An app checking whether someone is an adult needs an answer to an age question. That does not necessarily mean it needs their name, address, birthday, or a copy of their passport. The evidence used to establish age and the information returned to the app are separate things. Separating them clarifies the purpose of a check and its privacy implications.
Online age-verification laws have brought those implications into everyday app use. In its October 2025 analysis of age-verification safeguards, the Center for Democracy & Technology describes identity uploads and facial scans appearing across online services following the UK’s Online Safety Act. Its recommendations focus on limiting collection, sharing, and retention, rather than assuming that completing a check settles the privacy question.
The concern about age checks drifting into surveillance extends beyond a single upload. In her September 2026 AlphaWire opinion, Roxana Nasoi argues for open, community-built alternatives that verify necessary attributes while preserving privacy. For apps, that directs attention to a design choice: whether the service receives proof of age eligibility or a fuller record that identifies the person behind it.
An age result and an identity document
A document used to establish age contains more than the answer an app needs. A passport or driver’s license includes identifying information alongside a date of birth. Sending the document to a service gives that recipient access to those additional details, even when the task is simply to establish adulthood.
There can also be more than one recipient. The app providing access and the organization examining age evidence may be separate. The first organization can receive an age result while another handles the underlying document. Describing the app as receiving “only an age result” therefore says something about that particular disclosure, not everything collected throughout the process.
CDT recommends tokenized age-proof systems where available, so the service receives an attested result instead of underlying documentation. An attestation is a claim backed by the organization that issued it. The distinction is between establishing age and passing the original evidence onward. A result can answer the app’s question without copying every field from the document.
Tokenized systems do not necessarily use zero-knowledge proofs. “Tokenized” describes how an attested result is passed between systems; “zero knowledge” describes what a verifier can learn from a proof. The labels therefore answer different questions about delivery and disclosure. A service returning a token has not, just by choosing that format, established that its checks cannot be linked.
What a zero-knowledge proof establishes
Zero-knowledge proofs supply one way to separate an age claim from the evidence behind it. In their August 2025 analysis of blockchain privacy, David Sverdlov and Aiden Slavin describe proofs that establish a fact without revealing the supporting details. They also discuss digital identity systems that disclose attributes, including age, without exposing unnecessary personal information.
The proof method can serve both blockchain privacy and app age checks. A verifier checks whether a defined claim holds, rather than receiving the complete record behind it. In blockchain privacy research, the protected record includes transaction history. For an age check, the relevant claim concerns eligibility for access. The information being protected changes, while the purpose of limiting disclosure remains.
There is also a difference between sharing a selected field and proving something about that field. Sharing a birth date gives the recipient the date itself. A threshold proof communicates the age condition without supplying that date. Both approaches can reveal less than a full document, but they disclose different information.
The proof does not establish that nobody ever saw the source evidence. How the age claim was established, who issued it, and what happened to any collected records remain separate questions. Nor does the term “zero knowledge” describe everything an app knows about an account. It describes the privacy property of the proof.
Information outside the proof
The protected information is only one part of the interaction. An app that connects the age result to an existing account still has that account relationship. Preventing disclosure of a birth date does not remove the account or determine how the service stores its verification result.
CDT also recommends preventing the organization that issued age evidence from learning which services a person accesses. A limited age response and protection against linking separate visits are different safeguards. The proof’s contents alone do not describe the records created around its use.
CDT’s safeguards address that wider handling: use data for age verification, collect only what is necessary, limit sharing, and delete underlying evidence promptly. These are recommended protections, not a description of every existing app. The organization also calls for transparency about the operator, method, stored information, and available ways to request deletion.
Revoking an app’s camera permission controls subsequent camera access on the phone. It does not, on its own, delete an identity image already held elsewhere. Collection on the device and retention by another organization require separate controls.
A privacy-preserving check narrows the information disclosed for access while leaving the age decision grounded in evidence. The relevant app can receive confirmation of adulthood without receiving the document used to establish it. Any claim about the system’s privacy must account for the organizations handling that evidence and the records kept outside the proof.
