Age verification, EUDI Wallet & espuni — FAQ

DSA Article 28 requires online platforms accessible to minors to put in place appropriate and proportionate measures to ensure a high level of privacy, safety and security for children. It does not name a specific technology, but for platforms offering age-restricted goods or content, age verification is one of the measures regulators expect. Fines can reach up to 6% of global annual turnover.

Any platform offering access to age-restricted products or content to EU users — this includes online alcohol and tobacco sales, gambling, adult content, and platforms whose own terms require users to be 18+. It is not limited to adult content sites: e-commerce, gaming with loot boxes, and general platforms under the DSA can all fall in scope.

The EU Age Verification Blueprint is the European Commission's technical specification for privacy-preserving age verification, published at ageverification.dev. It defines how a platform can verify a user's age using EUDI Wallet-based credentials without learning the user's identity, date of birth, or any persistent identifier.

No. Under the EU Age Verification Blueprint, the platform receives only a yes/no answer to whether the user is over a requested age threshold. It does not receive the name, date of birth, document number, or any persistent identifier. This is explicitly designed to satisfy DSA Article 28(3), which states platforms are not required to process additional personal data solely to determine whether a user is a minor.

Under the Digital Services Act, fines can reach up to 6% of a provider's total worldwide annual turnover. Enforcement is active: the European Commission has opened proceedings against major platforms over minor protection.

Not necessarily — it can improve it. In the UK market, a reported case study saw a 50% reduction in cancellations of orders containing age-restricted products after adding verification, with most customers verified without friction. Privacy-preserving age verification returns a simple yes/no, so it can run with minimal disruption to the customer journey. (Source: UK Government Digital Identity Sectoral Analysis Report 2026, DSIT — UK market under the Online Safety Act.)

Age verification is one of the fastest-growing segments of the digital identity sector. In the UK, the share of providers offering age assurance rose from 23% to 31% in a single year, and age verification as a use case doubled, driven by the Online Safety Act. In the EU, DSA Article 28 and the EUDI Wallet rollout are expected to drive comparable demand. (Source: UK Government Digital Identity Sectoral Analysis Report 2026, DSIT.)

The European Commission's Age Verification Use Case Manual puts the current cost of traditional per-transaction age verification at 1–5 euros. Wallet-based verification changes that economics fundamentally: because the check is a cryptographic signature validation rather than a manual or document-based process, the marginal cost per verification drops to cents. espuni's usage-based pricing reflects this.

The European Commission estimates that millions of people will use age verification through EUDI Wallets to access online services, purchase age-restricted goods, and enter age-restricted venues. The online gambling sector alone counts 23 million regular players in the EU. With DSA Article 28 enforcement active and national wallets rolling out through 2026, wallet-based age verification is positioned to become the default mechanism across the EU.

It already is, in part. Denmark's AltID launched in production in June 2026 as the first age verification credential issuer on the EU's production Trusted List. The European Commission announced the EU age verification app as technically ready in April 2026, with distribution in pilot member states over summer 2026 and native integration into national wallets expected by late 2026. Seven front-runner member states — Denmark, France, Spain, Italy, Greece, Cyprus and Ireland — are integrating age verification into their national wallets.

The platform (acting as a verifier or relying party) sends a presentation request to the user's EUDI Wallet asking for a specific age attribute, for example age_over_18. The wallet, with the user's consent, returns a signed presentation containing only that boolean. The verifier checks the issuer's signature against a public trusted list — no contact with the issuer is needed.

OpenID for Verifiable Presentations (OID4VP) is the OpenID Foundation protocol used to request and receive credentials over the internet. For age verification, the EU defines a specific Age Verification Profile (AVP) on top of OID4VP that simplifies the flow for the age use case. It builds on OAuth 2.0 and typically delivers the presentation via a QR code or a same-device link.

HAIP (High Assurance Interoperability Profile) covers all credential types, requires the verifier to register and authenticate with a certificate, and mandates encrypted responses. AVP (Age Verification Profile) is limited to proof-of-age, does not require relying-party registration, and authenticates the verifier by URI. For age verification, AVP is the lower-friction path.

It uses the ISO/IEC 18013-5 mdoc (mobile document) format, encoded in CBOR, the same format used for mobile driving licences. Age attributes are presented via selective disclosure, so only the requested attribute — for example age_over_18 — is shared, and the rest of the credential stays hidden.

You can do either. Building in-house on open-source components like EUDIPLO is possible but carries ongoing maintenance cost as specifications evolve and each member state ships its own wallet. A managed service handles the protocol, trusted-list management, and wallet compatibility so the integration stays a single API rather than a permanent engineering commitment.

EUDIPLO is an open-source middleware from the OpenWallet Foundation (Apache 2.0 licensed) that implements EUDI Wallet issuance and verification protocols. It provides the protocol engine for interacting with EUDI Wallets, but a production deployment still needs integration, trusted-list handling, wallet testing, and ongoing maintenance around it.

A Trusted List is a signed registry of authorised credential issuers, published by the EU. A verifier uses it to confirm that a presented age credential was issued by a recognised authority. The EU publishes a dedicated Age Verification Trusted List for both test and production environments.

AltID is Denmark's digital identity wallet, launched in June 2026 by the Danish Agency for Digital Government. It is the first age verification credential issuer on the EU's production Trusted List. It issues two credentials: a proof of identity (PID) and a proof of age.

No. Contrary to some press coverage, AltID did not launch with zero-knowledge proofs. It achieves unlinkability through single-use credentials issued in batches — each presentation consumes a different credential, so two verifiers never see the same one. ZKP is expected later, once the Commission finalises the specification.

AltID's proof-of-age credential contains nine thresholds: age_over_13, 15, 16, 18, 21, 23, 25, 27 and 67. The verifier requests one, and the user discloses only that one — a platform checking age_over_18 never learns whether the user is also over 21.

No. For proof-of-age requests, AltID does not require registration in its Relying Party Registry — the verifier is authenticated by URI under the Age Verification Profile. Registration is only required to request the identity credential (PID), not the proof of age.

AltID uses OID4VP following the EU Age Verification Profile for online age verification. It does not support the browser Digital Credentials API at launch. It also offers a bespoke offline "Signed QR" mechanism for in-person (proximity) scenarios.

Under the EUDI Wallet Architecture and Reference Framework, the issuing authority is not contacted when you present a credential, so it does not learn when or where the credential is used. Requirement WIAM_12a further requires that the wallet provider cannot access the wallet's contents. The privacy dashboard that records your presentations lives on your device and is for your own audit.

The registration regime applies to relying parties — the companies and services that want to request your attributes. They register in their member state and declare which data they intend to request and under what legal basis. Citizens do not register to use their wallet.

At the credential layer, yes: designs like single-use credential batches ensure two verifiers cannot correlate presentations through a shared identifier. This does not by itself address correlation at the network layer (for example IP address in remote flows), which is a separate problem that credential design alone does not solve.

The EU Age Verification Solution is designed around zero-knowledge proofs, and the official portal presents ZKP as its core privacy mechanism. In practice, the first production issuer — AltID in Denmark — launched without ZKP, achieving unlinkability through batches of single-use credentials instead. Both approaches satisfy the specification's privacy requirements. ZKP-based verification is expected to arrive as the specification and national implementations mature.

No. espuni processes an age verification and returns a boolean result plus an opaque session identifier and timestamp. It does not store end-user identifiers or personal attributes. The platform links the result to its own user in its own system, under its own legal basis.

espuni is an Age Verification-as-a-Service platform for online platforms that need to meet DSA Article 28 obligations. It provides EUDI Wallet-based age verification through a single API, built on the open-source EUDIPLO middleware and aligned with the EU Age Verification Blueprint.

espuni uses simple, usage-based pricing with a free tier to start. Billing is based on completed verifications; abandoned or expired sessions with no wallet response are not billed. Production pricing scales with volume — contact for a quote.

espuni is built on the EU Age Verification Blueprint and OID4VP, so it works with any blueprint-compliant EUDI Wallet. Compatibility with AltID (Denmark's production wallet) is verified at the specification level via the Age Verification Profile.

No. espuni is an independent commercial service built on open standards and the open-source EUDIPLO middleware. It is not affiliated with or endorsed by the European Commission or any government. All information it publishes is based on public sources.

Because espuni is built on the open-source EUDIPLO middleware (Apache 2.0), a client is not locked in: if espuni were to disappear, the underlying verification engine remains available and deployable. This is a deliberate reduction of supplier concentration risk compared with fully proprietary providers.