Age verification requirements are turning into mandates around the world. The core issue has shifted from whether services confirm age to how they handle collected facial data and whether collection is necessary.

By Ricardo Amper, Founder and CEO, Incode Technologies

Over 30 age assurance statutes are active globally. The UK is rolling out the Online Safety Act's strict age check rules, including limits on under-16 social media access set for spring 2027.

Australia's under-16 restrictions began in December, with plans to raise maximum penalties to $99 million following initial compliance shortfalls. Brazil's Digital ECA rules started enforcement in March 2026, and half of U.S. states now require some age verification process.

Facial age estimation stands out as a practical compliance tool. It avoids government IDs and database queries, making it suitable for all ages, even those lacking documents.

In regulated regions, Incode data indicates users select it eight times out of ten compared to alternatives. Yet it requires sharing a face, something many prefer to keep private. Prior solutions typically captured the face, transmitted it to a server, and processed the estimate remotely.

Drawbacks of server-based age estimation

Records highlight rising risks, particularly for vendors using external technology. The Identity Theft Resource Center's 2025 Annual Data Breach Report noted 3,322 U.S. data compromises last year, a record and 79 percent rise over five years, with supply-chain incidents doubling in that span.

The same report showed 63 percent of consumers voicing strong worries about biometric data handling.

Attacks are accelerating beyond protections. Across more than 7 billion identity checks on its platform, Incode observed growth in agentic fraud using AI tools.

In 2024, agentic fraud accounted for 3 percent of attempts. By the first quarter of 2026 it hit 40 percent, and Incode projects it will surpass 90 percent in the next 18 months.

Privacy through policy versus architecture

The common response has been a privacy policy promising careful handling and deletion of biometric data post-check.

A policy remains a legal text, not a technical safeguard. It cannot prevent breaches, insider threats, or vendor compromises and only assigns blame after incidents.

Privacy by architecture takes another path: design the system so sensitive data never becomes exposed. Without transmission, interception is impossible.

Without storage, breaches cannot occur. Users need not rely on assurances. Privacy becomes an inherent system property rather than a pledge.

A $100 million pledge, split in two

Last month Incode Technologies, a leader in AI-driven identity verification and fraud prevention, revealed a $100 million investment in privacy-focused identity systems plus its purchase of Identiq, which develops cryptographic tools for peer-to-peer fraud prevention.

The funding targets on-device processing, ongoing privacy technology research, and expanded engineering and global operations.

Two weeks afterward the initial product launched. On-Device Age Estimation, released in July, runs Incode's models entirely on the user's device for the first time.

Both efforts stem from founding principles: AI-led verification without human biometric access, local device processing, and fraud collaboration without data exposure.

Part one: age checks with the face remaining on device

On-Device Age Estimation executes two Incode models locally on phones, tablets, or laptops: facial age estimation and passive liveness detection to confirm a live person rather than photos, deepfakes, or replays. Analysis occurs on-device with no transmission or storage.

Only the result travels forward: whether the user meets the age threshold. If the check fails for any reason, an alternative method chosen by the platform is offered automatically.

Achieving this required model compression. Incode reduced both models to about one-tenth original size via knowledge distillation, training compact versions to match larger model outputs.

The smaller models run in standard browsers or apps across diverse devices without specialized hardware.

Local analysis means Incode and client platforms have no technical access to biometric or facial images. In short, the user proves age while the face stays local.

Why send anything to a server?

An easily bypassed age check protects no one. Device-only checks cannot fully prevent session tampering such as injected feeds or altered devices. Incode's server layer reviews session metadata including timing, device traits, and connection details to spot injections and tampering.

This metadata holds no facial or biometric content and serves only fraud detection and session integrity.

Absent these checks, minors could pose as adults and vice versa, rendering results useless for safety and compliance.

These protections draw from extensive experience. For over a decade Incode models have run in high-threat settings like banks, fintech, and healthcare facing daily deepfakes, injections, and replays.

Incode's security layer delivers 99 percent spoof detection across deepfakes, injections, replays, and physical spoofs, matching standards used by eight of the top ten U.S. banks, and has identified over 1 million face attacks on its platform in 2026.

On-Device Age Estimation is the first enterprise solution merging on-device estimation with these protections, potentially redefining global age verification standards.

Part two: collaborative fraud defense without data pooling

The second commitment tackles institutional fraud intelligence sharing. Fraudsters operate across boundaries while defenders often work in isolation with limited threat visibility.

Traditional pooling of customer data across firms solves one issue while worsening another. Central repositories become prime breach targets matching reported statistics.

Identiq spent nearly a decade and over $50 million creating patented privacy technology allowing fraud signal sharing without exposing customer data to third parties.

No central repositories. No data brokerage.

Integrated into Incode's platform, this is expected to cover billions of verifications yearly, adding network fraud insights.

"Every institution shared the same concern with us: how do we fight fraud together without giving up control of our customers' data," said Itay Levy, Co-Founder and CEO of Identiq.

"Identiq built the answer to that very question. As part of Incode, that answer is now available to every organization that deals with massive amounts of user data."

The standard is being set now

Pressure arrives from both sides: regulations expand while users demand stronger privacy protections. Regulators are determining which methods qualify as effective, setting standards in real time.

Incode enters this phase with established credentials: compliance spanning SOC 2 Type 2, ISO/IEC 27001, HIPAA Attestation of Compliance, FedRAMP Ready, the Age Check Certification Scheme, and the Kantara IAL2 Component Services Trust Mark; more than 7 billion trust checks processed; and a live product keeping faces on-device alongside fraud collaboration that avoids data pooling.

"We have always believed that privacy and fraud prevention are not a tradeoff, but part of the same problem, solved together or not at all," said Ricardo Amper, Founder and CEO of Incode.

"Age checks are becoming law around the world. Our job is to do what we can so that proving your age asks as little of the user as possible."

Explore Incode's On-Device Age Estimation

Discover how On-Device Age Estimation helps platforms satisfy age assurance rules while keeping the user's face on the device, and schedule a team walkthrough.

Sponsored and written by Incode.