Age Verification on registration

[Alpha1]

The current age restriction for XenForo is outdated and does not work. We need a reliable Age Verification system.
My suggestion is to implement integration with one or more Age Verification services

The EU writes about the current method:
Self-declaration: this most common of all methods has been shown to be easily bypassed by children. Examples include self-declaring one's date of birth. (see attached file for reference)
This is why I posted this related suggestion in the past: https://xenforo.com/community/threads/improve-minimum-age-function.87298/

New legislation in the UK has already caused XenForo sites to shutter or to announce shuttering. More in this thread here:

Thread 'UK Online Safety Regulations and impact on Forums'

Dec 17, 2024

The UK regulator OFCOM yesterday announced a set of regulations which will come into effect on 17th March 2025

Time for tech firms to act: UK online safety regulation comes into force

People in the UK will be better protected from illegal harms online, as tech firms are now legally required to start taking action to tackle criminal activity on their platforms, and make them safer by design.

www.ofcom.org.uk

These have broad implications for all forums which "have links to the UK" - including those which accept UK users.

I've not yet had the chance to read all the guidance, as there are thousands of pages of it in multiple volumes. From what I can see the key items are strong age verification and content scanning.

I've already seen some...

• lazy llama
• regulation
• Replies: 1,847
• Forum: Forum management

• 
• 
• 

Hamster forum and local residents’ websites shut down by new internet laws

Scope and scale of Online Safety Act likened to China’s ‘great firewall’ as small websites struggle to comply

www.telegraph.co.uk

My suggestion is to implement integration with one or more Age Verification services. Some considerations for choosing Age Verification services are:

• Cost: It can quickly become costly if the webmaster will have to pay a significant amount per signup.
• Ease of use: Age Verification should not be too obstructive in the registration process.

Here are some possible Age Gate services:

AgeVerify - Website Age Verification - AgeVerify

AgeVerify is a free website age checker, pop up splash entry page & age verification pop-up script that easily integrates in to your existing website with a single line of code.

ageverify.com

Google 0auth may have something:

Access age-restricted content & features - Google Account Help

Some content and services are subject to age requirements. To access age-restricted content or services, we may ask you to confirm your age. Laws in certain regions may require app stores to verify u

support.google.com

Age and identity verification

Explore Verifymy's safeguarding solutions for online platforms, ensuring trust and compliance with age and identity verification.

verifymy.io

Building the world's trusted identity platform • Yoti

Our comprehensive suite of customer verification tools make it easy for businesses to be compliant and safe for people to prove who they are.

www.yoti.com

There are also payment services that allow the user to verify their age by payment. i.e. paid registration.

Some more options here:

Best 9 Age Verification Solutions for Business (2026)

Find the top age verification solutions for 2026. Reviewed for identity validation accuracy, compliance with age-restriction regulations, and integration ease to control access to restricted content.

expertinsights.com

I think that adding such integrations would help some webmasters keeping their websites online and avoid shutting them down.

 

[zappaDPJ]

Secondly the act only applies if you have a significant number of UK users. What significant means is open to debate.

My understanding, which I've yet be able to verify with OFCOM is the onus lies with the site owner to justify why they do not consider their UK user base to be significant.

I assume it's intentionally wooly because no one really knew quite what they meant when they wrote it.

So yeah, pretty much that.

 

[Facula]

Thank you very much for the timely and well thought out answers!

 

[Alvin63]

What I want to know is if I operate a forum in the US, but anyone can join, and someone joins from the UK, does that by default mean that I have to comply with US OSA?

I mean, that's just BS.

I think you have to have a "significant number" of Uk members to be expected to comply with the OSA. What some US forums do is just block the Uk!

 

[Mendalla]

I had a UK member but he has not been around recently. Probably got tired of the current waning state of the site. In fact, I don't have any members outside Canada who are active right now. We used to have an Aussie and a couple Americans but none are around anymore. So I am not really fretting about any laws other than my own country's.

 

[Eris Greyrat]

The current age restriction for XenForo is outdated and does not work. We need a reliable Age Verification system.
My suggestion is to implement integration with one or more Age Verification services

The EU writes about the current method:
Self-declaration: this most common of all methods has been shown to be easily bypassed by children. Examples include self-declaring one's date of birth. (see attached file for reference)
This is why I posted this related suggestion in the past: https://xenforo.com/community/threads/improve-minimum-age-function.87298/

New legislation in the UK has already caused XenForo sites to shutter or to announce shuttering. More in this thread here:

Thread 'UK Online Safety Regulations and impact on Forums'

Dec 17, 2024

The UK regulator OFCOM yesterday announced a set of regulations which will come into effect on 17th March 2025

Time for tech firms to act: UK online safety regulation comes into force

People in the UK will be better protected from illegal harms online, as tech firms are now legally required to start taking action to tackle criminal activity on their platforms, and make them safer by design.

www.ofcom.org.uk

These have broad implications for all forums which "have links to the UK" - including those which accept UK users.

I've not yet had the chance to read all the guidance, as there are thousands of pages of it in multiple volumes. From what I can see the key items are strong age verification and content scanning.

I've already seen some...

• lazy llama
• regulation
• Replies: 1,847
• Forum: Forum management

• 
• 
• 

Hamster forum and local residents’ websites shut down by new internet laws

Scope and scale of Online Safety Act likened to China’s ‘great firewall’ as small websites struggle to comply

www.telegraph.co.uk

My suggestion is to implement integration with one or more Age Verification services. Some considerations for choosing Age Verification services are:

• Cost: It can quickly become costly if the webmaster will have to pay a significant amount per signup.
• Ease of use: Age Verification should not be too obstructive in the registration process.

Here are some possible Age Gate services:

AgeVerify - Website Age Verification - AgeVerify

AgeVerify is a free website age checker, pop up splash entry page & age verification pop-up script that easily integrates in to your existing website with a single line of code.

ageverify.com

Google 0auth may have something:

Access age-restricted content & features - Google Account Help

Some content and services are subject to age requirements. To access age-restricted content or services, we may ask you to confirm your age. Laws in certain regions may require app stores to verify u

support.google.com

Age and identity verification

Explore Verifymy's safeguarding solutions for online platforms, ensuring trust and compliance with age and identity verification.

verifymy.io

Building the world's trusted identity platform • Yoti

Our comprehensive suite of customer verification tools make it easy for businesses to be compliant and safe for people to prove who they are.

www.yoti.com

There are also payment services that allow the user to verify their age by payment. i.e. paid registration.

Some more options here:

Best 9 Age Verification Solutions for Business (2026)

Find the top age verification solutions for 2026. Reviewed for identity validation accuracy, compliance with age-restriction regulations, and integration ease to control access to restricted content.

expertinsights.com

I think that adding such integrations would help some webmasters keeping their websites online and avoid shutting them down.

This is worse from 1984 predicted because it doesn't protect children, but they just control everything, and store your data, also a hacker will attack and breach data.

I will just block the UK country on my site if the UK government decides to threaten my site.

 

[RobinHood]

Isn't the ultimate and most practical goal (even if I don't agree it would be the best in practice) is that the big OS providers will end up providing their own age verification systems systems on the OS level to pre-approve visitors for visiting sites? It seems the way the iOS is going, and I'm sure MS will follow, not sure about Linux.

 

[Eris Greyrat]

Isn't the ultimate and most practical goal (even if I don't agree it would be the best in practice) is that the big OS providers will end up providing their own age verification systems systems on the OS level to pre-approve visitors for visiting sites? It seems the way the iOS is going, and I'm sure MS will follow, not sure about Linux.

If they do, then it will have heavy backlash serious and everyone will never do verify age verification. If Microsoft keeps doing crap. Everyone will find a way to bypass or switch to third party windows OS / Linux OS than a official OS

 

[zappaDPJ]

If they do, then it will have heavy backlash serious and everyone will never do verify age verification.

What about if the OS comes with a passcode option that allows the parent or guardian to set permissions on a phone? That would end the need for age verification.

 

[Eris Greyrat]

What about if the OS comes with a passcode option that allows the parent or guardian to set permissions on a phone? That would end the need for age verification.

Parental controls with a passcode already exist on iOS, Android, and PC, and they help when parents actually set them up. Why would the government have to control for verifying age verification, and your data will be sent to a datacenter and get breached, and it's over. A parent has to do a job and control kids, not a government job to control everyone

 

[zappaDPJ]

Parental controls with a passcode already exist on iOS, Android, and PC, and they help when parents actually set them up.

Well that's something new I didn't know, I had no idea you could do that already.

A parent has to do a job and control kids, not a government job to control everyone

I agree, 100%.

 

[Suzanne O]

Parental controls with a passcode already exist on iOS, Android, and PC, and they help when parents actually set them up. Why would the government have to control for verifying age verification, and your data will be sent to a datacenter and get breached, and it's over. A parent has to do a job and control kids, not a government job to control everyone

The reason why the Government are doing the parenting so to speak is because your kids are finding things online that are fun to do.
The things that are fun to do are games such Roblox for example that has some not so nice people running their chat program that causes your kids to go do things that they'd never do if you were keeping a better eye on what they would be doing.
You go on facebook and half the time it's a battle with some creepy dudes who are either after your kids or after yourself or who are some porn bot that wants to post up their disgusting photos of themselves that you don't want your kids to see.

That's not your kids getting information online for their projects they're doing for school.

 

[frm]

This is likely to affect Big Tech, first and foremost.

The question I have is: Wouldn't the simplest solution be connected accounts?


Move everyone who doesn't have a connected account to a lesser group, then move everyone who has a connected account to the new "Registered" group.


It seems like this is a non-issue if you can convince people to connect an account, possibly updating the connected account API to request the age range (unsure what data is requested by default).

Apple provides the Declared Age Range API under Swift's DeclaredAgeRange framework to help developers implement privacy-preserving age checks. Instead of exposing a user's exact birthdate, the API provides an age bracket signal (e.g., under 13, 13–15, 16–17, or adult) based on device-level and App Store data.

Accessing User Age Data
Developers use the Meta Graph API to request specific age data after a user logs in via Facebook Login.
Age Range Field: You can query the age_range field under the public profile endpoint. This does not require special permissions. It returns predefined brackets such as 13–17, 18–20, or 21+.

Then, your fallback for any request is that all users are age verified based on their [social media] profile.

It could even be an add on that doesn't necessarily "connect" an account, but merely does an age verification check on sign up using existing APIs. Some form of storage on what they processed on sign up for an internal check if ever asked how a specific account was age verified.

 

[zeeb0t]

So far as I can find, Didit seems like a viable option, probably for most forums - e.g., 500 free ID verification per month, so really only starts to cost money when you have in excess of this many registrations per month. It would likely also effectively stop spam bot registrations from ever being able to post, so that's nice.

An add-on would still be needed, to integrate the front and back of house integration, and enforce the minimum age verification and user group policies, and so on.

If this is something people think is needed, I could build the add-on for you all. I don't mind building it, as a free add-on.

 

[RobinHood]

They're using AML databases and checking bank accounts...not exactly unintrusive. They're also raising a lot of money, so I wouldn't be surprised if costs go up. In the end it feels like what the governments will end up using, acquiring or doing something similar. In the end, the anonymity and privacy of users will still be eroded and gone, especially for people that just want to join hobby communities to chat, interact and be social.

Didit Raises $7.5M Seed, Infrastructure for Identity Fraud

Didit raised $7.5M total to build the infrastructure for identity and fraud, one API for KYC, KYB, transaction monitoring and wallet screening.

didit.me

 

[RobinHood]

If they do, then it will have heavy backlash serious and everyone will never do verify age verification.

Except they will, because they'll have no choice.

There's been backlash for chat control...that's still passing and moving forward, all these new systems to monitor all our communications are moving full tilt ahead and there's very little the average person can do about it as governments want full access to know what everyone is doing online.

 

[chillibear]

So far as I can find, Didit seems like a viable option, probably for most forums - e.g., 500 free ID verification per month, so really only starts to cost money when you have in excess of this many registrations per month. It would likely also effectively stop spam bot registrations from ever being able to post, so that's nice.

We went through quite a few of the various provider options in the original Online Safety Act (OSA) thread https://xenforo.com/community/threads/uk-online-safety-regulations-and-impact-on-forums.227661/ (92 pages) and some of the pros/cons of them. Mostly the cons were: Retention of user data; excessive user data; cost. A lot of providers have a 'X tokens for Y currency' model which doesn't really work for small forums. I opted for my own provider because whilst they charged more they did genuinely charge per age verification. There are now more providers and more aggregation services on the market. There are of course still plenty of privacy concerns and whatnot attached to all that, not to mention systems that work world-wide, etc.

There were one or two tools written and some discussion about add-ons, at least one was built. My own solution was written to run alongside xenforo since PHP isn't really my thing these days. A generic add-on that could integrate with multiple providers would of course be lovely! I was just putting users into groups myself, then providing restrictions based on those groups. That stuck me as the most generic approach.

There isn't a requirement in the OSA for age verification unless you're running a pr0n site basically. However it's one of those where you get stuck with how you prove your site doesn't have child users and the consequences of having child users. So age verification is one "solution" to that.

 

[Suzanne O]

Half your forum's population are kids who love to post there.
Both Australia and the UK have put up an u16's ban on social media and forum usage.
If you put your own age verification and ruling to help protect those kids from being in harms way you could effectively have a family username that takes on the oldest member's identity and age until the youngest turns 17.
As i mentioned earlier set it up like you do with tv ratings as a guideline.
Then have it as a rule that links to the law you're country is running with.