Age-gating is the control that stands between a user and something restricted by age, and decides which side of it that user ends up on. The gate can sit in front of an entire service, a single video, a checkout, a chat feature or an app store download. It exists because law, platform policy and industry codes all make access conditional on age, and something has to enforce the condition at the moment of entry.

Ofcom calls the same idea an access control. In guidance published on 16 January 2025 and revised on 24 April 2025, the regulator describes it as a technical mechanism that prevents users who have not been age assured, or who were assured and did not meet the requirement, from reaching a service, part of a service or certain content. The wording separates two jobs the industry routinely merges. Establishing how old somebody is comes first. Acting on the answer comes second, and the second is the gate.

How a gate is assembled

Every age gate has three parts: a challenge, a threshold and a consequence.

The challenge is whatever the user is asked to supply. In the archetypal case it is a date of birth typed into a form. The Distilled Spirits Council of the United States defines that pattern precisely in its Code of Responsible Practices, calling it age affirmation and specifying full date of birth, month, day and year, plus country of residence where relevant. Other challenges range from a document scan to a facial image to a wallet credential, and the methods themselves belong to the wider practice of age assurance.

The threshold is the number the answer is compared against, and it is rarely 18. Thirteen comes from the Children's Online Privacy Protection Act of 1998. Between 13 and 16 sits the digital age of consent set by each European Union member state under Article 8 of the General Data Protection Regulation. Sixteen is the Australian minimum for social media accounts. Eighteen governs adult content and most gambling. Twenty-one governs alcohol purchase in the United States, which is why a spirits brand site and a beer brand site in the same market can gate at the same number while their media buying rules differ.

The consequence is the part buyers should care about, because refusal is not the only outcome. A gate can block outright, as an adult content site does. It can downgrade, switching an account to restrictive defaults rather than closing it. It can subtract features. Or it can do nothing visible while quietly changing what the ad stack may do.

Neutrality is a design constraint in its own right. The amended Children's Online Privacy Protection Rule codifies that any collection of age information must be neutral, must not default to a set age and must not encourage falsification. Commission guidance had already ruled out asking a maths problem, or any question a child would be unlikely to answer, as a substitute for asking directly. A manual month-and-year entry with no pre-filled values is the compliant form. In return, an operator of a general audience service that screens neutrally may rely on what users type even when it is false, which is the single most consequential sentence in the whole practice.

Persistence varies by placement. An anonymous splash gate remembers its verdict in a cookie or session token. A signed-in gate reads an account attribute instead. YouTube takes the second route: an age-restricted video requires a signed-in account with a birthday at least 18 years old, the video cannot be played on most third-party sites, and an embed attempt sends the viewer back to YouTube to sign in.

What the gate does to an ad request

Once a service concludes that a user is a minor, the result travels into the advertising stack as a signal rather than an audience.

Google carried that signal for over a decade through two boolean flags, tagForChildDirectedTreatment and tagForUnderAgeOfConsent. Both were retired on 18 May 2026 in favour of a single tag for age treatment, TFAT, carrying CHILD, TEEN and UNSPECIFIED across the Google Publisher Tag, the Google Mobile Ads SDK and the Interactive Media Ads SDK. The TEEN value closed a gap in which publishers could signal child-directed treatment or nothing at all. On YouTube the uploader-side equivalent is the made for kids audience setting, which switches off personalised advertising on the video regardless of who is watching. Both trace back to COPPA and its under-13 threshold.

In Europe the legal instruction is subtraction. Article 28(2) of the Digital Services Act bars advertising based on profiling where a provider is aware with reasonable certainty that the recipient is a minor. Reddit showed what that looks like in production when it locked teen chat and disabled ad personalisation from 24 June 2026 across the 27 member states, the European Economic Area and Switzerland.

Sensitive categories gate on both sides at once. Google's alcohol policy requires advertisers to apply age gating on a YouTube homepage, brand channel or video to run alcohol creative there, and separately restricts personalised alcohol advertising to predefined Google audiences, excluding advertiser-curated, custom and remarketing segments. Compliant alcohol campaigns sit at Eligible (limited) status by design.

Where the practice came from

Self-declared gates arrived with the commercial web and were codified first by industry rather than by statute. DISCUS extended its code to digital in September 2011, and the audience composition rule sitting alongside the gate has moved with the census: the placement standard rose from 71.6% of an audience expected to be of legal purchase age to 73.8% in 2023, with the Beer Institute at 73.6% and the Wine Institute at 73.7%.

Statutory pressure to replace the form field is recent. Ofcom's guidance of 16 January 2025 listed methods capable of being highly effective under the Online Safety Act, among them photo-ID matching, open banking, credit card checks, mobile network operator checks, digital identity services and facial age estimation, and ruled that self-declaration, disclaimers and contractual restrictions are not. Adult content duties became enforceable on 25 July 2025. Australia went further, barring under-16 accounts across nine named platforms from 10 December 2025 with civil penalties reaching 49.5 million Australian dollars.

The gate has also moved down the stack. Texas Senate Bill 2420 pushed the check to the storefront, and Apple activated it for new Texas accounts on 4 June 2026 after an injunction was lifted, passing bands rather than birthdates to developers through Declared Age Range.

Why the boundary matters to buyers

A gate does not only decide who gets in. It decides who remains addressable.

Meta reported removing access from 756,000 under-16 accounts in Australia between 1 December 2025 and 30 June 2026, 462,000 on Instagram and 294,000 on Facebook. The direct revenue attached to that cohort was modest, since teen accounts already carried personalisation limits. Second-order effects are larger: engagement signals feeding recommender systems change composition, household reach shifts in categories where teenagers influence purchases without making them, and lookalike seeds built before the cut-off now describe a population that no longer exists in that shape.

Where gates fail

Circumvention is the oldest objection and the best evidenced. Proton VPN recorded a surge above 1,400% in UK signups within hours of the Online Safety Act duties taking effect. DNS provider NextDNS shipped a Bypass Age Verification feature on 16 August 2025 that redirects requests through servers in unaffected jurisdictions.

False positives cut the other way. Google's machine learning age detection, which reached Search prompts in August 2025, can classify an adult as a minor and leaves a document upload or a selfie as the correction path. X routed verification through conditions that users reported as a premium paywall from 26 July 2025.

Compliance cost can exceed the market. Bluesky blocked Mississippi entirely rather than verify every user of a service the state defines broadly.

The legal ground is unsettled. France's Constitutional Council struck down an under-15 social media ban on 14 August 2026, 18 days before it would have applied. In the United States the Federal Trade Commission chose an enforcement policy statement on 25 February 2026 rather than a rule change, shielding operators that collect data solely to determine age provided they limit use, delete promptly and take reasonable steps toward accuracy. A policy statement binds no successor commission.

Not the same as

Age assurance is the umbrella term for establishing age by verification, estimation, inference or declaration. Age-gating is what a service does with the result.

Age targeting is a buying control. It narrows which users a campaign attempts to reach and has no effect on whether anyone can open a page.

Made for kids and TFAT are declarations about content or audience, set by an uploader or publisher. Neither blocks a viewer; both change what may be served.

Restricted Mode and parental controls are opt-in filters. Nobody is placed into them by age, and turning one off does not unlock age-restricted material.

Recent developments

The United States is layering state duties on top of federal ones. California's governor signed a measure on 10 September 2026 imposing penalties of up to 50,000 dollars per child served an addictive feed, with the age determination resting on a separate Digital Age Assurance Act that takes effect on 1 January 2027.

Europe's own tooling remains voluntary. The Commission's age verification application was declared feature-ready on 15 April 2026, but deployment was handed to member states through a recommendation rather than a regulation, with a target date of 31 December 2026 and no legal compulsion behind it. The United Kingdom has announced an under-16 ban aimed at spring 2027.

Timeline

  • 1998: The Children's Online Privacy Protection Act establishes the under-13 threshold in the United States
  • September 2011: DISCUS extends its Code of Responsible Practices to digital marketing, defining age affirmation
  • September 2020: YouTube begins applying age restrictions automatically through machine learning
  • July 2022: The Beer Institute adopts a 73.6% adult audience placement standard
  • May 2023: DISCUS raises its placement standard from 71.6% to 73.8% following 2020 census data
  • 16 January 2025: Ofcom publishes guidance on highly effective age assurance and rules out self-declaration
  • 17 January 2025: Part 5 duties of the Online Safety Act begin to apply
  • 22 April 2025: The amended COPPA Rule is published in the Federal Register
  • 27 May 2025: Texas Senate Bill 2420, the App Store Accountability Act, is signed
  • 23 June 2025: The amended COPPA Rule takes effect
  • 25 July 2025: Online Safety Act adult content duties become enforceable in the United Kingdom
  • 26 July 2025: X deploys age assurance for UK, Irish and EU requirements
  • 30 July 2025: Google begins machine learning age detection for United States users
  • 16 August 2025: NextDNS launches a DNS-level bypass for age verification
  • 10 December 2025: Australia's under-16 social media ban takes effect across nine platforms
  • 23 December 2025: A district court enjoins Texas SB 2420 days before its start date
  • 25 February 2026: The FTC issues a COPPA enforcement policy statement on age verification technology
  • 15 April 2026: The European Commission declares its age verification application feature-ready
  • 18 May 2026: Google replaces TFCD and TFUA with the TFAT age treatment signal
  • 4 June 2026: Apple activates Texas SB 2420 age rules for new App Store accounts
  • 24 June 2026: Reddit begins EU age checks and disables teen ad personalisation
  • 14 August 2026: France's Constitutional Council strikes down the under-15 ban
  • 10 September 2026: California enacts penalties for serving addictive feeds to minors
  • 31 December 2026: Target date for member state deployment of the EU age verification application
  • 1 January 2027: California's Digital Age Assurance Act takes effect

Summary

Who. Service operators build gates; regulators including Ofcom, the Federal Trade Commission, the European Commission and Australia's eSafety Commissioner set the conditions; platforms such as Google, Apple, Meta, Reddit and X operate them at scale; and advertisers in age-restricted categories inherit the results.

What. An access control that permits, downgrades or refuses entry to a service, a feature, a piece of content or a transaction on the basis of the age attributed to the user.

When. Self-declared gates date to the 1990s and were codified by industry codes from 2011; statutory pressure to replace them clustered between January 2025 and the present, with further deadlines falling through 2027.

Where. At service entry, account creation, content items, feature switches, checkouts and app storefronts, and in the ad request parameters that carry the verdict downstream.

Why. Because the answer decides not only who can see something but who remains addressable, and a gate that closes removes an entire cohort from targeting, measurement and modelling at once.