AI Identity Verification: Facial Age Estimation Rules

AI identity verification uses machine-learning models to confirm who a user is and, increasingly, how old they are — most visibly through facial age estimation, where a selfie is analysed to estimate age rather than read a date of birth from a document. For online gambling, the rule of thumb is simple: treat the AI estimate as one control in a layered age-assurance process, set a conservative challenge age with a buffer, and keep independent test evidence for the exact model version you deploy.

Done well, facial age estimation cuts friction for obvious adults while catching under-18s at the door. Done carelessly, it waves through minors or wrongly challenges one legitimate adult in five. This guide explains how the AI works, the buffer trade-off, the bias testing regulators expect, and where estimation fits alongside documents and database checks. If you are shortlisting vendors, start with our overview of age verification software for casinos.

How AI identity verification works

A facial age estimation model is trained on large, labelled image sets to output an estimated age (and usually a confidence band) from a live selfie. It is not facial recognition — it does not match you to a stored identity; it only estimates age. Accuracy is reported as Mean Absolute Error (MAE), the average number of years the estimate is off. Independent evaluation by the National Institute of Standards and Technology (NIST), through its Face Analysis Technology Evaluation, is the benchmark buyers should ask for; vendor self-reported numbers (often from mobile selfies) tend to look tighter than NIST’s document-image tests, so compare like with like.

Because an estimate is never exact, operators apply a challenge age (or buffer): if the estimate falls below the threshold, the user is escalated to a document or database check instead of being passed or refused outright. This is the same layered logic we describe in our guide to age verification methods.

The buffer trade-off: why the challenge age matters

The challenge age is the core policy lever. Set it close to 18 and you let more borderline minors through; set it high and you send far more genuine adults to a secondary check. Public testing shows the effect is large. In one documented example, moving the challenge age from 25 to 31 cut a vendor’s population-weighted false-positive rate from roughly 0.029 to 0.003 — but raised the share of adults wrongly challenged from about 0.082 to 0.199, close to one in five. There is no free lunch: tighter protection for minors means more adult friction.

The direction of the trade-off is stable even if exact figures vary by model and population, so the table below is illustrative, not a guarantee. Tune it against the evidence for your specific model version and audience.

Regulators and standards bodies have begun to let buffers shrink as models improve: Germany’s KJM has reportedly reduced the required buffer for one certified vendor from five years to three at the highest assurance level, citing lower error rates around ages 17–20. Treat such changes as model- and jurisdiction-specific.

Bias testing is not optional

Age estimation error is not evenly distributed. Independent work has found false-positive rates under a Challenge-25 policy varying sharply by demographic subgroup — for 17-year-old men, one algorithm ranged from about 0.06 for East European subjects to 0.84 for West African subjects. Vendors publish results by gender and skin tone and some report no material bias, but NIST uses geographic region as an imperfect proxy for skin tone, so no single number tells the whole story. Set separate approval thresholds for overall error, subgroup variance and scenario robustness before any production rollout.

Where AI fits in the age-assurance stack

Facial age estimation is one method among several. A defensible deployment combines methods and documents the logic, rather than relying on a single AI score. Keep certification (such as an Age Check Certification Scheme evaluation) separate from NIST accuracy results — they answer different questions.

For the independent evidence base, read NIST’s face-technology evaluation work (background on NIST) and ask every vendor for NIST results on the exact model version you will run. Biometric methods and anti-spoofing are covered further in our note on biometric identity verification.

What the accuracy numbers mean

Vendors and evaluators quote several figures, and mixing them up leads to bad procurement decisions. Mean Absolute Error is the average miss in years, but it hides the tails — a low average can still mean a meaningful share of 17-year-olds estimated as adults. The more decision-relevant number is the false-positive rate at your chosen challenge age: the share of under-18s who would be wrongly passed. Vendor results from mobile selfies tend to look tighter than NIST results on document images, partly because the capture conditions differ, so always ask which test set and which capture method produced a given number.

The practical rule is to compare like with like: insist on independent results (such as NIST) for the exact model version, at the specific challenge age you will run, broken down by demographic subgroup. A headline “MAE of 2.x years” is a starting point for a conversation, not evidence that a model is safe to deploy against your assurance obligations.

Why age assurance is tightening

The push toward AI-based age checks is driven by regulation, not just technology. In the United Kingdom, the Online Safety Act 2023 and Ofcom’s expectations around “highly effective age assurance” have raised the bar for services that must keep minors out, and facial age estimation is explicitly one of the methods in scope. Gambling regulators add their own layer: the Gambling Commission requires operators to verify a customer’s age before allowing deposits or play, and Ontario’s AGCO sets age-and-identity obligations for registered operators. The common thread is that “self-declared” age is no longer acceptable where minors must be excluded.

For a compliance team, that means age assurance is not a single vendor decision but an evidence exercise: you need to show the method is effective, that it was applied before access, and that borderline users were escalated. The trend is toward lower buffers as models improve (Germany’s reported reduction from a five-year to a three-year buffer for one certified vendor is an example), but each reduction is tied to independent evidence for a specific model and assurance level — so the regulatory direction rewards operators who document their testing, not those who simply switch a feature on.

Liveness detection and anti-spoofing

Facial age estimation and document checks both depend on the person in front of the camera being real and present — which is why liveness detection sits underneath AI identity verification. Passive liveness analyses a single selfie for signs of a spoof without asking the user to act; active liveness prompts a movement or gesture. The threats have moved on from printed photos and screen replays to injection attacks, where a manipulated or AI-generated video feed is fed straight into the verification pipeline, and deepfakes designed to defeat face matching. A 2026-grade deployment should assume these attacks exist and test against them, not just against held-up photographs.

For gambling operators this matters because the same selfie step is often reused for both age assurance and identity proofing at withdrawal. If liveness is weak, a fraudster can pass age estimation and later defeat the identity match, so treat liveness as a security control with its own evidence requirements, separate from the age-estimation accuracy numbers.

A deployment checklist for facial age estimation

Before you turn facial age estimation on for real users, work through the controls regulators and auditors will ask about. The goal is a “regulator-ready” package: you can show what model you ran, how you set thresholds, what happened to borderline users, and how you handled biometric data.

• Model version evidence: obtain NIST results for the exact model version you deploy, not a general vendor brochure.
• Thresholds, documented: set and record the challenge age and the rationale, with separate approval limits for overall error, subgroup variance and scenario robustness.
• Fallback path: escalate every borderline user to a document or database check rather than passing or refusing on the estimate alone.
• Bias monitoring: track outcomes by subgroup in production, because lab results do not guarantee field performance.
• Liveness: pair estimation with anti-spoofing tested against injection and deepfake attacks.
• Data protection: handle facial images as biometric data — obtain consent, minimise retention, and document your legal basis.
• Audit trail: log decisions, exceptions and manual overrides so the process is reconstructable later.

Used this way, facial age estimation becomes a fast, low-friction first line that genuinely reduces underage access — while the layered checks behind it carry the weight when the estimate is uncertain.

Compliance note: this is operator-facing guidance, not legal advice. Age and identity checks exist to keep out minors and protect vulnerable players; every customer-facing deployment must pair them with 18+ (21+ where local law requires) messaging, responsible-gambling tools and self-exclusion. Rules, standards and fees cited are current as of October 2026 and change — verify against the regulator’s own published standards before you act.

18+ only. Gambling can be addictive — please play responsibly and only bet what you can afford to lose. If gambling is affecting you or someone you know, contact a local support service. This content is informational and never a guarantee of winnings.

Written and reviewed by the iGaming Expert Hub editorial team. Facts checked against primary sources; see the reference above.

← All articles