Age Assurance
What is Age Assurance?
Age Assurance is a RiskOS™-native Enterprise Solution that confirms whether a user meets an age requirement — for example, 18, 21, or 25 and over. It combines low-friction passive signals with higher-assurance active verification in a single, configurable workflow.
Age Assurance uses a layered, progressive approach:
- Start with passive signals that require no user action, such as device, phone, or email intelligence.
- Escalate to active verification — a selfie or a government document capture — only when a passive check does not return a result or when your policy requires it.
This approach balances accuracy, privacy, user experience, and regulatory flexibility. Instead of returning a date of birth or an exact age, Age Assurance returns a simple ACCEPT or REJECT decision with a Valid Age tag, backed by privacy-preserving Boolean threshold flags (age18Plus, age21Plus, age25Plus), so your application receives only the eligibility answer it needs.
Common use cases
- Age-restricted content and platforms
- Alcohol, tobacco, vaping, and cannabis commerce
- Online gaming, gambling, and sports betting
- Marketplaces and social platforms with minimum-age requirements
- Any workflow that must confirm an age threshold while minimizing friction and data exposure
Available assurance methods
Age Assurance orchestrates two categories of method. Cherry-pick a single method, run several independently, or chain them into a waterfall that escalates only when a method returns no result.
Passive methods
Passive methods infer an age threshold from signals the user already provides, with no photo or document capture.
| Method | Input | What it does | Typical use |
|---|---|---|---|
| Device-based | Device session token (SDK) | Matches a device to a historical identity in Socure's Identity Graph. | First step when a device signal is available and rules allow it. |
| Phone-based | Phone number (optional name) | Resolves an age threshold from an identity linked to the phone number. | When a device signal is unavailable. |
| Email-based | Email (optional name) | Resolves an age threshold from an identity linked to the email address. | As an additional passive fallback. |
The Digital Intelligence SDK captures the device session token and passes it in the evaluation request — you don't collect it manually.
Phone- and email-based methods can trigger a one-time passcode (OTP) to confirm possession. OTP runs only when RiskOS™ finds an identity.
Active methods
Active methods estimate or read an age from a capture the user provides through the Predictive DocV capture application. They run only when a passive method can't resolve age or your policy requires a capture.
| Method | Input | What it does | Typical use |
|---|---|---|---|
| Selfie-based | Selfie image with consent | Estimates an age from a facial image, with liveness and injection checks. | Where a document is not required. |
| Document + selfie | Government document (± selfie) | Reads the age from a verified government document, with the same checks. | Where a jurisdiction requires a government document. |
Age Assurance bills only when a method returns a usable result. For the full billing model, see Billing behavior.
High-level runtime flow
The following diagram shows the conceptual execution flow. When your application submits an Evaluation request, RiskOS™ runs the passive and active methods your workflow configures:
- The client submits an Evaluation request with the available inputs.
- RiskOS™ executes the configured passive methods.
- A method that returns a result ends the evaluation and returns a decision immediately.
- A method with no hit — or no matching input — falls through to the next configured method.
- Active verification occurs only when required.
- The final response returns a privacy-preserving
ACCEPTorREJECTdecision with aValid Agetag.
Meets threshold
No hit or no input
Meets threshold
No hit or no input
Meets threshold
No hit or no input
Evaluation request received
Device Age Assurance
Return privacy-preserving decision
Email Age Assurance
Phone Age Assurance
Active verification: selfie or document
The exact sequence depends on the workflow configured during implementation.
Regulatory handling
Age Assurance is fully customer-controlled. Socure remains neutral on regulatory policy and doesn't decide which rules apply to your business. Your workflow defines:
- State rules — which methods and thresholds apply in each jurisdiction.
- Thresholds — which Boolean threshold flags (
age18Plus,age21Plus,age25Plus, or others) gate your decision. - Escalation paths — when to fall through from a passive method to an active one, and which active method to require.
Thresholds are customer-configurable and can evolve over time.
Get started
[Configure the Workflow
Understand how passive and active methods are orchestrated into a waterfall and how routing decides each step.](https://help.socure.com/riskos/docs/configure-age-assurance-workflow)
[Build the Integration
Call the Evaluation API, read threshold decisions, and validate in Sandbox.](https://help.socure.com/riskos/docs/build-age-assurance-integration)
[Handle Age Assurance Step-Up Flows
Handle OTP and active selfie or document capture step-ups end to end.](https://help.socure.com/riskos/docs/handle-age-assurance-step-up-flows)