France’s double-anonymity approach shows how platforms can verify a user’s age while limiting unnecessary exposure of identity and browsing activity.
Age verification creates a difficult privacy question.
A website may need to know whether someone is old enough to access restricted content. But proving age can involve sharing personal information that tells the website far more than it actually needs to know.
If the only question is whether someone is over 18, does the website need their full name? Their exact date of birth? A copy of their identity document? And should the company carrying out the age check know which sensitive website that person is trying to access?
France has introduced an approach designed to separate these pieces of information: double anonymity.
The approach forms part of France’s age-verification framework for certain services providing access to pornographic content. Under the framework established by France’s audiovisual and digital regulator, Arcom, covered services must meet specific requirements for verifying users’ age, including privacy protections around how age information is established and shared.
For businesses working with digital identity verification, the French model offers a useful example of a broader principle: a verification system does not always need to reveal a person’s full identity to prove that they meet a particular requirement.
The name sounds technical, but the basic idea is straightforward.
Suppose a website needs to confirm that a visitor is an adult.
The website needs an answer to one question: Is this person old enough to access the service?
It does not necessarily need to know who that person is.
France’s double-anonymity approach is designed to keep those pieces of information separate.
In the model described by France’s data protection authority, CNIL, the website receives proof that the user is an adult without learning the user’s identity. At the same time, the party involved in establishing the user’s age should not be able to determine which protected website the user is accessing.
Neither side gets the complete picture.
That separation is what makes the approach different from simply asking users to upload an identity document directly to every age-restricted website they visit.
Uploading an ID may seem like the easiest way to prove age, but an identity document contains much more information than an age check usually requires.
Depending on the document, it could reveal a person’s full name, photograph, exact date of birth, document number, nationality and other personal details.
The website may only need to know whether the person has crossed a particular age threshold.
There is a significant difference between receiving a complete identity profile and receiving a simple confirmation that a user is over 18.
For an age-related access decision, that confirmation may be enough.
This is where attribute-based verification becomes useful. Instead of sharing a person’s complete identity, a system can establish a particular fact about them.
Age is one example. In other situations, the relevant fact might be residency or another eligibility attribute.
The service receives the information needed to make its decision without automatically receiving everything used to establish that information.
Double anonymity becomes easier to understand when verification is treated as a series of separate functions rather than one large identity check.
First, the user needs a way to establish that they meet the required age threshold. Depending on the system, this may involve an age-proof provider or another approved verification method.
A proof of age can then be generated.
The important part is what happens after that verification.
The website making the access decision does not necessarily need the personal information used to establish the user’s age. It needs reliable evidence that the age requirement has been satisfied.
At the same time, the system should be designed so that the party establishing the age proof cannot connect the user’s identity with the particular protected service they are accessing.
France’s framework therefore focuses not only on whether an age check happens, but also on how information moves between the different parties involved.
CNIL has explored privacy-preserving technical approaches that can support this separation. The specific implementation can vary, but the underlying idea remains the same: each participant should receive only the information necessary to perform its role.
An important detail is that France’s framework should not be reduced to the idea that every age check must work in exactly the same way.
The framework establishes privacy requirements for age-verification systems while also requiring covered services to make available at least one method offering the stronger protections associated with double anonymity.
This distinction matters because age verification can be implemented using different technologies and providers.
The focus is therefore not simply on choosing one particular verification technology. It is also about setting limits on what information can be exchanged between the user, the verification process and the website.
For users, the result is the possibility of proving that they meet an age requirement without automatically revealing their complete identity to the website they want to access.
Consider what happens when someone uploads an identity document directly to an age-restricted website.
That website may then process two sensitive pieces of information at the same time: who the person is and what service they are accessing.
If users repeat the same process across several websites, identity information or copies of documents may be processed by multiple organisations.
Separating verification from access can reduce that exposure.
This approach also reflects the GDPR principle of data minimisation, under which personal data should be adequate, relevant and limited to what is necessary for the purpose for which it is processed.
Double anonymity itself should not be confused with a general GDPR requirement. Rather, the French approach shows how data-minimisation principles can influence the design of an age-verification system.
It also provides a useful design lesson for a privacy-first identity verification platform.
Verification does not automatically require every service involved in a transaction to receive the same personal information. What a service receives can depend on what it genuinely needs to establish.
Age and identity are related, but they are not the same thing.
If a service needs to know whether a person is above a certain age, identifying that person may provide information that is unnecessary for the access decision.
That changes the question the platform needs to ask.
Instead of asking, “Who are you?”, the relevant question may simply be, “Can you prove that you meet the required age?”
This distinction matters because every additional piece of personal information collected creates data that needs to be handled appropriately.
If the platform does not need a person’s full identity to make its decision, collecting less information can reduce unnecessary exposure while still allowing the age check to take place.
The phrase secure identity verification without data exposure does not mean that personal information is never processed.
A verification provider may still need information about the user to establish that they genuinely meet the required age threshold.
The difference lies in what happens to that information afterwards.
The personal information used during verification does not automatically need to be passed to the website relying on the result. The website may receive proof of the required attribute rather than the underlying identity information.
That is an important distinction.
Privacy-preserving verification is not about pretending personal data does not exist. It is about controlling where that information goes, what each party can see and whether the information being shared is actually necessary.
France’s double-anonymity framework has a specific regulatory context. It applies to services covered by French age-verification requirements for pornographic content and should not be presented as a universal rule for every website, marketplace or SaaS platform.
The design principle behind it, however, is relevant much more broadly.
Before building a verification process, a platform can start with a simple question: What do we actually need to establish about this user?
Sometimes a complete verified identity may be necessary. In other situations, the platform may only need proof of a particular attribute.
Once that requirement is clear, the next question is how much of the information used during verification needs to reach the service making the final decision.
If a website only needs proof that someone meets an age threshold, there may be no need for it to receive the user’s full identity document as part of that access decision.
This way of thinking encourages platforms to treat verification as a process of establishing specific facts rather than automatically collecting the maximum amount of information available.
For years, proving something about yourself online has often meant handing over personal information.
Need to prove your age? Provide your date of birth. Need stronger evidence? Upload an identity document.
France’s double-anonymity approach starts from a different question: What is the minimum information needed to make the decision?
For age verification, the answer may be proof that someone meets the required age threshold, without giving the website their name, exact date of birth or identity-document details.
That does not remove verification. It changes how much information verification needs to expose.
For digital platforms designing identity and age-assurance systems, that is the broader lesson from the French approach: establish the fact that matters, limit unnecessary disclosure, and avoid connecting identity with online activity when that connection is not needed.