Why your platform might need age verification (even if you're not an adult content site)

The assumption that gets compliance teams in trouble

When people hear "age verification," they think of adult content sites. That assumption is costing platforms time they don't have.

Article 28(1) of the Digital Services Act applies to any online platform "accessible to minors" — a category far broader than most teams initially assume. The European Commission's guidelines, published in July 2025, identify four scenarios where age verification specifically (not just age estimation, not self-declaration) is the expected standard:

Services restricted to 18+ by their nature — alcohol, tobacco, gambling. Services designed for an adult-only audience, even if not explicitly age-restricted by law — adult dating platforms are the Commission's own example. Services whose own terms and conditions already require a minimum age of 18. And high-risk services where less rigorous measures are considered insufficient.

That third category is the one teams miss most often. If your terms and conditions already state "you must be 18 or older to use this service" — and many platforms include this boilerplate without much thought — you've effectively self-identified as needing real verification, not just a checkbox.

Sectors that are in scope, whether they expected it or not

Gaming platforms with loot boxes, gambling-adjacent mechanics, or mature content ratings. Online betting and casino platforms — obviously in scope, often already regulated nationally but now facing an additional EU-level requirement. E-commerce platforms selling alcohol or tobacco, including marketplaces that merely list these products alongside others. Social platforms with minimum age requirements in their own ToS, regardless of their primary content category.

None of these are "adult content sites" in the colloquial sense. All of them fall under Article 28(1).

What "appropriate and proportionate" actually rules out

The guidelines are explicit on one point: self-declaration — a checkbox asking "are you over 18?" — does not meet the bar for high-risk services. It's considered insufficiently robust and easily circumvented by anyone, including minors.

Age estimation — software that infers age from behavioral or biometric signals — is acceptable, but only as a transitional measure, for a period the Commission caps at 12 months. It's a bridge, not a destination.

Age verification — confirming age through a verified, trusted source — is what the guidelines describe as appropriate for the scenarios above. And as of mid-2026, there's now an EU reference standard for exactly that: the EU Age Verification Blueprint, built by the European Commission specifically to give platforms a privacy-preserving way to verify age without collecting identity data.

The enforcement signal that changes the calculus

Until recently, this was largely theoretical for platforms outside the obvious high-risk categories. That changed in early 2026, when the Commission opened formal proceedings against Meta for insufficient age verification on Facebook and Instagram, and against Snapchat for similar gaps. Both cases centered on the same finding: self-declaration and estimation-based methods weren't enough.

Those investigations don't apply only to platforms the size of Meta. They signal how the Commission is interpreting "appropriate and proportionate" in practice — and that interpretation applies to every platform in scope, not just the largest ones. Fines under the DSA can reach 6% of global annual turnover.

Where this is heading

Five EU member states — Denmark, France, Greece, Italy and Spain — are already piloting national age verification apps built on the Commission's reference blueprint, with Cyprus and Ireland joining the rollout. Denmark's AltID became the first to list a credential issuer on the EU production Trusted List in June 2026 — meaning real, verifiable proof-of-age credentials are already circulating, not just in testing environments.

If your platform falls into any of the categories above, the question isn't really whether age verification applies to you. It's how soon you implement something that meets the standard the Commission has already defined — before enforcement, rather than after.