Imagine an age check that asks for no ID document, no bank card, no selfie. Just a notification on your phone: "This service is requesting proof: are you over 18?" You approve with a single tap. The platform receives one word — "yes" — and nothing else. No name, no date of birth, no document number. That is the principle behind the age proof issued by the European digital identity wallet, and it is the third generation of age checking now arriving at the door of adults-only services.
We have already explained here what happens to an ID document after a check and, more recently, how facial age estimation works. The angle here is different: this is the third path, the age attribute issued by a certified wallet. A little-known mechanism, often presented as the ideal solution, and one whose real promise and real limits both need to be understood — especially if you live outside the European Union.
Three ways to prove you are an adult
To place the wallet in context, it has to be compared with the two methods that came before it.
| Method | What the platform receives | What a third party learns about you |
|---|---|---|
| ID document sent to the service | Name, date of birth, photo, document number | The service (or its provider) knows who you are |
| Facial estimation | A probable age bracket | A provider has seen your face at a given moment |
| Age proof from a certified wallet | A boolean: "adult: yes" | The issuer knows you proved an age, not to whom |
The difference is qualitative, not incremental. In the first two cases, personal data circulates. In the third, what circulates is a cryptographic attestation: a token signed by a trusted issuer that the service can verify mathematically without ever learning what was used to produce it.
The legal framework for this wallet is the European eIDAS 2 regulation (Regulation (EU) 2024/1183), which requires every member state to offer a digital identity wallet to its residents. In parallel, the European Commission has funded a reference age-verification app, known as the mini-wallet, so that services can request the "over 18" attribute without waiting for national wallets to be fully deployed.
"Double-blind": the central piece of the system
If the age attribute simply travelled from the issuer to the service, one obvious problem would remain: the issuer would know which service you are visiting, and at what time. For an adults-only service, that is unacceptable.
Hence the principle that the CNIL (France's data protection authority) has recommended since 2022 and reaffirmed in its opinion on the Arcom (French audiovisual and digital regulator) framework: double anonymity, or double-blind.
The age verifier must not know which site the user wants to access, and the site must not know who the user is. Both forms of ignorance must be guaranteed technically, not merely promised contractually.
In practice, the scheme works in three stages:
- Issuance. Once, in advance, you obtain an age attestation from a trusted issuer (the state, a digital identity operator, a bank in some schemes) and store it in your wallet. The issuer knows it has issued this attestation to you.
- Local storage. The attestation stays on your device, protected by the phone's secure element and by your passcode or fingerprint.
- Presentation. At the moment of the check, it is your device that answers the service. The issuer is not contacted, so it learns nothing about your visit.
That last point is the key. An age check that triggers a network call to the issuer at every login is not double-blind, whatever the marketing page says. A check that works offline, using only an attestation already present on the device, is.
Non-correlation: the other, less familiar guarantee
One theoretical weakness remains: if your wallet always presents the same token, two different services can compare their logs and work out that it is the same person. European specifications therefore require non-correlatable attestations: each presentation generates a different proof, impossible to link to the previous one.
For an adult who uses several 18+ platforms, that is the difference between a check that genuinely protects and a check that creates a cross-site tracking identifier. So the question to ask when facing an age-check page is not only "what am I being asked for?" but "can this proof be reused against me?"
Where do things actually stand in November 2026?
The legal timetable has to be distinguished from the real one.
- France. The loi SREN (Act on securing and regulating the digital space) of 21 May 2024 gives Arcom the power to adopt a binding technical framework for age verification by services distributing adults-only content. That framework, adopted after a public consultation and an opinion from the CNIL, enshrines double anonymity as a requirement and bans the simple tick-box. Arcom has also launched proceedings against some thirty sites for failing to check age.
- European Union. The Digital Services Act (DSA) requires platforms to protect minors, and the Commission has published guidelines that explicitly cite the wallet-based age-verification app. National wallets must be available to all residents by the end of 2026, with a gradual ramp-up.
- United Kingdom. The Online Safety Act has required "highly effective" checks since 2025. Ofcom accepts several methods, including facial estimation and mobile operator checks, but the European wallet has no legal standing there.
- Russia, Kazakhstan, Belarus, Ukraine. No equivalent of the eIDAS wallet. In Russia, the logic is the reverse: reinforced identification through state services and a centralised register, under the control of Roskomnadzor. For Russian-speaking readers, this means that the same service may apply very different checking regimes depending on the country detected — an issue we covered from the regulatory angle in our article on throttled messaging apps and VPN rules.
In practice, a French-speaking adult logging in to an 18+ platform today will still mostly encounter facial estimation or a bank-card check. The wallet is coming, but it is not yet the default route.
What the wallet protects — and what it does not
This is where many articles stop too soon. An anonymous age proof solves one problem: identity leaking at the moment of the check. It solves no others.
What it protects:
- your name and date of birth never reach the platform;
- no document scan sits dormant in a provider's database;
- the issuer does not build up a history of your visits;
- if the platform suffers a data breach, there is no identity to steal — only an unusable token.
What it does not protect:
- your IP address, which the platform sees anyway, as we set out in detail regarding what your operator and your router see of your sessions;
- your device and its technical fingerprint;
- the content of your conversations and what your camera shows;
- your household: an anonymous age check does nothing about the fact that a spouse, a flatmate or a neighbour can hear or see the session.
In other words: the wallet shifts the risk from administrative identity to domestic and technical risks, which remain entirely your responsibility. An adult who secures the entrance but leaves the screen visible from the hallway has gained nothing. A simple privacy screen filter, which blacks out the image as soon as it is viewed from an angle, solves part of a problem no cryptography will ever touch.
Six questions to ask when facing an age check
Since several methods coexist and will do so for a long time, here is a useful framework for the moment the check screen appears.
- Who is asking me for proof? The platform itself, or a named third-party provider? A named, identifiable provider is a fairly good sign: it is subject to the GDPR and to the regulatory framework.
- What exactly am I being asked for? A simple "adult yes/no" boolean is the legitimate minimum. Requesting a full identity for mere 18+ access is disproportionate.
- Where does the data go? A privacy policy that specifies retention periods and rules out advertising reuse is worth more than a blank page.
- Is there a choice of method? The frameworks encourage plurality: if only one method is offered and it is the most intrusive one, that is a warning sign.
- Can the check be replayed against me? A proof that can be reused identically is an identifier in disguise.
- Is the platform credible in other respects? Legal notices, moderation, publisher's address: the full checklist is in our article on how to recognise a credible 18+ chatroulette.
If two answers out of six make you uneasy, that discomfort is legitimate: there is no obligation to submit to a check whose scope you do not understand.
The particular case of couples
One practical detail the legal texts do not address: an age check validates a person, not a room.
When two adults log in together in front of the same camera, the platform has verified the age of the account holder. The second adult on screen has proved nothing. Legally, the holder's liability is engaged; humanly, the question of the second person's consent remains wide open and has nothing to do with cryptography. We explored this in our article on protecting the household when the camera comes on.
Two concrete consequences for a couple:
- the account must be owned by name by one of the two, and both must know it;
- the explicit agreement of the second adult on what is shown, recorded or interrupted must be settled beforehand, not during.
An identity wallet does not arbitrate a discussion between partners. All it does is prove an age.
Getting ready for the wallet without exposing yourself further
A few useful habits, independent of the European timetable.
On the device side. The age proof lives in your phone: if the phone is compromised, so is the proof. Long passcode, system updates, short auto-lock. An adult who often carries their device around will benefit from an RFID-blocking wallet case to prevent remote reading of any contactless documents carried alongside it.
On the separate-identity side. The wallet proves age, not account anonymity. Email address, username and browser must stay compartmentalised, following the method described in our article on separating username, email and browser. To remember these distinct credentials without writing them in a notebook left in plain sight, a password manager with a physical security key remains the most robust solution.
On the environment side. None of the above replaces physical discretion: a door that closes, closed-back noise-cancelling headphones rather than speakers, a neutral background. To hide a wall that says too much, a plain webcam backdrop does a job that neither Arcom nor the European Commission will ever do for you.
On the backup side. If the attestation is stored locally, losing the phone means requesting it again. Noting down in advance which issuer provided it saves half a day of searching. A small notebook with a combination lock kept out of sight is better than a file called "identity" on the desktop of a shared computer — a subject we dealt with in our article on the household's shared computer.
Key takeaways
On paper, the European digital identity wallet is the best compromise ever proposed between two contradictory requirements: preventing minors from accessing adults-only services, and not turning every adult into an identified file. It rests on three pillars: minimal attribute (a yes, not an identity), double-blind (nobody sees both ends of the chain), non-correlation (no reusable proof).
Three caveats, however, deserve to be stated plainly.
- Its rollout is gradual and European: outside the EU, and notably for Russian-speaking users, it has no effect at all, and other approaches — centralised, name-based — prevail.
- It covers only the moment of the check. Everything that happens afterwards depends on your settings, your network, your room and your agreements with the other adults present.
- Its quality depends on the actual implementation by the service: the word "anonymous" is used by systems that are nothing of the sort. Reading the privacy policy page remains the only real test.
A well-designed age check should cost an adult nothing but two seconds of attention. We are getting there. But the bulk of protecting a household, in 2026 as before, is still not decided at the service's front door: it is decided in the room where the camera comes on.
Sources
- Regulation (EU) 2024/1183 amending the eIDAS Regulation (European digital identity wallet), Official Journal of the European Union.
- European Commission, guidelines on the protection of minors under the Digital Services Act (DSA) and reference age-verification application.
- Arcom (French audiovisual and digital regulator), technical framework on age verification for access to services distributing adults-only content, and the associated public consultation.
- CNIL (French data protection authority), opinion on the draft Arcom framework and recommendations on double anonymity in age verification.
- Loi n° 2024-449 du 21 mai 2024 visant à sécuriser et à réguler l'espace numérique (SREN) (Act no. 2024-449 of 21 May 2024 on securing and regulating the digital space).
- Ofcom, guidance on highly effective age assurance, Online Safety Act 2023.
