Beyond the Upload: Reusable and Anonymous Age Credentials

This chapter examines an architectural alternative to repeating a full identity check at every service: a reusable credential that proves an age attribute without handing each relying service the underlying identity record. The focus is the boundary between proof and identity, then the Privacy Pass-based anonymous-token proposal described by Wodo, Gorski, and Hanzlik. The reader will be able to trace who performs the age proof, who issues a token, who verifies it, and which privacy, usability, and security properties still depend on assumptions outside the token itself.

The appeal is easy to state. If a person has already established that they are over a required age, a service may not need their name, address, document image, or exact birth date. A credential could communicate only the attribute needed for the decision. The person might also avoid repeating a burdensome check across every service. But moving from an upload to a credential does not remove the need for trust. It changes where trust, data, and abuse controls live.

Reusing an attribute without reusing an identity

A reusable identity record answers a broad question: who is this person, and what information is associated with them? A reusable age attribute answers a narrower one: does this credential assert that the holder meets a specified age condition? The difference matters for privacy. A service that receives only “over 18” learns less than a service that receives a document containing a name, photograph, date of birth, and document number. It may be able to make the access decision without becoming a repository of identity records.

The narrower proof is not self-authenticating. Someone must establish the age attribute, someone must issue or sign it, and the relying service must decide whether it trusts that issuer and the format used. The original proofing event may involve an identity document, a financial relationship, a government record, or another method. A credential reduces what the later service needs to see; it does not change whether the original age decision was accurate, fair, or lawfully obtained.

Ofcom observed that most services did not yet use interoperable or reusable age credentials when the UK rollout began. It also saw growing experimentation at account, operating-system, digital-identity, and third-party-provider layers. Reusable or tokenised models could reduce repeated checks and per-check costs, while digital identity services could share a specific age attribute across multiple interactions. Emerging designs also discuss zero-knowledge proofs, in which a verifier learns that a statement is true without receiving the underlying value. These developments point toward a less repetitive age-assurance ecosystem, but they remain an emerging market rather than a settled production standard.

Interoperability introduces a set of roles that a direct upload can hide. An issuer creates or signs the credential. An attester may perform the identity or age-proofing work on which the credential is based. A client device stores or presents it. An origin, or relying service, verifies the credential and makes the access decision. A trusted list or public repository can help services identify authorised issuers and obtain the keys needed to verify their signatures. Each role has a different view of the user and a different responsibility for failure.

The separation can reduce unnecessary disclosure. The attester may need to see the evidence used for know-your-customer or age-proofing, while the origin needs only a valid adulthood result.