The age assurance playbook: one build for every mandate

The problem, stated honestly

Age assurance has one hard truth at its center: the population that must be excluded is the population most motivated and most native at circumvention. Teenagers defeat naive gates with borrowed credentials, replayed photos, shared accounts, and app-store workarounds at rates adult fraud teams underestimate, and the Australian data shows the scale: a measured 10 percent drop in under-16 account ownership after enforcement began, alongside surveys where more than half of children report never being asked their age at all. The gap between those numbers is the industry's to-do list.

The second truth: privacy constraints are load-bearing, not decorative. Every serious regime, the KIDS Act's no-stored-biometrics design, the US bill's estimation-without-identity requirement, eIDAS 2.0's selective disclosure, mandates proving the band while learning nothing else. Architectures that solve age by collecting identity documents from children are non-compliant by design in the era being written, and the platforms that hoarded minors' data will regret it in front of exactly the regulators now acquiring examination powers.

The third truth: friction is the failure mode that kills compliant programs. An age gate that loses adult users at scale gets quietly weakened by the growth team, and a weakened gate is what the investigator finds. The architecture below treats conversion as a design constraint equal to detection, because a control that survives is worth ten that impress in the audit and die in the funnel.

Reference architecture: the four-plane age stack

The stack has four planes. An evidence and policy plane, run by Luna, holds the per-regime tiers, buffer policies, decision records, examiner packs, and legislative tracking. A decision plane runs the per-action age checks at signup, login, purchase, wager, content gate, and tier conversion. Beneath it, three verification paths carry the work: an estimation path, a credential path, and a guardianship path. Inference signals triage which path each user meets, and Arbiter attacks all three paths on a standing cadence.

The estimation path

Facial age estimation carries the anonymous majority: a passive camera glance yielding an age band, no identity resolved, no template stored. Two design rules make it mandate-grade. Liveness underneath: the estimate issues only on deepeye's structural light and subdermal analysis, so replayed photos, screens, and generated adult faces fail before the age model ever runs. Buffers around every boundary: passing an 18-plus gate on estimation alone requires an estimate comfortably above 18, and the KIDS Act's dual boundaries at 13 and 15 mean dual buffer bands, each routing its borderline zone to the credential path. Demographic consistency is measured on the deployed population, not assumed from vendor tables, because a gate whose error widens for some skin tones is a discrimination case wearing a compliance badge.

The credential path

Arc validates the proofs that beat estimation entirely: EUDI wallet attestations with zero-knowledge age claims, mobile driver's licenses, UK DVS-certified digital IDs, the EU age verification app's tokens, and chip-read documents where nothing better exists, each under per-issuer trust policy with revocation checking and presenter binding. Selective disclosure is preserved end to end: the platform learns over 15 or over 18, never the birthdate, which is both the privacy mandate and the data-minimization defense. The credential path is also the buffer band's landing zone, so estimation's borderline users get a strong check rather than a coin flip.

The guardianship path

The KIDS Act's mini accounts, and every parental-consent regime behind them, are delegation problems: verify the adult, bind their guardianship to the minor's account as revocable authority, validate it during supervised use, and dissolve it at the verified tier conversion. Arc runs the same delegation machinery here that it runs for agent chains, and the lifecycle records, creation, supervision events, conversion, are first-class evidence, because guardianship is where investigators will probe for fabricated parents.

The evidence and policy plane

Luna holds the per-regime policy matrix, which boundaries, methods, and buffers apply per market and per action, writes every decision with its method, result, confidence, and context, assembles the examiner packs that Australia-style documentation powers demand, and tracks the legislative motion that keeps the matrix current through the KIDS Act's negotiation and the US bills' committee season.

Phase 0: population and exposure audit (weeks 1-2)

Two weeks of measurement, four artifacts. The action inventory maps every moment the platform must know an age band: signup, login, purchase, wager, content access, feature unlocks, tier conversions. Each action gets its regime references and its current control, and most platforms discover the honest baseline is a birthdate field nobody checks.

The population census measures what the user base can actually present: smartphone and camera coverage for the estimation path, credential availability by market (mDL states, EUDI rollout, UK certified IDs), and the household-device realities that guardianship flows must survive. Age assurance designed for a population that does not match yours is friction theater.

The minor-presence estimate is the uncomfortable artifact: run inference signals over the existing book to estimate under-age presence honestly, because regulators increasingly do exactly that from the outside, and Australia's survey-versus-enforcement gap shows what discovery looks like. The estimate prices the remediation queue and anchors the program's before-and-after measurement.

The regime matrix rows out every applicable mandate, in force and pending, boundary ages, accepted methods, evidence duties, and dates, and becomes Luna's initial policy configuration. Exit criteria: all four artifacts accepted jointly by trust and safety, compliance, and product, with one executive sponsor and the minor-presence estimate acknowledged in writing, because the program that hides its baseline cannot prove its progress.

Phase 1: the estimation gate (weeks 3-6)

Estimation deploys first because it carries the volume and its infrastructure, passive capture with structural liveness, is the foundation the other paths reuse. Track one integrates the fused session: deepeye's structural liveness with the age model issuing bands on top, at the actions the regime matrix marks as gated, starting with signup and the highest-risk access points. Track two calibrates buffers: per-boundary widths chosen deliberately against the platform's risk appetite, measured on live traffic in shadow mode for two weeks, with demographic-consistency reporting from day one. Track three builds the fallback ladder: buffer-band and no-camera users route to the credential path or, pre-launch, to document verification, at equal assurance and with the step-down documented, because fail-open temporary gaps are what teenagers find first and investigators find second.

Latency and conversion are exit gates, not afterthoughts: the estimation check must complete inside user tolerance at the platform's peak concurrency, and abandonment against the Phase 0 funnel baseline must hold inside the agreed envelope. Exit criteria: estimation live on the gated actions in the first target market, buffers calibrated with shadow-mode evidence, demographic consistency inside threshold, fallback ladder tested, and the first Arbiter replay-attack campaign passed.

Phase 2: the credential path (weeks 7-10)

Phase 2 turns on the proofs that make age assurance stronger and lighter at once. Arc ingestion goes live for the credentials the Phase 0 census found: EUDI wallet age attestations and the EU age app's tokens for European users, mobile driver's licenses where states issue them, certified digital IDs in the UK, chip-read documents as the universal floor. Each format gets issuer trust policy, revocation cadence, and presenter binding, the liveness check that stops a borrowed phone from becoming a borrowed age, and selective disclosure is verified end to end: the decision plane receives bands, never birthdates.

The routing logic then rebalances the whole gate: credential holders skip estimation entirely, buffer-band users land on credentials instead of rejection, and the friction budget improves as adoption grows, which is the quiet commercial argument for building this path early. Exit criteria: at least two credential formats live with per-issuer policy, presenter binding enforced and red-teamed, selective disclosure audited, and buffer-band routing measurably converting borderline users instead of losing them.

Phase 3: guardianship and tiers (weeks 11-13)

Where a regime requires supervised tiers, the KIDS Act's mini accounts foremost, Phase 3 builds the delegation flows. The guardian verification runs the full adult path: identity, liveness, and, where the regime demands, relationship evidence. The binding creates a revocable authority linking guardian to minor account, validated at supervised-use events and logged per lifecycle step. The conversion dissolves it on verified age at the boundary, estimation or credential, never the self-declared birthday, and the record shows the whole arc: creation, supervision, conversion.

The adversarial design point: fabricated guardians are the attack, an adult account manufactured or rented to unlock a minor's access, so guardianship creation gets the same ring-level scrutiny as any onboarding, shared-device and reused-asset correlation included. A guardian anchoring eleven unrelated minors is a finding, not a family. Exit criteria: guardianship lifecycle live in the target regime's shape, conversion on verified age tested, fabricated-guardian campaign from Arbiter defeated, and the lifecycle evidence pack producible per account.

Phase 4: evidence operations (weeks 14-16)

Phase 4 converts the running gates into examination capital, on the standard Australia has made explicit: records produced, not policies described. Luna assembles the standing artifacts: per-decision records across all three paths; measured accuracy and demographic-consistency reporting for the estimation gate on the deployed population; buffer policies with their reasoning documented; circumvention statistics, replays caught, borrowed sessions flagged, fabricated guardians declined, with the catching signal named; and the per-regime examiner pack that answers a KIDS-Act-style 90-day probe or an eSafety documentation demand from system output.

The phase closes with the mock examination: an internal team, armed with the regulator's question set, requests the evidence cold, the ten contested underage-access cases, the estimation accuracy file, the guardianship lifecycle records, and passing from system output alone is the exit criterion. Remediation of the Phase 0 minor-presence estimate also lands here: accounts the new gates would not have admitted get re-verified or transitioned under the regime's rules, before a regulator asks why they persist.

Phase 5: adversarial assurance (ongoing)

Age assurance decays without pressure, because its adversaries are numerous, motivated, and share techniques at school. Arbiter's standing calendar: weekly replay-and-synthetic campaigns against the estimation gate with current generation tooling; monthly borrowed-credential and stolen-phone campaigns against the credential path's presenter binding; quarterly fabricated-guardian and tier-conversion exercises; and event-driven campaigns when new circumvention techniques surface publicly, because they will, on video, with tutorials.

Every campaign feeds the regression suite and the evidence plane: the circumvention statistics that examiners respect most are the ones a platform generated by attacking itself and fixing what it found.

The regulatory map: one architecture, every regime

The board-level readings: convergence, every regime demands band proof at access with privacy and records, and reuse, each new law lands as rows in Luna's policy matrix rather than as a program. The KIDS Act's negotiation will move details; it will not move the shape.

Measurement: the program scoreboard

Reviewed monthly by the three sponsors, four sections on one page. Protection metrics: estimated minor presence trend against the Phase 0 baseline, circumvention interceptions by class with the catching signal named, and Arbiter campaign interception rates. Fairness metrics: estimation accuracy and false-rejection rates by demographic on the deployed population, buffer-band routing volumes, and fallback-path completion rates, because the users the primary gate cannot serve are the program's equity record. Funnel metrics: added latency per gated action, abandonment delta against baseline, credential-path adoption share, and step-up rates per tier. Evidence metrics: per-decision record completeness sampled weekly, examiner-pack currency per regime, mock-examination pass state, and time-to-produce for a cold file request, the single number Australia's regime has made decisive.

Failure modes: how age programs actually fail

The birthday gate. Self-declared age survives somewhere in the flow, a legacy signup path, an API, a market the rollout skipped, and becomes the route every minor takes. Phase 0's action inventory exists to find these; the discipline is closing them rather than grandfathering them.

The estimation monoculture. One method serves everyone, so the users it serves badly, no camera, borderline band, demographic edge, pile into support or churn, and the gate gets loosened to stop the bleeding. The three-path architecture exists precisely so no single method carries a population it cannot.

The stored-birthdate reflex. Teams collect and keep identity data just in case, converting a privacy-preserving mandate into a data-protection liability. Bands in, bands stored, nothing else, and the audit of what the system retains is part of Phase 4, not an afterthought.

The unmeasured gate. No demographic reporting, no circumvention statistics, no baseline, so the first honest measurement happens inside a regulator's investigation. Every metric on the scoreboard above is cheaper to produce voluntarily. The guardianship rubber stamp. Parental flows that verify nothing become the bypass: any adult account, real or manufactured, unlocks any minor. Guardianship creation deserves onboarding-grade scrutiny and ring-level correlation.

Segment notes

Social and video platforms carry the KIDS Act's full shape: dual boundaries, mini accounts, and the safety-by-design duties around them. Their scale argues for the credential path early, and their existing-book remediation is the heaviest, which is why the Phase 0 minor-presence estimate cannot be skipped. iGaming operators already run the strictest version: 21-plus boundaries, wager-time checks, and the state patchwork, covered in depth by the player verification playbook. Their age stack extension is session-frequency estimation ahead of the federal bill. App stores, games, and AI chat services are the KIDS Act's newly conscripted: many have never run identity infrastructure at all, and their populations skew mobile, which makes the estimation path's coverage strong. Age-restricted commerce inherits the UK's certified-credential moment: their gates are transactional and in-person as often as online, which is where verification hardware, the deepcam line's tabletop model at the counter, completes the picture the phone-based paths start.

The guardian experience: where compliance meets the kitchen table

Guardianship flows fail in living rooms before they fail in audits, so their UX deserves executive attention. The parent being asked to verify is often busy, skeptical, and on a different device from the child; a flow that demands document uploads at bedtime will be abandoned, and the abandoned flow becomes the pressure to weaken the gate. The designs that work make the guardian's verification a single passive session, estimation or a credential they already hold, deliver the binding request through a channel the parent already trusts, and make supervision legible: a guardian who can see what they authorized, and revoke it in one action, is a guardian who completes the flow and defends the platform to other parents.

The household edge cases need explicit policy rather than improvisation: separated parents and contested guardianship, kinship care and guardians without formal documentation, shared family devices where the guardian and minor present from the same hardware, and the sixteen-year-old whose younger sibling uses their hand-me-down phone. Each has a designed path in mature deployments, and each becomes a support escalation, then a press story, in immature ones.

Choosing the stack: the platform's evaluation grid

Six questions separate age assurance vendors. First, what anchors the estimate? Estimation without structural liveness is a suggestion box for replayed and generated faces; ask for the physics, and for the demographic-consistency measurements on populations resembling yours. Second, how many boundaries can policy express? A vendor built for one 18-plus threshold meets the KIDS Act's dual bands with duct tape; buffer policy per boundary, per market, should be configuration. Third, which credentials ingest today? EUDI attestations, the EU age app's tokens, mDLs, and certified digital IDs, with per-issuer policy, revocation, presenter binding, and selective disclosure preserved. Fourth, is guardianship delegation real? Ask to see the lifecycle: verified binding, supervised use, revocation, conversion on verified age, with records at each step. Fifth, what does a decision leave behind? Request the examiner-facing file for one contested case, produced live, timed. Sixth, who attacks it? Standing red-team evidence against current circumvention tooling is the falsifiability test that separates measured defense from asserted defense.

The economics: pricing protection honestly

Age assurance budgets clear when three lines are priced together. The penalty line is now concrete: Australia's A$99 million ceiling, the KIDS Act's fast-tracked probes, and the US bills' statutory exposure make a single enforcement event more expensive than a multi-year program. The remediation line is the one platforms underprice: discovering the minor-presence baseline under investigation, with a regulator setting the timeline, costs a multiple of measuring and fixing it voluntarily. The product line surprises committees in the other direction: credential-path onboarding is faster than document flows, passive estimation is lighter than the challenge screens it replaces, and platforms in age-sensitive categories increasingly market verified safety to parents as a feature, which converts the compliance build into acquisition copy.

Day-two operations: running the age program

Three rhythms keep the deployed program honest. The weekly protection review pairs trust and safety with product over the scoreboard: circumvention interceptions, fairness metrics, funnel deltas, and every Arbiter finding, one owner and date per item. The monthly regime council walks the policy matrix against legislative motion and lands each change as configuration with a test date. The quarterly examination rehearsal produces one regulator-grade pack from live system output, rotating regimes, so the documentation-disclosure request that Australia normalized is always a repeat performance. Staffing stays light by design: a policy owner for the regime matrix, an investigator queue sized to guardianship and circumvention escalations, and the adversarial liaison converting red-team findings into fixes.

After go-live: the first quarter

The quarter after cutover sets the program's trajectory. Run the remediation sweep first: the Phase 0 minor-presence estimate, re-measured with the new gates' evidence, becomes a concrete queue of accounts to re-verify or transition under each regime's rules, actioned while executive attention is high. Publish the internal scoreboard second: trust and safety, compliance, and product watching the same weekly numbers is what keeps the three-owner charter from re-fragmenting, and the fairness metrics in particular need daylight, because demographic drift discovered by a journalist is a crisis while the same drift caught on the weekly page is a tuning ticket. Schedule the first mock examination inside the quarter, not at the anniversary, because the KIDS Act's 90-day probe design means the real request may not wait for your anniversary either.

The board narrative

The program's summary for the board fits in three sentences. Age assurance is now a licensing condition for the consumer internet: the EU, Australia, the US, and the UK have all converted it from best practice into examinable obligation, with penalties sized to get attention. One architecture, estimation on liveness, credential proofs, guardianship delegation, over a policy matrix, satisfies every regime as configuration, and the build is sixteen weeks, not a multi-year program. The platforms that build it now protect minors measurably, convert compliance into parent-facing trust, and meet each new mandate as a configuration change while competitors meet it as a crash project.

The ninety-day variant

Platforms facing a forcing event, an enforcement letter, a market launch, a regulator's questionnaire, compress to the spine: Phase 0 in one week, the estimation gate with liveness and buffers in four, credential ingestion for the market's dominant format in three, and the evidence plane switched on from day one, with guardianship flows and the full examiner packs following the deadline. Every component ships as permanent architecture in triage order; nothing is throwaway.