rest, the rules between consenting adults depend on no automatic check at all: they are a matter of consent, screenshots and recordings, a field where no algorithm will decide for you.
Sources cited: Arcom (technical reference framework for age verification, October 2024), SREN law of 21 May 2024, GDPR (EU Regulation 2016/679), DSA Regulation (EU 2022/2065), eIDAS 2 Regulation (EU 2024/1183), CNIL, Ofcom and ICO (United Kingdom), NIST Face Analysis Technology Evaluation, Russian federal law 152-FZ.
