Age Verification

Age verification is the process of confirming that a person meets a specific age threshold, most commonly the legal age to buy alcohol or tobacco, enter an age-restricted venue, or use a regulated online service, before letting a transaction or access decision proceed. In its simplest, oldest form it's a clerk glancing at a photo ID and doing arithmetic. In its modern, digital form, it's a document check, a database lookup, an AI-driven facial age estimate, or some combination of those.

The workflow pain that makes age verification interesting as a technology problem, not just a policy question, is that the honest legal requirement is almost always narrower than what gets collected to satisfy it. The law typically requires proof of age (a yes/no answer to "is this person over N") not proof of identity. But the common ways of satisfying that requirement (scanning and storing a full ID, or asking for a name and birthdate) collect far more personal data than the question actually needs, turning every checkout into a data-retention liability for a binary fact. "Click yes, I'm 18" gates avoid the data problem by proving nothing at all.

Who actually built this

There is no single body that invented age verification, age-of-majority thresholds are ancient legal concepts, and requiring a document check to enforce them at the point of sale is standard, decades-old retail compliance practice enforced by whichever regulator governs the age-restricted good or service in a given market (alcohol and tobacco regulators, gaming and betting commissions, and, increasingly, online-safety regulators, see Age Assurance for that more recent, broader regulatory framing). What's newer is the cryptographic technique some systems, including Solidus's, use to answer an age question without disclosing the underlying birthdate: BBS+ signatures and SD-JWT VC, both specified and implemented by cryptography and standards communities Solidus did not originate.

Solidus today

Solidus computes an age_over_18 (and age_over_21) boolean claim once, at the moment a document-backed credential is issued, from the holder's verified birthdate. At presentation time, the holder can selectively disclose just that boolean, via BBS+ or SD-JWT VC selective disclosure, without revealing the birthdate, name, or any other field on the credential. This is real, tested code, running on Solidus's public testnet today.

It is important not to overstate what kind of proof this is. It is disclosure of a precomputed value, not a zero-knowledge proof evaluated over a hidden one, the distinction matters, and Solidus's own Predicate Proof entry documents it plainly: a true hidden-value predicate proof (prove "age ≥ 18" without any party ever computing or storing that boolean) is specified in Solidus's protocol design but has never been built. What ships today is a real, meaningful reduction in data exposure compared to handing over an ID, but it is not the strongest cryptographic guarantee the word "predicate" sometimes implies, and BBS+ itself remains unaudited. No retail, delivery, or venue integration exists with a paying customer; every applied use case described in Solidus's vertical strategy is a sales concept, not a shipped deployment.

See also

Age Assurance is the broader regulatory umbrella this sits inside, especially in online-safety contexts. Predicate Proof and Selective Disclosure are the precise cryptographic mechanisms, and their honest limits, behind Solidus's age-check claim. Level of Assurance governs how strong the underlying identity check needs to be before an age claim built on it can be trusted.