DSA Article 28 and age verification: what your platform needs to know

The regulatory problem

What Article 28 actually requires

Article 28(1) of the DSA requires online platforms accessible to minors to implement appropriate and proportionate measures to ensure a high level of privacy, safety, and protection for minors. The regulation does not specify a concrete mechanism — and for a time this generated real uncertainty about what constituted compliance.

That uncertainty was significantly reduced on 14 July 2025, when the European Commission published its guidelines on the application of Article 28(1). While not legally binding, the guidelines serve as the reference standard that authorities — the Digital Services Coordinators in each Member State — use to assess whether a platform is compliant.

The guidelines distinguish three levels of mechanisms:

• Self-declaration — the user simply states their age. The guidelines consider this insufficient on its own for high-risk content.
• Age estimation — methods based on indirect signals (behaviour, facial biometrics estimation). The guidelines permit this as a temporary alternative, for a transitional period not exceeding 12 months, in contexts where full verification is appropriate.
• Age verification — solutions that rely on verified and trusted sources to establish age with a high degree of certainty. This is the level required for access to high-risk content: pornography, gambling, alcohol, tobacco.

Why this is no longer theoretical

DSA enforcement in this area is active. In 2026, the European Commission has opened proceedings against platforms such as Meta and Snapchat for failing to prevent access by under-13s, specifically noting that self-declaration and estimation methods were insufficient. Penalties for non-compliance with the DSA can reach 6% of the company's global annual turnover.

Several Member States are also accelerating the rollout of national age verification solutions ahead of the end of 2026 — Denmark has already launched its national digital identity app with an integrated age verification credential; Spain, France, Italy, Greece, Cyprus, and Ireland are in similar pilot rollout phases.

The tension with GDPR and how it's resolved

The problem any compliance officer spots immediately

Verifying a user's age appears, at first glance, to involve processing personal data. This creates direct tension with the data minimisation principle in GDPR (Article 5.1.f) — and indeed, Article 28(3) of the DSA is explicit on this point:

platforms are not required to process additional personal data solely to determine whether a user is a minor

The Commission's guidelines resolve this tension by explicitly recommending unlinkable verification solutions — mechanisms where the user can prove they meet an age threshold without disclosing any other personal data, not even their exact date of birth.

The technical standard that makes it possible

This is exactly what the EU Age Verification Blueprint resolves, the reference specification developed by the European Commission. Through verifiable credentials with selective attribute disclosure, a user can prove they meet the age threshold without the platform receiving their name, date of birth, or any personal identifier.

The result for the platform is a boolean: age_over_18: true or false. Nothing more. (The standard also contemplates the progressive incorporation of zero-knowledge proofs as an additional cryptographic mechanism in future iterations, further reinforcing this privacy guarantee.)

What evidence remains to demonstrate compliance

A common question from legal teams: if the system doesn't identify the user, what evidence remains to demonstrate to a Digital Services Coordinator that the control was actually applied?

The answer is process evidence, not identity evidence:

• A technical record that the verification was executed correctly, with a timestamp
• Confirmation that the credential presented was issued by an authority recognised on the European trust list in force at the time
• Aggregate service availability data — that the control was active continuously

This is sufficient to reconstruct, in an audit, that the verification mechanism was functioning and applied at the time of access — without any record ever existing that links that verification to the identity of a specific person.

The association between that technical record and a specific user or account, if the platform needs it for its own purposes (for example, to resolve a specific user's complaint), is managed within the platform's own systems — under its own legal basis for processing — never in the verification system.

How a third-party verification service fits in

Implementing this internally requires deep knowledge of protocols such as OpenID for Verifiable Presentations (OID4VP), management of issuer trust lists, and continuous maintenance as the standard evolves — it is actively evolving as the European ecosystem matures through 2026.

A specialist service allows the platform to comply with Article 28 without taking on that technical complexity, while maintaining at all times the unlinkability architecture required by the regulatory framework.

This is exactly what espuni does: an age verification layer built on the EU Age Verification Blueprint, where the result the platform receives is only the age boolean — never a piece of data that could identify the user.