doc__table__49

| 47. | The Commission considers the use of age estimation methods, when provided by an independent third party or through systems appropriately and independently audited notably for security and data protection compliance, as well as when done ex ante if necessary to ensure the effectiveness of the measure, to be an appropriate and proportionate measure to ensure a high level of privacy, safety, and security of minors in the following circumstances: (a) Where, due to identified risks to minors’ privacy, safety and security, the online platform service’s terms and conditions or similar contractual obligations of the service require a user to be above a required minimum age that is lower than 18 to access the service, based on the provider’s assessment of risks for minors on the platform (45) (46). (b) Where the provider of the online platform has identified medium risks to minors on their platform as established in its risk review (see Section 5 on Risk Review) (47) and those risks cannot be mitigated by less restrictive measures. The Commission considers this will be the case where the risk is not high enough to require access restriction based on age verification but not low enough that it would be appropriate to not have any access restriction or to have access restriction that is not supported by any age assurance methods or is only supported by self-declaration. Self-declaration is not considered to be an appropriate age-assurance measure as further explained below. Good practice MegaBetting (48) is an online platform that allows users to bet on the outcome of real-world events. The provider restricts its service to users above 18 years, in line with national law. To ensure that its online platform is not accessible to minors, it relies on the EU age verification solution that only tells the provider whether the user is at least 18 years old. This information is created by a trusted issuer based on the national eID of the user and is received from an application on the user’s phone. The provider considers therefore that the system meets the criteria of being highly effective whilst preserving the privacy of the user. Poor practice SadMedia is a social media online platform. The provider of SadMedia decided to restrict its services to minors who are at least 13 years old. This was based on its assessment of medium risks that the platform could pose to minors’ privacy, safety and security. SadMedia’s terms and conditions set out this restriction. To enforce this restriction, the provider of SadMedia relies on an age estimation model that it developed, and that it claims can predict the age of the user with a margin of error of ± 2 years. As a result of this margin of error, many minors below the indicated age can access the service and many minors who meet the required age cannot access the service. SadMedia’s age assurance measure is not highly effective and therefore does not ensure a high level of privacy, safety and security for minors on its service.

← 6.1.3.3. Age estimation · All articles · doc__table__50 →

Source: EUR-Lex (Cellar) · retrieved 2026-09-07 · Text as adopted (Official Journal); later amendments are not incorporated in this text.