Age Verification
Stop minors.
Not adults.
When a wrong age decision puts your licence at risk, you need more than a checkbox. IDProval's multi-signal verification gives you a confident, auditable verdict — not a guess.
Integration
Three steps to ship.
Install the SDK, create a session on your server, open the modal on your frontend. The verification flow, liveness checks, and document fallback are all handled for you.
import { createServerClient } from '@id-proval/sdk/server'
const client = createServerClient({
apiSecret: process.env.IDPROVAL_API_SECRET,
environment: 'production',
})
// Create a verification session for your user
const session = await client.verification.create({
external_id: 'order_abc123',
})
import { consumeVerificationSession } from '@id-proval/sdk/client'
// Open the verification flow in a managed modal
consumeVerificationSession(session.url, {
onCompleted: ({ is_of_age, verdict }) => {
if (is_of_age) {
grantAccess()
}
},
onCancelled: (reason) => {
showRetryPrompt()
},
})
{
"verification_id": "vrfy_01jt...",
"external_id": "order_abc123",
"status": "completed",
"verdict": "auto_approved",
"is_of_age": true,
"manual": false,
"completed_at": "2026-05-06T14:22:01Z"
}How it works
Multiple signals.
One clear answer.
A complete age verification requires two things: a real person behind the camera and a valid passport. IDProval runs a passive age estimate first, then walks the user through liveness confirmation and passport capture — combining all signals into one auditable verdict.
Passive scan
As soon as the user opens the flow, their face is analysed server-side. Our model returns an estimated age band and a confidence score — no prompts, no action required from the user. Clearly adult users pass instantly. Clearly underage users are rejected.
Liveness challenge
When the passive confidence is borderline, a short interactive challenge (blink, nod, or similar) confirms the user is a real, live person — not a photo or a screen replay. Liveness data feeds back into the age decision.
Passport scan
The user scans their passport. The date of birth is extracted and cross-referenced against the passive age estimate. A face match between the passport photo and the selfie is also performed to confirm it's the same person.
Verdict and audit trail
The passive estimate, liveness score, passport date of birth, and face match are combined into a single verdict — auto_approved, manual_review, or auto_rejected — along with the reasons that drove it. The verdict fires to your webhook and is queryable via the API at any time.
Verdict system
Three outcomes. No ambiguity.
Every verification ends in one of three structured verdicts. You act on the verdict — IDProval handles all the signal weighting behind it.
All signals agree the user is of age and the person is verified as live. Access is granted immediately with no manual action required.
Signals are ambiguous or conflicting. The session is queued for human review in your dashboard. A follow-up webhook fires when the reviewer decides.
Strong evidence the user is under the required age. Access is blocked. The verdict and supporting reasons are stored in the audit trail.
Regulatory context
The rules are getting stricter. The fines are not small.
Regulators in the UK, EU, and US are moving from guidance to enforcement. Platforms that can't demonstrate robust age assurance face licence revocation, substantial fines, and reputational damage that no marketing budget can repair.
"Robust" doesn't mean a self-declaration checkbox. It means a technical measure that a regulator would find credible under scrutiny — which is exactly the bar IDProval is designed to clear.
Ofcom Age Assurance Duty (UK)
Under the Online Safety Act, regulated services must implement age assurance for harmful content. Ofcom's guidance requires technical measures — not just terms of service — and specifies that the method must be "highly effective".
Digital Services Act (EU)
Very Large Online Platforms must conduct systemic risk assessments covering minors' access to harmful content and implement proportionate mitigation measures. Age verification is explicitly identified as a relevant technical measure.
State-level laws (US)
Texas, Utah, Louisiana, and a growing number of US states have enacted or are actively passing age verification laws for adult content and social media. Non-compliance means platforms face being blocked or sued at the state level.
The cost of getting it wrong
A false acceptance — letting a minor through — is never just a technical miss. It's the data point regulators cite in enforcement actions. A reliable, auditable verification record is your evidence that you did everything reasonably possible.
Capabilities
Everything you need. Nothing you don't.
Passive age estimation
Server-side analysis of a live selfie frame. No head turns. No prompts. Fast decisions for clearly adult users.
Liveness detection
Interactive challenge for borderline cases. Confirms a live person and prevents photo or video spoofing.
Passport extraction
The user's passport is scanned and parsed. Date of birth and face photo are extracted and used in the final verdict. Passport is the only accepted document type currently.
Webhook delivery
Every verdict fires a signed webhook to your endpoint. Correlate with your records using the external_id you provide.
Sandbox environment
Full verification flow in sandbox mode returns realistic payloads without processing real biometric data.
Multi-language support
The verification UI supports English, German, French, and Spanish with auto-detection or explicit locale override.
Smart document skip
Enable allow_skip_document and users clearly over 25 bypass the passport scan, approved on liveness + age estimate alone. Reduces friction for low-risk cohorts.
FAQ
Common questions.
Does the user need a passport every time?
By default, yes. A passport scan is part of every full verification. However, you can enable allow_skip_document in your verification options. When enabled, if the age estimate from liveness frames places the user clearly over 25 (age range bottom ≥ 25), the passport step is skipped and the verification is auto-approved.
Can I skip the passport scan for clearly adult users?
Yes. Set allow_skip_document: true when creating a verification session. After liveness is confirmed, we run server-side age estimation on the challenge frames. If the estimated age range is clearly above 25, the user is auto-approved without ever seeing the document capture step. If the estimate is ambiguous, the flow falls through to passport capture as normal.
What documents do you accept?
Currently passports only. We plan to add support for national ID cards and driver's licences in future.
What happens when a session is flagged for manual review?
The session moves to a pending_manual state and your webhook receives a manual_review verdict. Your team can review and approve or reject through the dashboard. The outcome triggers a follow-up webhook.
Are selfies or frames stored?
Captured frames are processed server-side and are not retained beyond the verification session lifetime. Session data is pruned automatically after expiry.
Can I test without real users?
Yes. Set environment to "sandbox" when creating the server client. Sandbox sessions go through the full flow and return realistic verdict payloads without processing real biometric data.
Get started
Ready to ship age verification?
Spin up a sandbox account, integrate in a day, and have a compliant, auditable age check in production before end of sprint.