.webp)
An age check usually confirms a user’s eligibility only at one specific moment, yet the result of the check is often treated as permanent for that user’s account. That can present a problem, as a person can pass a completely valid age check, and then simply hand the account to someone else tomorrow.
Case in point: in January 2026, Roblox made age checks mandatory for chat, and that same month, age-checked Roblox accounts appeared for sale online for only a few dollars.
At Identity Week America 2026, Regula’s Solutions Architect Igor Zhdanko talked at great length about this exact problem: even the strongest age check must have a shelf life.
Drawing on that presentation, this article follows the same argument from a valid first check to the harder question of what happens afterward.
Regula’s Solutions Architect Igor Zhdanko on stage, discussing the issues of age assurance.
A correct age check can still produce the wrong access decision
When assessing age assurance, it helps to distinguish two kinds of failure:
-
Technical failure: The verification method is tricked or produces the wrong result.
-
Systemic failure: The check produces the correct result, but the service continues relying on it for too long.
Technical failures tend to have slightly more obvious fixes, for example, going for a stronger liveness detection or age estimation system. Systemic failure can be trickier to handle.
If the device or credentials later change hands, the service may continue granting age-restricted access with no fresh evidence about the active user. And making the first check more accurate will not close that gap; the service also needs a way to reassess confidence when later activity no longer fits.
It’s crucial that we don’t treat age as a permanent account property. As soon as the account gets an adult label, that label can live for years. But that account can easily later be handed to a child; just as it can be rented or sold.
— Igor Zhdanko, Solutions Architect at Regula
The business’s responsibility continues after the check
Once an adult hands over a verified account, it may look like misuse that sits outside the service’s control. However, regulators may have a different view.
For example, Australia’s social media minimum-age guidance specifically tells providers to consider changes that may indicate the sale or transfer of an account to an underage user. It also mentions device data and behavioral signals as ways to detect irregular activity.
The guidance looks at whether reasonable steps were taken for age assurance.
And this is where the wording gets tricky, as it’s hard to tell what exactly reasonable steps are. So, it’s often better to be on the safer side, and re-check instead of relying on a decision made years ago.
— Igor Zhdanko, Solutions Architect at Regula
The financial consequences of non-compliance are already real. In December 2025, Ofcom fined AVS Group £1 million because the age checks used across its adult websites were not considered highly effective.
Granted, the case concerned weaknesses in the checks themselves, rather than the later transfer of a verified account. Still, it shows the direction of travel: regulators are keen on age-assurance controls actually protecting children, not existing for the sake of existing.
Continuous assurance — ever-present, but very quiet
If initial age checks are already strong, one of the next logical steps is to introduce what is called continuous assurance. Continuous assurance is the practice of keeping an earlier age decision open to review throughout the account relationship.
For example, an account suddenly moves between several new devices, or someone completes an account-recovery process and immediately tries to access age-restricted content.
Now, such events don’t prove that a child has taken over, but they do weaken the confidence behind the original decision.
When too much confidence is lost, there needs to be a response. It might range from lightweight authentication to a new age estimate or document-backed verification, depending on how much confidence has been lost.
At the same time — and this part is crucial — continuous assurance must stay very quiet.
We are not talking about ID scans or liveness checks at every login. Most of the work happens in the background, using selected information from the service’s account, device-risk, and fraud systems. Ordinary sessions continue normally, and visible checks return only when the accumulated evidence justifies them.
Continuous assurance comes with a three-way trade-off
Unfortunately, it’s impossible to “have it all”, when it comes to continuous assurance. Every design of it has to balance risk assurance, data privacy, and user friction.
For example, if we aim for really high risk assurance levels, we will need to either collect more user data or trigger a strong, disruptive check.
Conversely, if we choose to minimize data or friction, assurance will take a hit. For example, less intrusive evidence like device signals will often cause false positives. Common are instances where a legitimate adult may travel, replace a phone, use a VPN, or recover an account after losing access.
And if a legitimate user is stopped, they need a clear way forward: another suitable verification method, an opportunity to repeat the check, or a route to request a review. Otherwise, a false positive can become a decision the user has no realistic way to correct.
This makes continuous assurance a matter of good workflow orchestration. A system must combine the relevant risk events, apply the business’s rules, select a proportionate check, handle inconclusive results and review requests, and preserve the reasoning behind each decision.
Done properly, continuous assurance remains active throughout the account relationship while most legitimate users barely notice it.
I think people hear ‘continuous assurance’ and imagine continuous checks. From the user’s perspective, it should feel almost like the opposite.
— Igor Zhdanko, Solutions Architect at Regula
Conclusion
“Age verified” works better as a decision tied to specific evidence than as an eternal fact about an account. However, that does not necessarily need a fixed expiry date.
A good system keeps the decision usable during ordinary activity and reopens it only when a meaningful trigger — such as a new device, sudden account recovery, unusual geography, or a risky action — weakens the confidence behind it.
For example, Regula IDV Platform follows that same logic across the entire customer relationship. Its primary aim is to keep ordinary sessions ordinary and ask again when trust has genuinely gone stale.
If your age-assurance strategy is in line with what Regula offers, talk to our team about what should happen next.
