ComplyAge
A checkpoint barrier across a dust-blown road.

Privacy-first age verification

The Age Gate

A drop-in script that gates your site by region. Free on every plan, including the free tier.

Get started

The ComplyAge Age Gate is a free JavaScript widget. It shields the page the moment it loads, asks ComplyAge which rule applies to the visitor's region — allow, verify, or deny — and either reveals the page, opens a verification window, or blocks access. Verified visitors receive a signed pass so they are not re-checked on every visit.

How it works

The script runs before any of your content is visible. It draws an opaque shield over the page, then calls the decision endpoint with your integration's public key. The response says whether the visitor's region is enforced, the minimum age, and which verification methods that region accepts. If the region is not enforced — or the visitor already holds a valid pass — the shield is removed immediately. Otherwise the shield becomes a centred verification window and the page stays covered until the visitor passes or leaves.

Passes, not tracking

When a visitor verifies, the gate stores a short signed pass — an Ed25519-signed token bound to your integration — in a first-party cookie on your own domain. On the next visit the script checks the signature locally with your integration's public key, so a returning visitor is let through without a round-trip and without ComplyAge learning anything about the visit. Passes expire; the default lifetime is 30 days.

Region rules you control

ComplyAge ships a catalogue of enforcement zones — the US states with age-verification statutes, the United Kingdom, France and Australia — each with a minimum age and the verification methods that jurisdiction accepts. Every region resolves to one of three rules, and you can override any of them for your site from the members portal.
  • Allow — no gate for this region
  • Verify — the visitor must complete an accepted verification method
  • Deny — access is blocked for this region

What it costs

Nothing. The Age Gate and OAuth/SSO are free on every plan. You only pay when a visitor completes a billed KYC verification through it — and only the methods a region actually requires are offered.

Fails open, not shut

If the decision request cannot complete — a network error, an outage — the script reveals the page rather than locking every visitor out. The decision endpoint is served from the apex domain and cached, so this is rare; when it happens, availability wins and the next page load tries again.

Search engines and the gate

The shield is a CSS overlay on top of an intact DOM: your HTML is delivered unchanged, so crawlers index your content exactly as before. There is nothing to exempt and nothing to cloak. The developer note covers what Googlebot sees, interstitial guidance, and Core Web Vitals.

Install in three steps

  1. Create an integration

    Sign up, create an integration for your site, and copy its public key from the Age Gate tab. Test keys and live keys are separate, so you can wire the gate on staging first.

  2. Add the script tag

    Place it in <head> so the shield is drawn before your content paints. The script is dependency-free and a few kilobytes; it is served with a short cache so key rotations take effect within a minute.

    <script src="https://complyage.org/gate/v1/script.js?k=YOUR_PUBLIC_KEY"></script>

  3. Set your region rules

    Review the default allow / verify / deny rule for each enforcement zone in the members portal and adjust them for your site. Changes apply on the next decision — no redeploy.

Frequently asked questions

Does the Age Gate hide my content from Google?
No. The shield is a CSS overlay; the page's HTML is unchanged, so crawlers index your content normally. See the developer note on the gate and SEO.
What happens to visitors outside enforced regions?
Nothing visible — the shield is removed as soon as the decision comes back unenforced, typically within a few hundred milliseconds of page load.
Can I use it without KYC?
Yes. Set every region to allow or deny and the gate never opens a verification window; it behaves as a pure geo-gate.
Does it work on single-page apps?
Yes. The script runs once per page load and the pass cookie is first-party to your domain, so client-side navigation is unaffected.
What does the visitor see in a verify region?
A centred verification window over the shielded page, offering only the methods that region accepts — for example government ID or payment card in Texas, plus facial age estimation in most other zones.