Age assurance has a vocabulary of its own — some of it from regulators, some from the techniques, some from ComplyAge's product. This glossary defines each term once, in plain English, and links to the page where it matters.
Terms
- Age assurance
- The umbrella term for any technique that establishes a person's age or age range — verification against a document, estimation from a face, inference from data, or a trusted third party's attestation.
- Age verification
- Establishing age with a high degree of certainty from an authoritative source such as a government-issued document or a bank. Distinct from age estimation.
- Age estimation
- Inferring an age or age range from characteristics — most commonly a live facial image — without a document. Probabilistic by nature, so regulators expect a buffer above the legal minimum.
- Age gate
- A control that blocks access to content until a visitor's age (or region rule) has been resolved. ComplyAge's Age Gate is a script that shields the page, decides by region, and opens a verification window only where required.
- Allow / verify / deny
- The three compliance rules a region can carry in ComplyAge. Allow lets the visitor through; verify requires an accepted method; deny blocks access.
- Enforcement zone
- A jurisdiction with a minimum age, a rule and an allowed-methods list in ComplyAge's catalogue — a US state with an age-verification statute, or a country such as the UK, France or Australia.
- Minimum age
- The age threshold a zone enforces for the gated content. ComplyAge's catalogue uses 18 for adult content; alcohol and gambling thresholds differ and are configured separately.
- Challenge age / buffer
- A margin above the minimum age applied to estimation methods: a visitor estimated below the challenge age is asked for a stronger proof rather than refused.
- Liveness detection
- Checks that a camera is seeing a real, present person rather than a photo, a screen or a mask — prompts, motion and texture cues, run on-device in ComplyAge's verification window.
- Facial age estimation
- Age estimation from a live selfie: a face is detected, liveness is confirmed, and a model estimates age. No document is involved and no image is stored.
- Face anchor
- A protected vector derived from a verified face that lets ComplyAge recognise the same person on a later check. It cannot be reversed into an image and is not shared with partners.
- Government ID verification
- Photographing a passport, ID card or driving licence, reading it with OCR, and matching a live selfie to the document portrait. The strongest age proof and the one strict zones require.
- OCR
- Optical character recognition — reading the machine-readable zone or printed fields on a document to extract the date of birth, expiry and document type.
- Payment card check
- Confirming a valid credit or debit card through a small, voided authorisation. Accepted by many statutes as a commercially reasonable method; credit cards are the stronger signal.
- Reusable verification
- A verification record stored against a user's ComplyAge identity so it can satisfy later checks — for the same partner or another — without repeating the method.
- Verification record
- The stored outcome of a verification: method, time and result. It never contains the evidence.
- Audit archive
- The encrypted bundle of a verification's evidence — images, document reads — retained only to answer a valid legal request and deleted when retention ends.
- Grant
- A durable record that a user has connected — and been verified for — a specific partner integration through OAuth/SSO. Users can revoke grants from their portal.
- Integration
- A partner site's configured connection to ComplyAge: test and live keys, Age Gate rules, verification settings, OAuth credentials and webhooks. Usage is metered per integration.
- Test keys / live keys
- Separate key sets per integration. Test keys never bill and never produce live verifications, so staging can be wired end to end.
- Pass
- The signed token the Age Gate stores in a first-party cookie after a visitor is verified or exempt. Verified locally with the integration's public key, so returning visitors are revealed without a request.
- Ed25519
- The signature scheme ComplyAge uses for gate passes. Fast to verify in a browser with SubtleCrypto and impossible to forge without the private key.
- Fail-open
- The gate's behaviour when the decision request cannot complete: reveal the page rather than lock out every visitor. Availability failures should not become access failures.
- Geo-IP
- Resolving a visitor's region from their IP address. The Age Gate's first step; results are cached.
- Data minimisation
- Collecting only what a check requires, keeping it only as long as its purpose requires, and never repurposing it. A design constraint, not a policy footnote.
- Double-blind (double anonymity)
- An architecture in which the age-verification provider does not learn which site the user is visiting and the site does not learn who the user is. Required by France's Arcom reference framework.
- Highly effective age assurance
- Ofcom's standard under the UK Online Safety Act 2023: methods that are technically accurate, robust, reliable and fair — photo-ID matching, facial age estimation, mobile-network checks, credit-card checks, digital identity wallets and similar. Self-declaration is not.
- Digital identity wallet
- A government- or bank-backed app holding verified attributes (including age) that a person can present to a site without showing the underlying document.
- KYC
- Know Your Customer — the identity-verification checks regulated businesses run on customers. ComplyAge's billed product applies the same techniques to age and identity for online services.
- OpenID Connect
- An identity layer on OAuth 2.0: an authorisation-code flow that yields identity claims. ComplyAge's OAuth/SSO follows its shape and adds a verifications extension.
- Consent screen
- The page in an OAuth flow where the user approves the scopes a partner requested. In ComplyAge it names the site and lists exactly what will be shared.
- Webhook
- An HTTP callback ComplyAge sends to a partner's server when a verification event occurs, configured per integration.
- Self-declaration
- Asking the visitor to tick a box or enter a birth date. Trivial to bypass and not accepted by any modern age-verification regime as sufficient.
- Interstitial
- A screen shown before the page's content. Google excludes legally required interstitials such as age verification from its intrusive-interstitial ranking signal.
- Cloaking
- Serving crawlers different content from users — a search-engine violation. ComplyAge's gate serves identical HTML to everyone, so no crawler exemption is needed.
- Lawful request
- A subpoena, court order or equivalent that ComplyAge will act on to open an audit archive. The law-enforcement page describes what is required and what is disclosed.
Frequently asked questions
- What is the difference between age verification and age estimation?
- Verification establishes age from an authoritative source — a document or a bank. Estimation infers it, most often from a live face, and is probabilistic, so it is used with a buffer above the legal minimum.
- What does highly effective age assurance mean?
- It is Ofcom's standard under the UK Online Safety Act for methods that are accurate, robust, reliable and fair. Photo-ID matching, facial age estimation, credit-card and mobile-network checks qualify; self-declaration does not.