An operational engineering analysis evaluating deepidv, Persona, and Sumsub against the age assurance regime taking shape this quarter: Australia's doubled penalties and examination powers, the UK's certified digital ID for alcohol sales, and the US mandate track for sportsbooks and platforms.

Age assurance graduated from feature to regulated infrastructure in a single week. Australia's amendment raised failure penalties to A$99 million and armed its regulator with documentation-disclosure powers; the UK approved certified digital IDs for the highest-frequency age check in retail; and platforms worldwide read both correctly, as the template for what their own regulators will demand. Buying age assurance now means buying three things at once: an accurate estimation and credential stack, liveness that keeps it honest, and an evidence architecture that survives examination. This analysis compares deepidv, Persona, and Sumsub on those three axes.

The age assurance scorecard

Capability	deepidv	Persona	Sumsub
Facial age estimation	In-session, on structural liveness, buffer-policy native	Workflow block, configurable	Toolkit module, configurable
Liveness under the estimate	Passive structural light, subdermal	Active and passive options	Configurable liveness step
Certified credential acceptance (digital ID, ZKP age proofs)	Native via Arc, per-issuer policy	Emerging support	Configurable blocks, customer-maintained
Session-level re-checks (login, action-time)	Native, client-edge latency	Workflow re-trigger	Workflow re-trigger
Demographic consistency evidence	Measured bands, per-population reporting	On request	On request
Examination-grade decision records	Per-check evidence trail, native	Case records	Case records

Three architectures meet the documentation era

deepidv: age as a session property with an evidence trail

deepidv treats every age verdict as a compound fact: an estimation band, issued on deepeye's passive structural liveness, inside an attested session, logged with method, confidence, and context. That construction answers the three mandate-era questions at once: the estimate resists replayed and generated faces because liveness anchors it; borderline bands route to document, chip, or certified credential paths via Arc, including the UK's DVS-certified digital IDs and ZKP age proofs; and every decision is reconstructable for the regulator who now has the power to ask. Session-level placement, the login and action-time checks Australia's regime rewards and the US bill would mandate, runs at client-edge latency on the core platform.

Persona: configurable flows, evidence by assembly

Persona's workflow engine expresses age checks as configurable blocks, and teams with strong ops can compose estimation, document fallback, and liveness into a coherent gate. The documentation era stresses the seams: examination-grade evidence means per-decision records spanning every block, demographic-consistency measurement on the deployed population, and buffer policies maintained as regulation moves. On a workflow toolkit, that assembly and its upkeep belong to the customer, and the deepidv vs Persona comparison details where assembled flows and native evidence part ways.

Sumsub: broad toolkit, age as one module among many

Sumsub's breadth across KYC, AML, and fraud keeps it on age assurance shortlists, and its estimation module is serviceable inside its workflow model. The structural consideration mirrors every Sumsub evaluation this year: configuration is the customer's work, and the age mandate era multiplies the configuration surface, per-jurisdiction buffer policies, credential scheme onboarding as the UK and EU frameworks expand, and session-level re-check placement. Operators should price that standing effort honestly; the deepidv vs Sumsub comparison maps the boundary.

Suggested read: Australia doubles down: A$99M penalties for failed age checks

The test that decides it: the examiner's request

Run one scenario in every evaluation: a regulator, armed with Australia-style documentation powers, requests the full record for ten contested underage-access cases. The passing stack produces, per case, the age method used, the estimate and its confidence band, the liveness verdict beneath it, the fallback path taken or refused, and the session context, assembled by the system, in minutes. Stacks that answer with a policy PDF and a database export project are announcing their finding in advance.

A second scenario sorts the rest: present a replayed adult face, a generated adult face, and a borrowed adult session to each platform's age gate. The mandate era's premise is that all three arrive daily; the vendor's detection of all three is the product.

Frequently Asked Questions

Which vendor is best for age verification compliance?

For onboarding-only age checks, all three platforms serve. For the mandate-era shape, session-level estimation on liveness, certified credential acceptance, and per-decision evidence for examiners, deepidv ships the stack natively, while Persona and Sumsub reach it through customer-configured workflows whose evidence assembly and upkeep the operator owns.

What is age assurance versus age verification?

Age verification confirms age from an authoritative source, a document, database, or certified credential. Age assurance is the broader discipline: estimation, verification, and inference methods combined under policy, with fallbacks and evidence. Modern mandates regulate the whole assurance system, not just the verification step.

Do platforms need liveness for age checks?

Yes, if the check gates anything worth cheating. Estimation without liveness accepts replayed photos and AI-generated adult faces; regulators have absorbed this, and Australia's examination regime will surface it. Passive structural liveness closes the gap without adding user friction.

How do certified digital IDs fit age assurance?

As the strongest fallback and, increasingly, the primary path: UK DVS-certified digital IDs are now approved for alcohol sales, and EU wallets ship zero-knowledge age proofs from the end of 2026. Platforms need credential validation with per-issuer trust policy alongside estimation, which is what deepidv's Arc provides.

What evidence should an age assurance system retain?

Per decision: the method used, the estimate or credential result with confidence, the liveness verdict, the fallback routing, and session context, retained to the strictest applicable standard. Australia's documentation-disclosure powers make this the operative compliance test, and other regulators are following.