An operational engineering analysis evaluating deepidv, Jumio, and Persona against the EU KIDS Act's tiered age assurance proposal: band verification at 13 and 15, parental mini accounts, wallet-first proofs, and investigations fast-tracked to 90 days.

The KIDS Act redraws what an age vendor must do. Threshold checks, over 18, over 21, were one boundary with one buffer; the proposal's bands demand two verified boundaries (13 and 15), a supervised tier bound to a verified guardian, method staging from the EU age app toward EUDI wallet proofs, and evidence that survives an investigation on a 90-day clock. Platforms across social, video, app stores, games, and AI chat services will be procuring against that shape while the proposal negotiates, because acceptance infrastructure takes quarters and the Commission wants speed. This analysis compares deepidv, Jumio, and Persona on the workload as proposed.

The KIDS Act readiness scorecard

Capability	deepidv	Jumio	Persona
Age-band verification (13/15 boundaries)	Estimation with dual-boundary buffers + credential proofs	Document-anchored age, estimation emerging	Configurable estimation and document blocks
Parental / guardianship binding	Delegation chains via Arc, revocable	Not a stated product focus	Workflow-composed household flows
EU age app and EUDI wallet proof ingestion	Native via Arc, per-issuer policy	Regional roadmap	Emerging support
Liveness under the estimate	Passive structural light, subdermal	Selfie pipeline heritage	Active and passive options
Session-level re-checks	Native, client-edge latency	Re-verification events	Workflow re-trigger
90-day probe evidence	Per-decision records, system-assembled	Case records	Case records

Three architectures against the tier problem

deepidv: bands, delegation, and proofs on one engine

The KIDS Act's three hard problems map onto capabilities deepidv already runs. Band verification: facial age estimation on deepeye's structural liveness with buffer policies tuned per boundary, and credential proofs, the EU age app's tokens and EUDI wallet attestations, ingested through Arc with selective disclosure preserved, so the platform learns the band and nothing else. Guardianship: mini accounts are delegation chains, a verified adult bound to a minor's access with authority validated at use and revoked on change, the exact machinery Arc runs for agents and credentials. Evidence: every decision on the platform carries method, confidence, and context, which is what a 90-day fast-tracked probe rewards. The deepidv vs Jumio and deepidv vs Persona hubs carry the standing head-to-heads.

Jumio: document strength, tier machinery to build

Jumio's document-anchored verification handles the KIDS Act's strongest path, a chip-read ID proving an exact age, and its enterprise reach suits the platforms the Act regulates. The gaps are the proposal's novel parts: dual-boundary estimation with per-band buffers, guardianship binding, and wallet-proof ingestion sit outside a document pipeline's natural shape, and buyers should ask for architecture and dates rather than intent. For platforms whose users skew document-holding adults, Jumio's path is credible; the KIDS Act's population is precisely the one that does not hold documents.

Persona: composable flows, the assembly question again

Persona's workflow engine can express much of the tier logic: estimation blocks, document fallbacks, and household-style flows composed per platform. The recurring evaluation question compounds under the KIDS Act: two boundaries, guardianship states, method staging toward wallets, and per-member-state variation are a large configuration surface, and its upkeep, through Council-and-Parliament amendments and national transpositions, belongs to the customer. Platforms with strong ops teams can carry it; platforms buying an operated capability should weigh the difference deliberately.

Suggested read: The EU KIDS Act arrives with tiered age assurance for all

The test that decides it: the mini account lifecycle

One scenario exercises everything the proposal adds. A 14-year-old joins a platform under a parent's guardianship; at 15 the account converts to full access; meanwhile the guardianship must be verifiably bound at creation, enforced during use, and cleanly dissolved at conversion, with records at each step. The passing stack verifies the parent, binds the delegation, verifies the band at both boundaries without storing biometrics, converts on verified age rather than self-declared birthday, and produces the lifecycle's evidence on request.

Run its adversarial twin too: a 12-year-old presenting a replayed adult face for the 15-plus tier, and a fabricated guardian with no verified link to the minor. The KIDS Act's premise is that both arrive at scale; detection of both is the product being bought.

Frequently Asked Questions

What does the EU KIDS Act require from age verification vendors?

Band verification at two boundaries (13 and 15) rather than one threshold, parental-guardianship flows for the mini-account tier, staged methods from the EU age verification app toward EUDI wallet proofs, privacy-preserving design without stored biometrics, and evidence capable of answering investigations fast-tracked to 90 days.

Which vendors support age-band verification for the KIDS Act?

deepidv runs dual-boundary estimation on structural liveness with wallet-proof ingestion and delegation-based guardianship natively; Persona can compose much of the logic in configurable workflows the customer maintains; Jumio brings document-anchored age strength with the tier-specific machinery still emerging. Verify guardianship handling in any evaluation.

How would mini accounts verify parents?

Through delegation: verify the adult's identity, bind their guardianship to the minor's account as a revocable authority, validate it during supervised use, and dissolve it at the 15-plus conversion, with records throughout. It is closer to Know Your Agent delegation than to classic KYC.

When should platforms start building for the KIDS Act?

Now, at architecture level. The proposal must clear Council and Parliament, but acceptance infrastructure, band policies, guardianship flows, wallet ingestion, takes quarters, the EUDI wallets it leans on arrive within months, and early builders will shape the compliance expectations everyone else inherits.

Does the KIDS Act ban under-13s from the internet?

No. It routes ages 3 to 13 to child-appropriate video services under parental management, creates supervised mini accounts for 13 to 15 on social and video platforms, and opens full accounts from 15, with age verified at each boundary rather than self-declared.