 access age-restricted content and services, or to remotely order age-restricted goods. 1 Although the debate on the desirability and feasibility of online age verifications mostly raged in the late 90s and at the start of the millennium, 2 the discussion has made a remarkable comeback due to three major recent developments.
First, the United Kingdom in 2016 introduced an amendment to its Digital Economy Act that obliged anyone making 'pornographic material available on the internet to persons in the UK on a commercial basis' to carry out age verifications of their users and block anyone under 18 years. Although the policy has now been abandoned due to ongoing controversies and a lack of legal clarity, heavy financial penalties and the blocking of access to the material in question were foreseen. 3 A second major development was the massive public backlash erupting in 2017 towards 'loot boxes' in the video game industry. The specialised gaming press already compared these randomised in-game purchases to gambling, 4 but the release of blockbuster Star Wars Battlefront 2 saw the controversy spill over into mainstream media. 5 One of the most interesting reactions came from the UK Gambling Commission, which suggests that a system of age verification should be installed in situations where video games would cross the line into gambling, 6 similar to online gambling sites. 7 The resurgence of interest in AV mechanisms coincides with a third major development: the European Union's legal reform of its personal data protection framework. The General Data Protection Regulation (GDPR) entered into force on 25 May 2018, reaffirming certain data protection principles of its 1995 predecessor, but also introducing novelties such as the acknowledgement that children merit specific protection with regard to their personal data. Although the GDPR nowhere explicitly mentions age verification measures, article 8 stipulates that if a data controller 8 relies on consent as a ground of processing (under article 6, 1 (a)) when offering an information society service 9 directly to children younger than 16, 10'such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child'. Since the Article 29 Working Party (the former authoritative advisory body on EU personal data protection) indicated that consent given by an underage child renders the processed data unlawful, 11 data controllers have a strong incentive to verify users' ages. 12 As will be demonstrated, however, current AV practices are sorely lacking in accuracy and efficiency (section II). The need thus imposes itself to consider alternative, innovative AV proposals, although these too can have important drawbacks -in particular with regard to personal data protection principles (section III).

II. Current Age Verification Procedures are Inadequate
While research shows that the online gambling industry has been largely successful in blocking minors from gambling, 13 other sectors have long-since struggled in determining an effective, standardised approach to online age checks: a questionnaire of e-commerce enterprises in the UK found that no less than 79% of them were concerned that their existing verification procedures still allowed age-restricted goods to be sold to minors. 14 Legal uncertainty abound, certainly since the UK Chartered Trading Standards Institute indicated that there is no widespread consensus on the technical and procedural aspects of AV mechanisms. 15 Individual websites and services have hence attempted to create their own age verification procedures. An analysis of several websites and their procedures allows us to construct a typology of five age verification methods that are currently widely em-Emerging Tech for Online Age Verifications ployed. While no measure can be considered completely immune to errors or fraud, it is possible to make a distinction between'soft' and 'hard' AV measures based on the effort for minors to circumvent or deceive the system. 16 The methods have been ordered accordingly, from'softest' (being the easiest to deceive) to 'hardest' (being the most difficult to circumvent): 1. self-certification, such as tick boxes, age affirmation pages (AAPs), and age disclaimers; 2. reliance on e-payment services by performing a small transaction; 3. reliance on credit cards, such as verifying the card information or performing a small transaction; 4. use of data aggregation services; 5. identity document scanning and eID systems (the electronic identification card of citizens).
The five identified methods will be briefly discussed regarding their respective weaknesses and strengths.

Self-Certification
Self-certification asks users to verify themselves that they are above a certain minimum age by ticking a box or writing their date of birth before entering a website or creating an account. Age disclaimers simply state (usually in a banner on a webpage) that the host considers anyone accessing the content and / or services to be the required minimum age. These methods are incredibly easy to bypass and do not carry out an age'verification' in any way. Even in the case that a minor would answer truthfully and cookies remember to bar entry to the user, session cookies are simply undone when the browser is closed and more advanced cookies can be circumvented through incognito browsers or by adjusting browsers' cookie settings.

Reliance on E-Payment Services
This method grants users access on the condition that they perform a small transaction (for example of 0.01 euros) through an e-payment service. This too fails to carry out an actual verification of the user's age since merely having or using such an account is not per se proof of adulthood: many e-payment services (including the popular Paypal and Worldpay) can be linked to debit cards, which are also available to minors.

Reliance on Credit Cards
Some sites seek to verify a user's credit card information, or ask that a small credit card transaction is performed. Although this might seem similar to the second method of relying on e-payments, credit cards form part of a strictly regulated system. Because of the stringent financial and administrative conditions imposed -one of them being that minors cannot request credit cards in most jurisdictions -it is a much more reliable way to distinguish between adults and minors.
That is not to say no flaws exist. There are many examples of youngsters using the credit card of their parents without consent. 17 Although any potential transactions will afterwards show up on the adult's credit statement, the child will usually have gained access to the age-restricted matter by the time the misuse is discovered. Additionally, it is possible to add children as an 'authorised user' to an adult's card, circumventing the AV measure entirely. However, this last situation highlights the role of parents in evaluating whether or not their child can be trusted with the responsibilities that come with a credit card.
Moreover, the binary results of credit card verifications raises another problem: adults without credit cards have no way to prove their age and are thus unjustly excluded. 18 Studies have shown that about 75.7 percent of American consumers possess at least one credit card, 19 meaning that over 20 percent of the adult American population would be denied ac-

Use of Data Aggregation Services
A similar scenario unfolds when companies rely on data agencies to collect and compile information from publicly available datasets such as credit history, driving license databases or electoral history. 20 Here too, some adults are unjustly denied access, for example because they have never applied for credit and do not possess a driving license. One source states that this process would leave around 15% of the UK's adult population unidentified. 21 An additional shared flaw between methods three and four due to their binary outcomes is that they do not allow for any distinctions between internet users under 18. Minors cannot apply for credit, nor possess electoral information; methods three and four can therefore only conclude whether a user is an adult or not, rendering these methods useless for goods or services that have different age ratings than 18+, such as 16+ or 12+.

Identity Document Scanning and the Use of eIDs
The fifth method (respectively sending scans of identity documents and making use of citizens' electronic identification cards (eIDs)) are the only ones resistant to the aforementioned problems. Adults are not unjustly excluded, and precise distinctions among minors are possible (on the uncertain condition that minors receive identity documents; see below). Although there is always the possibility that individuals commit fraud with identity documents, the heavy penalties on identity fraud 22 should act as a deterrent, while verifying the submitted information within a government database provides a strong safeguard. Method five is thrus provides two reliable ways of determining an individual's age. Nevertheless, there are drawbacks. The scanning and sending of identity documents (method 5) over unsecured lines opens the door for identity theft by third parties. While using eIDs (method 6) proves much safer in that regard, their use from consumers' homes would necessitate several crucial elements: a widespread dissemination of eID card readers to cit-izens, the presence of a governmental infrastructure that allows a smooth interface between state administration back-ends and consumer-friendly front ends, a high level of cybersecurity, and the granting of identity documents to minors to allow for the age ranges under 18. Additionally, several jurisdictions (most notably the UK and the US) do not have the tradition of using identification documents that continental Europe has, further calling into question the large-scale feasibility of methods five and six.
Nevertheless, there are methods currently available to successfully conduct AV procedures. The British Standards Institution (BSI) has helped to develop PAS [Publicly Available Specification] 1296:2018, a code of practice to assist providers of age-restricted goods and services. The code is innovative in that it focuses on eligibility and vectors of trust, and although an extensive analysis would lead us too far here, its approach is well-considered and displays respect for personal data protection principles. Importantly, however, it does not advise on the practical implementation of an actual age checking system, let alone how to incorporate existing age check exchange programs into a corporate infrastructure -meaning that smaller business will find it difficult to translate the theoretical advice offered in the code to actual compliance.

III. An Emerging Market of Innovative Ideas