The Real Design Question: Which Trade-off Is Acceptable Here?
The final question for age assurance is not which technology wins in the abstract. It is which process is proportionate to a service’s actual risk, supported by evidence strong enough for its claim, protective of users’ data, usable enough to be completed, and accountable for what happens after the decision. This conclusion brings together the regulatory boundaries, sector evidence, process controls, privacy safeguards, economic pressures, circumvention risks, and credential proposals examined in this series. It gives the reader a way to judge a deployment without mistaking an ID upload, face scan, wallet, or passing percentage for the complete answer.
The title’s distinction is therefore practical. An identity document is one possible input. Age assurance is the chain that connects an input to a protection outcome: what the service needs to know, what it does with uncertainty, when the gate applies, what data remains, how users recover from errors, and whether the wider ecosystem makes the decision meaningful. The best design is not the one that maximises one metric. It is the one whose trade-offs match the harm and remain visible under scrutiny.
Different rules answer different questions
The supplied sources do not describe one universal age-verification regime. They start from different harms, age boundaries, and allocations of responsibility. Preserving those differences is the first condition of a sound comparison.
The FTC’s COPPA enforcement statement addresses a child-privacy question. COPPA protects children under 13 and gives parents control over the collection, use, and disclosure of their children’s personal information, including through verifiable parental consent. The statement says that relevant mixed-audience and general-audience operators may use information to determine a user’s age without first obtaining verifiable parental consent, but only within the FTC’s stated enforcement-discretion conditions. The information must be used solely for age-verification purposes, disclosed only to appropriately safeguarded third parties that accept the same limits and prompt deletion, retained no longer than necessary, described in the privacy policy, secured reasonably, and collected through a method likely to produce reasonably accurate results.
Those conditions define a narrow permission, not a general endorsement of identity collection. A primarily child-directed service must still treat all users as children under the FTC’s stated position. A general-audience service that learns that a user is a child remains subject to COPPA’s other requirements. The statement creates no substantive rights and may be withdrawn or superseded. Its central lesson for age assurance is that purpose limitation, retention, security, notice, third-party control, and accuracy belong in one decision rather than in separate compliance boxes.
Ofcom’s framework begins from a different objective: protecting children from harmful content and enforcing duties under the UK Online Safety Act. Its HEAA guidance evaluates technical accuracy, robustness, reliability, and fairness, with accessibility and interoperability as additional principles. The framework focuses on whether a person is 18 or above for the duties covered by the report. It does not settle how a service should enforce every minimum age, and the report does not assess the separate question of restricting access for under-16s.
The legal purposes change the meaning of the same method. A facial estimate used to distinguish children from older users for a COPPA-related privacy decision is not automatically the same legal or operational intervention as a facial estimate used to block entry to pornography in the UK. A reusable credential that proves adulthood may reduce disclosure at a relying service, but its privacy value depends on the issuer, the protocol, and what other information can be linked to its use. The method is portable; the obligation is not.
The arXiv paper adds a technical and institutional perspective rather than another binding rule. It argues that a system permitting methods with different assurance levels can inherit the weaknesses of its least trustworthy option or integration, and it proposes a more distributed architecture using multiple attesters, issuers, and privacy-preserving tokens. Its proposal is useful because it makes concentration, anonymity, and device-binding issues explicit. It is not evidence that the proposed architecture has been validated in production, nor does it override the responsibilities imposed by a regulator.
These perspectives can be placed beside one another without being collapsed. The FTC asks when a defined age-determination collection practice can avoid a particular COPPA enforcement action.