Proving you qualify without proving who you are
By Dylan Wolpe
The short version
- Almost every eligibility check collects far more than the check requires: a yes-or-no question is answered by handing over a document containing name, address, document number and photograph.
- The collected data becomes a liability for the verifier, who must now store, secure and eventually delete identity records they never wanted.
- Proving a threshold, over eighteen, resident here, qualified as that, without revealing the underlying attribute is a solved cryptographic problem gated on issuers signing what they issue.
- Regulation is now pushing in both directions at once: mandating age checks while penalising the data collection that the usual implementation requires.
A website needs to know you are over eighteen. It asks for a photograph of your passport. It now knows your full name, date of birth, nationality, passport number, what you look like, and that you were on that website, in exchange for answering a question with two possible values.
The shape of the over-disclosure
| The check | What is required | What is handed over |
|---|---|---|
| Over 18? | One boolean | Name, DOB, document number, photograph, nationality |
| Resident in this area? | One boolean | Full address, and usually a utility account |
| Earns above a threshold? | One boolean | Every transaction for three months |
| Holds this qualification? | One boolean | Complete academic record |
The pattern is identical in each case, and it has one cause: the document is the only thing carrying authority. There is no mechanism for presenting a single fact from it, so the whole thing is presented and the recipient inherits everything inside.
Nobody designed this. It is what happens when the only available proof of a fact is the document the fact happens to live in.
The verifier does not want this either
It is tempting to frame this as sites being greedy for data. Mostly they are not. A retailer enforcing an age restriction has no commercial use for passport scans, and acquires:
- A high-value breach target, correlated with user behaviour on their site.
- A data protection obligation covering documents they never wanted.
- Retention and deletion duties for records with no business purpose.
- Liability if any of it leaks.
The incentives are aligned here in a way they usually are not. Neither party wants the transfer to happen; it happens because there is no alternative mechanism at the moment the check is required.
What the alternative looks like
If a credential is signed by an issuer, a government, a bank, a university, then a proof can establish a derived fact about its contents without revealing them. The verifier confirms:
- The credential was issued by an authority they recognise.
- It has not expired or been revoked.
- The derived claim holds: the date of birth implies an age above the threshold.
- The proof was generated for this request and cannot be replayed elsewhere.
And learns nothing else. Not the date of birth, not the name, not the document number. The check is satisfied and no identity data changes hands, so there is nothing to secure, nothing to retain, and nothing to breach.
Why it is not everywhere already
The same reason as everywhere else in this category, covered in the anchor problem: the mathematics has been ready for years, and it needs issuers to sign credentials in a form a holder can present selectively. That is an institutional change, and institutions move at institutional speed.
What is different now is that the pressure has become bidirectional. Regulators are increasingly mandating age assurance while simultaneously penalising the data collection that the naive implementation requires. Organisations are being told to check, and told off for how they check. That contradiction is uncomfortable enough to move procurement, which is usually what actually moves infrastructure.
The general shape
Age is the vivid example because everyone has met it. The pattern is far wider: proving residency without an address, professional standing without a full record, income without a statement, entitlement without a case file.
Each is currently answered by handing over a document, and each leaves the recipient holding data they did not want and cannot safely keep. The interesting thing about this category is that it is one of the rare privacy improvements both parties actively want, which is a much better position to build from than the usual one.
Questions people ask about this
Can you verify someone's age without seeing their ID?
Yes, in principle and increasingly in practice. A proof can establish that a date of birth in a signed credential implies an age above a threshold, without revealing the date or anything else in the document. The verifier learns one bit, the person qualifies, and holds no identity data at all.
Why do age checks collect so much personal data?
Because the only widely available proof of age is a document that also contains name, address, document number and photograph. There is no mechanism to present the one relevant fact, so the whole document is handed over and the recipient inherits everything in it.
What is the risk to the site doing the checking?
They become a database of their users' identity documents, correlated with what those users were doing on their site. That is a high-value breach target and an ongoing data protection obligation, acquired purely as a side effect of complying with a rule about age.