Implications of Age Assurance on Privacy and Data Protection: A Systematic Threat Model

In today’s digital world, children are encouraged to develop a significant part of their daily lives by online means. Age assurance solutions have become essential tools to ensure the protection of their fundamental rights. This is reflected in different regulatory frameworks, strategies, codes, and recommendations concerning children’s protection and a safer Internet. These solutions estimate or verify users’ ages, allowing for the establishment of age restrictions for content, services, and goods. However, the intersection of safety and privacy within this field poses significant challenges, not only for children but for all Internet users. This research explores the privacy and data protection implications of age assurance, analyzing existing solutions and proposing a comprehensive privacy threat model. The threat model developed in this paper can be widely applied to improve the design and implementation of current solutions, policy and guidelines formulation, and awareness initiatives about age assurance challenges. By balancing adequate age assurance with robust and compliant data protection, we can create a digital environment for everyone that guarantees the protection of fundamental rights.