Online Age Verification System: Preventing Sales to Minors

Whether you run a age-restricted digital service (such as online gaming), or an online store selling e-cigarettes, cannabis or alcohol, age verification is a legal requirement in jurisdictions that permit such online activities. Like identity verification procedures, age verification shouldn’t serve the purpose of regulatory compliance alone; it needs to be designed to deliver an optimal online experience that doesn’t deter age-appropriate customers from purchasing products and services.

Slow and cumbersome verification processes will test customers’ patience and drive them away. In that context, how can companies verify age online with confidence, while providing a quick and seamless onboarding experience?

Gaming

The applicable age verification requirements may differ depending on the product and service being sold, along with the jurisdictions in which the business operates and in which orders are placed. Staying compliant therefore requires an understanding of the specific standards prescribed by local regulators. Age verification systems need to be robust, accurate and quick, and they need to maintain an audit trail. Another consideration, especially for operators selling in multiple jurisdictions, is the system’s ability to customize age verification requirements to account for cross-border regulatory compliance.

For example, the legal age in some jurisdictions is 18, whereas in other areas it may be 19 or 21. Having automated procedures to account for such differences allows the age verification system to seamlessly onboard customers from multiple regions, without the tedium of creating a separate onboarding process for each and every jurisdiction.

Age-restricted products

Unlike services, age-restricted products are physically delivered to the customer. Relying on the delivery person to verify the customer’s age comes with inherent risks. Does the delivery person have expertise in identity and age verification? Can they be thorough in doing their due diligence on each and every customer that they deliver to? Is there a way to track the verification and authentication process? Can it be audited?

Alcohol

Consider online alcohol sales, a $21 billion market that is estimated to grow to $45.5 billion by 2024. In a sting operation in Texas, it came to light that over 20 percent of underage people were able to get alcohol by ordering it on an app. For legitimate operators, underage drinkers represent massive risks in the form of regulatory fines and lawsuits; there is also the risk of reputational damage should these oversights become public and attract the opprobrium of the society at large. It would also give detractors the ammunition to call for the creation of excessive requirements to police the sale of age-restricted products online, which could threaten the viability of the business model.

E-cigarettes

Another fast-growing market where age verification is generally a requirement is e-cigarettes (vaping). The FDA does prohibit the sale of e-cigarettes and other nicotine products to people under the age of 18. But according to the U.S. Centers for Disease Control and Prevention (CDC), e-cigarette use by high school students has jumped 78 percent from 2017 to 2018. In 2019, anti-tobacco organization Truth Initiative stated that “27.5 percent of high school students had used e-cigarettes in the past month.”

Unfortunately, according to a 2017 Internet Tobacco Vendors Study, “very few vendors used potentially effective age verification, leaving youth access to e-cigarettes online wide open … in the online e-cigarette market, vendors do very little to prevent youth access, and have used payment and shipping methods that were banned for cigarettes.”

Cannabis

Many jurisdictions already permit the medicinal use of cannabis, and efforts to legalize recreational use have been successful in several parts of the world. Global consumer spending on cannabis is projected to hit $32 billion by 2022.

For example, in Canada, on October 17, 2018, recreational cannabis was legalized across the country. As with the example set in several U.S. states, legalization doesn’t imply an “anything goes” scenario; cannabis distribution will be a highly regulated space, with strict rules and procedures. A consistent criterion is the mandatory check of purchasers’ IDs to prevent underage users from accessing the drug.

While sales are regulated on a provincial level, the online purchase of cannabis products is generally acceptable across Canada. According to Canada Post, the Canadian national mail service, “If the receiver appears to be younger than 25 years old, our trained delivery agent will require an acceptable photo ID … before handing the parcel to the individual. The proof of age requirement means we must also record the name and signature of the receiver.” The success of such measures, however, is highly contingent on how steadfastly they are followed.

Children in an online world

Online age verification is useful, or a legal requirement, for many digital services. Consider how widespread entertainment, interaction and other activities are on mobile and online channels, often without adult supervision. Allowing minors to create adult profiles is a recipe for disaster, enabling access to sites or content that they should not be exposed to.

Depending on the age, jurisdiction and use case, there are strict laws that might require consideration. In the U.S., the Children’s Online Privacy Protection Act Rule (COPPA) limits the collection of personally identifiable information from youngsters (under the age of 13) without their parents’ consent. In the EU, the GDPR also has strict conditions around collecting young people’s information.

The consequences for disregarding these age-related obligations are especially harsh. Musical.ly, for example, paid a $5.7 million fine and the FTC assessed a $4 million fine against HyperBeard, both for allowing children to create accounts without the proper safeguards or consent. In many cases, it’s not enough to simply make a statement of the age requirements or use an age checker that is easily bypassed with no verification.

If parental consent is necessary, it’s essential to put careful thought into the consent process; while parents want to ensure the safety of their children, they also don’t want to go through onerous and ongoing checks that make their gatekeeping difficult. Finding solutions that protect children, follow the law, and allow parents the control and flexibility that they desire is key to making the online world work for minors.

Identity verification systems

For companies providing age-restricted products or services via online channels, an effective identity verification solution helps ensure compliance. With digital identity verification (IDV), the consumer’s personally identifiable information (PII) data such as name, address and date of birth is obtained with their consent, and the PII is then checked against data sources to see if the information matches — in other words, it is established if the customer is indeed who they say they are. Layering various other data points on top of PII adds to the level of trust in that identity. These data points can include email and phone contact data, which is confirmable via two-factor authentication. The history and metadata of the contact information also provides data points for further analysis.

Another valuable layer of information is available via ID document verification. ID documents are photographed and sent in electronically. These photos are then automatically compared to ID document templates to analyze for forgery or alteration. The information can also be collected using optical character recognition (OCR) and then run through the IDV process.

Beyond providing age verification compliance measures, these identity verification processes provide a layer of fraud prevention. As online verification is quick and easy for consumers to fulfill, it allows consumers to seamlessly carry on with their transaction without being burdened by additional steps to prove their identity.

For businesses that focus on age-restricted products and services, one of the most fundamental business factors is ensuring convenience for legitimate customers, while reducing the risk of minors obtaining access to such products.

This post was originally published April 25, 2019 and updated to reflect new information.