Age Verification in Europe: UK, France, Germany & Italy Compliance Matrix (2026)

---

Why age verification moved from best practice to table stakes

For most of the 2010s, an "Are you 18?" checkbox was treated as sufficient age gating across Europe. That era is over. Between January 2025 and February 2026, four of Europe's largest e-commerce markets stood up enforceable age-verification regimes, each with a named regulator, a published technical standard, and a live enforcement record that already includes fines, site blocking, and payment blocking.

The trigger was convergence on a single principle: self-declaration is not verification. A tick-box, a date-of-birth dropdown, or a credit-card payment confirms nothing about age — a child can lie in a checkbox as easily as an adult can tick it. Regulators now require a third party to establish age, independent of both the user's assertion and the platform's own data. This is why the language across all four regimes has hardened from "age gating" to "age assurance" and "highly effective age verification."

For a B2B operator the practical consequence is immediate. If you sell physical products, the duty mainly attaches to the marketing surface — a landing page or storefront that hosts 18+ imagery, and any ad or affiliate network that distributes it. If you run content or a community, the duty attaches to the service itself. In both cases, the same privacy-first verification layer solves the problem, and the same documentation expectation applies: name your provider, your method, and your data-minimisation posture, in writing, before a regulator asks.

This guide walks through each of the four regimes, then gives you a single compliance stack that satisfies all of them at once.

United Kingdom: the Online Safety Act and Ofcom's "highly effective" standard

The United Kingdom runs the most aggressive enforcement programme of the four. Under the Online Safety Act 2023, services that are likely to be accessed by children and that host pornographic content must implement "highly effective" age assurance to prevent children from encountering that content. The duty on age assurance took effect on 25 July 2025; the related "children's access assessment" duty has applied since 16 April 2025. According to the Wikipedia entry on the Online Safety Act 2023, the Act creates a duty-of-care framework overseen by Ofcom, with penalties that scale to the greater of £18 million or 10% of a company's qualifying worldwide revenue.

What counts as "highly effective" matters more than the label. Ofcom has made clear that self-declaration fails, and has endorsed a menu of acceptable methods: facial age estimation, credit-card or open-banking checks, mobile-network-operator checks, digital identity services, and government photo-ID verification. The common thread is that the check is performed by an independent mechanism that a child cannot trivially bypass.

Enforcement is real and escalating. By February 2026 Ofcom had opened investigations into more than 90 services and issued a string of fines: £600,000 against Youngtek Solutions Ltd, £1 million against AVS Group Ltd (December 2025), £800,000 against Kick Online Entertainment SA (February 2026), and the largest so far — £1.35 million against 8579 LLC (February 2026). Ofcom reported that roughly two-thirds of the top 100 pornography services had deployed age checks by April 2026. For a brand operator, the message is blunt: the UK is not waiting, and "we are not a UK company" is not a defence — the duty follows access from the UK, not where your servers sit.

France: SREN and Arcom's double-anonymity model

France's framework rests on the SREN law (Law No. 2024-449, adopted 21 May 2024), which built on the long-standing Article 227-24 of the French Criminal Code that makes it a criminal offence to allow minors access to pornography. The regulator Arcom published its technical reference framework on 11 October 2024, and the obligations became enforceable on 11 January 2025.

France's signature requirement is double anonymity: the age-verification provider must not learn which site the user is trying to reach, and the site must not learn the user's identity — it receives only a binary confirmation that the user is over 18. Verification is session-level: a one-time check or a "remembered login" is not enough, because the point is to gate each access attempt, not each account. Permitted approaches include identity-document verification through an independent third party, age estimation with liveness detection, and (once live) the EU Digital Identity Wallet.

Arcom's enforcement escalates in a specific order: a formal notice giving roughly one month to comply, then financial penalties, then ISP blocking within 48 hours, search-engine delisting, and app-store removal. Penalties reach €150,000 or 2% of global turnover at the notice stage, rising to €250,000 or 4% (6% on repeat). The trajectory is instructive: in June 2026 the Court of Justice of the EU confirmed that protecting minors is a matter of public policy sufficient to justify targeted national action against EU-established providers, and on 29 July 2026 Arcom announced action against 31 more non-compliant sites. Survey data from Ifop shows the compliance gap: only about half of French adults attempting to access adult sites were asked to verify their age, and only 39% of adults (18% of 15–17-year-olds) completed the check — evidence that enforcement is still catching up to the letter of the law. For a brand planning a French launch, our France market-entry guide pairs this with the DGCCRF labelling and retail rules you will also need.

Germany: JMStV and the KJM-approved closed user group

Germany is the oldest and most prescriptive of the four regimes. The Interstate Treaty on the Protection of Minors in the Media (JMStV) requires that content harmful to minors be made available only within a closed user group (geschlossene Benutzergruppe) — a legal test, not guidance — and that the age-verification system be approved by the KJM (Kommission für Jugendmedienschutz) or a recognised self-regulatory body such as the FSM. Self-declaration, pure age estimation, and simple credit-card checks do not satisfy the closed-user-group requirement; Germany is deliberately deterministic, not probabilistic.

Two operational details make Germany distinct. First, the approved-provider list: only systems that KJM has positively assessed (historically including Yoti, IDnow, Veriff, Sumsub, Shufti, Verifymy, and Gataca) deliver regulatory certainty. Second, the three-year safety buffer for machine-learning age estimation — an ML system must recognise a user as at least 21 before approving them for 18+ content, to absorb the model's margin of error.

Germany also has the sharpest financial enforcement lever in the group. Since 1 December 2025, state media regulators can instruct banks and payment service providers to halt transactions to non-compliant platforms — a power that no VPN or mirror domain can work around, because it cuts the payment rails themselves. Website blocking had always been possible; payment blocking is new and economically decisive. As with the UK, the JMStV applies to any platform accessible to German users, regardless of where it is incorporated. Our Germany market-entry guide covers the adjacent WEEE registration and labelling obligations you will stack on top of this.

Italy: the Caivano Decree and AGCOM's session-level checks

Italy arrived later but has moved quickly. The Caivano Decree (Decree-Law No. 123/2023, converted by Law No. 159/2023), Article 13-bis, requires websites and video-sharing platforms that disseminate pornographic content in Italy to verify that users are over 18. AGCOM operationalised this through Resolution No. 96/25/CONS (April 2025), agreed with the privacy regulator (Garante), on a technologically neutral basis that mandates proportionality, data minimisation, security, storage limitation, and transparency rather than any single method.

Italy mirrors France's double-anonymity, session-level model — the age-verification provider does not know the destination, and the platform receives only an over-18 confirmation. Italian digital identity (SPID and the CIE card) is explicitly recognised as a valid verification path. Deadlines were staggered: providers established in Italy or outside the EU had to comply by 12 November 2025, and providers established in another EU member state by 1 February 2026. AGCOM published its list of covered platforms on 31 October 2025.

Enforcement is already producing blocking orders. AGCOM's first two — against the sites giochipremium.com and entai-ita.net — were upheld by the Lazio regional administrative court on 16 April 2026, confirming the lawfulness of the approach even against operators established in other member states. Fines reach €250,000, and AGCOM can order blocking until compliance is restored. A notable detail for operators: covered sites are also prohibited from promoting VPNs as a means to bypass the requirement — a signal that regulators understand the circumvention dynamic and are legislating against it directly.

What this means for adult wellness brand operators

There are three layers of obligation to think through, and they scale with your business model:

1. The storefront layer. If you run an 18+ product site with age-restricted imagery, the verification duty attaches to your access path. A privacy-first, session-level check satisfies all four regimes at once, so you do not need four different systems — you need one system that is strong enough for the strictest (Germany's closed-user-group standard) and private enough for the most privacy-sensitive (France and Italy's double-anonymity standard).
2. The content and community layer. If you operate a blog, forum, creator platform, or UGC surface, the duty follows the content, not just the checkout. Your age gate must sit in front of content pages, and your content-management policy should document creator age verification and moderation.
3. The documentation layer. Regulators and acquirers increasingly expect you to hold, in writing: a consumer age-verification policy naming your method and provider; a content-management policy; a complaint and takedown procedure; and a record of your data-minimisation choices. The operators who get fined are often doing the right thing but have not written it down.

For manufacturers and distributors, this changes what "compliance-ready" means at the product level. Buyers will increasingly ask for documentation that supports their downstream age-verification obligations — for example, content age-guidance, age-restriction labelling, and digital-manual infrastructure that can carry a QR code to an age-gated product page. A factory that can hand over this packaging is worth more to a European brand than one that cannot. See our European distributor requirements guide and the multi-market labelling guide for the adjacent documentation stack.

A practical compliance stack for your DTC launch

Assemble these five pieces and you have covered all four regimes with one coherent system:

• One approved third-party verifier. Pick a provider that is on (or able to satisfy) Germany's KJM/FSM assessment and that supports double-anonymity architecture for France and Italy. This is the single highest-leverage decision, because it fixes the hardest two regimes at once.
• Session-level gating. Do not rely on a one-time login. Gate each access attempt to 18+ content, and place the gate in front of content pages, not only the cart.
• Double-anonymity design. Architect the flow so the verifier never learns the destination and the site never learns the identity — only an over-18 boolean passes through. This is mandatory in France and Italy, and strongly preferred everywhere.
• A written policy bundle. Consumer age-verification policy, content-management policy, complaint/takedown procedure, and data-minimisation record. Update it when your method changes.
• Age-restriction packaging and metadata. On the physical side, ensure age-restriction labelling and a QR-linked digital manual that routes to an age-gated surface — this supports both retail buyers and your own DTC.

Because payment and ad platforms sit inside the same risk envelope, pair this with our Shopify and payment-processor guide and the high-risk-payments and marketing-restrictions guide before you spend on acquisition.

The EU convergence horizon

The four national regimes are not the end state. Three EU-level tracks are converging: the Digital Services Act (Article 28 age-appropriate design duties), the EU Digital Identity Wallet (operational by end of 2026), and a European Commission age-verification "blueprint" that several member states are piloting. The predictable endpoint is a harmonised, attribute-based system in which the user proves age once and the relying party receives only a certified over-18 attribute.

The practical advice for an operator is to build for convergence now: choose a verifier with an open, standards-based architecture, minimise the personal data you touch, and keep your policy bundle current. The operators who adopt privacy-first, session-level verification in 2026 will not have to re-architect when the EU layer lands. According to the Wikipedia entry on the Digital Services Act, the DSA imposes risk-assessment and mitigation obligations on very large platforms, and the Jugendmedienschutz-Staatsvertrag entry documents Germany's state-level closed-user-group requirement; the Age verification system entry surveys the broader technical landscape. In the academic literature, the regulatory turn toward platform duties is analysed in Zittrain's The Future of the Internet and How to Stop It [Zittrain, 2008] and the child-protection framing in Livingstone's Children and the Internet [Livingstone, 2009], while boyd [boyd, 2014] and Zuboff [Zuboff, 2019] document, respectively, the social dynamics of teens online and the surveillance economics that privacy-first verification is designed to resist.

---

References

1. 根据维基百科条目《Online Safety Act 2023》（https://en.wikipedia.org/wiki/Online_Safety_Act_2023）
2. 根据维基百科条目《Digital Services Act》（https://en.wikipedia.org/wiki/Digital_Services_Act）
3. 根据维基百科条目《Jugendmedienschutz-Staatsvertrag》（https://en.wikipedia.org/wiki/Jugendmedienschutz-Staatsvertrag）
4. 根据维基百科条目《Age verification system》（https://en.wikipedia.org/wiki/Age_verification_system）
5. Zittrain, Jonathan. The Future of the Internet and How to Stop It. Yale University Press, 2008.
6. Livingstone, Sonia. Children and the Internet. Polity Press, 2009.
7. boyd, danah. It's Complicated: The Social Lives of Networked Teens. Yale University Press, 2014.
8. Zuboff, Shoshana. The Age of Surveillance Capitalism. PublicAffairs, 2019.