Age assurance mechanisms in digital environments: technical options, legal limits and proportionality criteria

Abstract

Age assurance in digital environments has become a central issue in contemporary regulation, particularly considering the need to protect children and adolescents from inappropriate or prohibited content, products and services without overlooking the impact of such measures on privacy, personal data protection, inclusion and non-discrimination. Drawing on guidance issued by Brazil’s data protection authority, the Agência Nacional de Proteção de Dados (“ANPD”), the regulatory framework surrounding the Brazilian Digital Child and Adolescent Statute, and recent European regulatory and institutional references, this article examines the main mechanisms currently available, organizing them into categories and analyzing their functioning, advantages, and limitations. Based on this framework, the article argues that the legal legitimacy of such mechanisms does not derive solely from their technical capacity to verify age, but also from their regulatory purpose, practical effectiveness and compatibility with principles such as data minimization, purpose limitation, security, inclusion and proportionality. It concludes that there is no universally superior solution in the abstract and that the choice of mechanism should be guided by the specific risk posed by the service and by the pursuit of solutions capable of proving only the necessary age-related attribute, with the lowest possible level of intrusion upon users’ rights.