Age estimation is software that estimates a person's age from a photo of their face, without finding out who the person is. It is used to keep children away from websites and apps that are meant for adults. It is one kind of age assurance, the general name for any way of checking a user's age online.
Many countries now require online services to check their users' ages. In the United Kingdom, the Online Safety Act requires pornography sites, and many social media and gaming services, to use strong age checks. Several US states and Australia have passed similar laws. Most age estimation is sold for these markets, so the example on this page is set in the United Kingdom.
Asking for an ID document would work, but it has costs. Many teenagers have no ID, and many adults do not want to upload a passport to a website. Every stored copy of an ID is also a privacy risk. Age estimation asks for one selfie instead. A model, trained on millions of faces of people whose ages were known, estimates the person's age. It does not compare the face with any database of people, so it cannot tell who the person is. The image is deleted as soon as the estimate is made. This design suits data protection laws, such as the UK's version of the GDPR, which limit what personal data a company may keep.
Imagine a 21-year-old in Manchester who wants to use the voice chat in an online game. The game allows voice chat only for adults. It asks for a selfie. First, a liveness check confirms that a live person is in front of the camera, not a photo of an adult. Then the model estimates her age as 23. The model's typical error is about two years. So the game sets a buffer: for a feature limited to people over 18, anyone estimated at 21 or over passes. She passes, and the selfie is deleted. A 16-year-old estimated at 17 would not pass. Someone estimated at 19 would be offered another method, such as an ID document checked by identity verification (IDV).
Age estimation is used by dating apps, by betting services built on sportsbook software, and by games platforms, including user-generated games platforms. In India, the DPDP Act requires a company to get verifiable consent from a parent before it processes the personal data of a child, meaning anyone under 18. This duty applies from 13 May 2027, under the DPDP Rules, 2025. So companies in India will also need ways to tell whether a user is a child.
Age estimation is different from age verification. Verification proves an exact date of birth from a document. Estimation gives a likely age from a face. That is enough when the only question is whether someone is clearly above an age limit.