The European Commission on November 4, 2026 published a 69-page independent study concluding that an EU-wide age check requirement would hand online services new but mostly modest bills, with a median cost of about €0.07 per check based on the United Kingdom's experience and set-up costs of a few hundred to a few thousand euros for most small and medium-sized services. The same study warns that the cheapest compliance route, the EU's own age verification app, is available in only a small number of member states, and that this gap "must be treated as a priority, and addressed before any future legislative instrument on age assurance would enter into force."

Titled "Analysis of the impact of age assurance on fundamental rights and the financial impact on businesses concerned," the report was written by Owen Bennett for the Commission's Directorate-General for Communications Networks, Content and Technology (DG CNECT), and carries the imprint of Unit F3, which handles DSA protection of minors and other societal risks. It is dated October 2026 and presented as a follow-up to the recommendations that the co-chairs of the Special Panel on child safety online delivered to Commission President Ursula von der Leyen in July 2026. On its publication page, the Commission describes the work as an independent study carried out by an external contractor and says it does not assess the EU KIDS Act, the regulation the Commission proposed on September 17, 2026. The report's own disclaimer states that its views "are those of the author and do not necessarily reflect the official opinion of the Commission."

In Short

A study published by the European Commission on November 4, 2026 says that forcing websites and apps across the EU to check users' ages would cost most of them little, typically a few hundred to a few thousand euros to set up and a few cents per check. It matters for any ad-funded service, game, shop or social platform that may have to verify ages, and for advertisers whose audiences pass through those checks, because the study also flags the risk that age data gets reused for profiling. What changes is the debate: Brussels now has a cost case for mandatory checks, but the study itself acknowledges that most member states do not yet offer the publicly funded EU age app it relies on.

What the study covers, and what it does not

The report splits into two halves. The first examines three fundamental rights most directly engaged when age checks are actually deployed: data protection and privacy, non-discrimination, and freedom of expression and access to information. The second estimates what a mandate would cost the "information society service providers" likely to fall within its scope. It ends with 13 recommendations to the Commission: three on data protection, four on non-discrimination, three on freedom of expression and three on costs.

Its scope is narrower than its title might suggest. The author states plainly that the report "will not engage the prior question of whether mandating age assurance to protect children online is a proportionate policy approach." It also sets aside the effect of age limits on children's access to content, and, in a footnote, the interference with service providers' own "freedom to impart information." What remains is a practical question: if the EU legislator decides to require age checks, how can the damage be contained and the bill kept down?

Throughout, the report uses age assurance as an umbrella term for "the methods and processes used to determine, with varying degrees of certainty, an individual's age or age range." It analyses two regulatory scenarios. In the first, the law prescribes one or more specific methods for certain services. In the second, it sets "a general, outcomes-based mandate under which service providers can choose from a variety of methods." The rights risks and the remedies differ between the two, and the report keeps returning to that split.

The evidence base is thin, and the report says so. "Precise estimation of the sector-level economic impact of age assurance requirements is constrained by a lack of rigorous existing quantitative data," the executive summary states. Most of the cost evidence comes from the UK, where the Online Safety Act's age check duties are in force, from Australia's impact assessment for its Social Media Minimum Age Act, and from vendor marketing claims. All figures originally in US dollars, Australian dollars and pounds sterling were converted to euros at August 27, 2026 exchange rates, according to a methodology note.

The cost figures

Deployment: hundreds of euros, or hundreds of thousands

The report separates services that build their own systems from those that buy one. The difference is large.

Building in-house is expensive. The study cites Ofcom's 2025 impact assessment of its children's codes, which estimated that hard costs to develop, deploy and test a proprietary system for the UK market "could be in the region of many hundreds of thousands and potentially up to £1 million," with total staff costs in the start-up phase that "may exceed this amount." When Ofcom later tried to gather actual figures from companies that had built their own systems, the evidence was "limited and fragmented," and most could not isolate development and deployment costs. The report concludes that in-house development "is only likely to be exercised by the largest service providers, if at all."

Buying from a vendor is far cheaper. Ofcom's review of UK implementation found that "set up costs do not appear high." Australia's government, in the impact analysis that preceded its under-16 law, estimated implementation at about €4,200 per in-scope provider, expressed as 80 hours of staff time, which implies an hourly rate of roughly €52.50 (a PPC Land calculation). The report notes that the Australian figure "appears to assume" third-party solutions, though this was not explicitly stated.

Vendors now compete on speed of integration, and the report lists their claims. Yoti has asserted, as recorded in a 2024 UK government impact assessment, that services can integrate with its back-end within approximately half a day. iDenfy says its API-based products can typically be integrated "within a week," and that its lighter plug-in can be deployed "in minutes," a claim the report says competitor AgeVerif echoes. Didit says its product can be production-ready within days. Several providers sell plug-ins for WordPress and Shopify. The report labels all of these "vendor self-assertions" that are "not based on independent evaluations," yet it still treats them as evidence of a market where ease of integration is a selling point.

From that, it draws its central deployment estimate: for most small and medium-sized services, integrating a third-party product "will be in the hundreds of euro or the low thousands of euro (assuming one to several software developer days at standard market rates)."

Per-check costs: 7 cents in the UK, zero for digital ID

The headline number comes from Ofcom's 2026 report on the use of age assurance. Among the service providers Ofcom evaluated, the per-check cost had "a median of around EUR 0.07, with most checks falling at or below a cost of EUR 0.12." The study does not say how many services were in Ofcom's sample.

That outcome sits at the low end of earlier forecasts:

Source Per-check estimate (converted to euros)
Ofcom, UK implementation data (2026) Median about €0.07; most at or below €0.12
Ofcom forecast before UK rules took effect (2025) €0.06 to €0.35
UK Department for Science, Innovation and Technology (2024, adjusted to 2026 prices) €0.14 average
Australian government impact analysis (2024) About €0.39
Large UK and Australian services, per an industry observer Below €0.06 on average
Digital ID-based checks, Ofcom evaluation €0.00 for most evaluated services

The differences add up at scale. One million checks would cost about €70,000 at the UK median, €120,000 at €0.12, and €390,000 at the Australian forecast, in PPC Land calculations based on the report's figures.

Price falls with volume. Vendors offer subscription, fixed-cap and volume-tiered pricing, and "the more checks completed, the cheaper each check becomes for the service provider." The sub-€0.06 figure for high-volume companies is sourced to a personal communication with an industry observer, not to published data.

The zero figure for digital ID checks is the most striking in the report. Most UK services using digital ID-based checks reported per-check costs of €0.00, which the report attributes to reusable proof-of-age credentials and to vendors "monetising through other, paid verification services bundled alongside the free digital ID check." Take-up of these products in the UK has been low, the report adds.

Running costs: staff hours that shrink after year one

Beyond set-up and per-check fees, every service carries ongoing costs: legal, compliance, information security, customer support and supplier due diligence. The report expects these to scale with check volume and to be easier for large companies to absorb.

Australia's impact analysis offers the only hard numbers. It predicted that in-scope providers would need 10 hours of staff time per week for business-as-usual compliance in the first year, about €27,300 annually, falling to two hours a week in later years, about €5,450 annually. In the UK, companies have so far been unable to quantify these costs accurately. Ofcom's view, quoted in the report, is that while such costs "may represent an additional cost for businesses and be relevant in some cases, the evidence we reviewed does not allow us to conclude they prevented the effective deployment of age assurance for the analysed service providers."

Services that already run age checks, because of trust and safety policies or rules elsewhere, would face smaller increases. Some UK providers reported no set-up costs at all for the national mandate, because they already had contracts and integrations with vendors.

Why the report expects costs to fall

The study makes five predictions about the medium term. Per-check prices from third-party vendors will keep dropping as technology improves and competition grows, a forecast based on "comparable experiences in other software-as-a-service-based competitive markets." Interoperability between providers will add further downward pressure; euCONSENT's AgeAware and k-ID's OpenAge projects aim to let a check done by one provider be recognised by another, and k-ID claims reuse costs participating services "just fractions of a cent" per use. Technical standards, notably ISO/IEC 27566-1:2025 and IEEE 2089.1-2024, should cut the cost of vetting vendors. Global spread of age rules lets multinational services spread fixed costs, while a single EU instrument would remove the need to tailor checks to each member state. And regulation itself should draw in new suppliers.

On that last point, the report quotes the Age Verification Providers Association, the vendors' trade body: "clear legal requirements also stimulate supply [...] regulatory certainty can resolve this chicken-and-egg problem and expand choice after day one." Two other claims about the sector's growth, including the expected rise in products aimed at small firms, rest on personal communications with I. Corby, author of two association articles the report also cites, rather than on published research.

The report concedes the limits of all this. "Robust data on the cost impacts of age assurance is admittedly limited," it states, and assessments based on today's market "are likely to be soon superseded." On interoperability, the early stage of the projects "means it is not yet possible to accurately predict the medium-term cost reduction benefits."

Small businesses: cheap to install, dearer per check

A whole section deals with micro, small and medium-sized enterprises, many of which, the report says, could be required to deploy age checks for the first time depending on a law's scope.

The picture is mixed. Set-up should be cheap: integration of an app built on the EU blueprint could cost "within the range of hundreds of euro or low thousands of euro," and vendors' plug-ins and widgets lower the technical bar further. Per-check prices are another matter. "Micro-enterprises and SMEs will likely face proportionally higher per-check costs than their larger competitors when using third-party solutions that do not rely on reusable proof-of-age credentials," the report says, because they cannot negotiate the volume discounts available to platforms with large user bases. They are also less likely to have back offices that can absorb support tickets from users who fail a check.

The report's answer is the EU blueprint, which it says "offers a pathway for SMEs seeking to avoid this size disadvantage," plus harmonisation. With more member states drafting their own rules on age thresholds, buffers, permitted methods and security standards, the report argues that this "'cost of non-Europe' in age assurance is more pronounced" for small firms than for large ones.

The EU app and the deployment gap

The study rests much of its cost case on the EU Age Verification blueprint, the open-source architecture the Commission funded. Because the development costs were publicly subsidised and the code is open, the report expects it to be "among the cheapest available compliance pathways for service providers of every size, including on a per-check basis."

Two caveats come attached. First, "there is currently a lack of clarity as to whether and how Member States or third parties deploying solutions based on the EU Age Verification blueprint will seek to recover deployment, operational, and per-check costs." Second, apps based on the blueprint are "currently available in only a small number of EU Member States," and most states lack supporting infrastructure such as adequately resourced manual enrolment offices.

The gap is not new. In April 2026, the Commission was relying on seven self-selected frontrunner countries and a non-binding recommendation urging all member states to deploy by December 31, 2026, with no penalty for missing that date. Documents released in July 2026 under a freedom of information request showed that DG CONNECT held no privacy impact assessment for the app, and that the released specifications treated zero-knowledge proofs as recommended or experimental rather than switched on.

The study, by contrast, says the blueprint replicates both double-blind architecture and zero-knowledge proof cryptography, "with technical fallback foreseen for cases where ZKP is infeasible." It also notes that reusable proof-of-age attestations, available where the zero-knowledge presentation is used, are valid for a maximum of three months.

The KIDS Act raises the stakes. As proposed on September 17, the regulation would require providers to rely exclusively on an EU age verification solution for the under-15 account check and would oblige each member state to offer at least one certified solution free of charge. That corresponds to the first of the study's two scenarios, a prescribed method, for the most consequential check in the proposal. Yet the cost evidence the study assembles comes mostly from the UK, where services choose among competing vendors. If the EU solution is free to users and publicly funded, its per-check cost to services may well be low. Who pays to operate it, and whether operators will charge relying parties, is precisely the question the study says remains unclear.

Profiling: where age data meets advertising

For the marketing industry, the most pointed passage concerns what happens to age data after a check. "Age assurance deployments can be used to facilitate the commercial profiling of individuals accessing a service," the report says. "Absent guardrails on how services process personal data collected for the purpose of age assurance, there is a risk that the data collected can be used by service providers to enhance their profiling, micro-targeting, or identification of service users in pursuit of commercial objectives."

The report's main remedy is the General Data Protection Regulation. Purpose limitation would stop data collected for age checks from being used "for another unrelated end," and strict enforcement "could reduce the risk of age assurance mandates being leveraged by service providers for the purposes of user profiling." The principle of data minimization would keep collection to the least needed, since excessive collection "creates the risk of age assurance morphing into user identification." Its first recommendation is to keep any new law coherent with the GDPR and to make sure data protection authorities have the resources to apply it.

The proposed KIDS Act goes further than the study's recommendation. Its Article 28 would bar age assurance solutions from enabling identification and from being used to locate, track, target, advertise to or profile recipients. The European Data Protection Board set out the same line in February 2025, when its statement on age assurance said the process must not enable additional tracking or profiling. In the United States, the Federal Trade Commission's February 2026 policy statement offered enforcement relief only where data is collected solely to determine age and deleted afterwards.

Platforms are already drawing that boundary in practice. When Reddit introduced age checks across the EU in June 2026, it disabled ad personalization for teen accounts and said verified ages are never visible to advertisers.

Breaches are the other data risk. The report cites Discord's October 2025 disclosure that a third-party vendor handling age verification appeals had been breached, potentially exposing government ID photos and selfies of roughly 70,000 users. Methods such as facial age estimation and ID matching process biometric data, part of the GDPR's special categories of personal data, which the report says makes the consequences of a breach "even more profound and long-lasting."

As mitigations, the report points to double-blind designs, in which the check is done by one party and passed to the website as a token, so that the site learns only that the user is of age and the checker never learns which sites the user visits. Implementation standards for France's 2024 SREN law require that architecture. It also lists on-device processing and vendor deletion policies; it cites Yoti's policy that facial scans are deleted as soon as age is checked. It does not mention that Spain's data protection authority fined Yoti €950,000 in March 2026, including €250,000 for excessive data retention, a decision Yoti is contesting.

Exclusion, fallbacks and facial estimation

The report is candid that age checks can lock out people who are entitled to use a service. Digital identity schemes, the EU blueprint included, usually require a chip-based passport or national ID card and a smartphone with near field communication. Children, the elderly, people in socio-economically disadvantaged groups and people of immigrant or undocumented backgrounds are less likely to hold the right documents. Some member states, the report warns, "might struggle to meet surge demand for manual enrolment" at local offices.

Facial estimation carries a different risk. Accuracy varies by demographic, and deployments set an age buffer around the threshold to compensate for the model's mean absolute error, which can wrongly deny access to people just above the limit. The report draws on the US National Institute of Standards and Technology's ongoing evaluation programme, running since 2024, and on Australia's Age Assurance Technology Trial, which tested 13 age estimation systems and found they "generally performed well across diverse user groups" while noting that underrepresentation of indigenous populations "remains a challenge." Its conclusion is firm: facial estimation "should not be relied upon by service providers as the sole method of assurance without escalation or fallback."

It also finds, for now, no evidence of the feared exclusion at scale. In Australia and the UK, "there is no clear evidence (beyond anecdotal examples) that of-age users have been excluded or wrongly denied access to online services as a direct result of age assurance mandates." The four recommendations in this area ask the Commission to make member states fund fallback enrolment routes, consider secondary legislation or standards on non-discrimination, require a choice of methods where none is prescribed, and ensure every service offers an escalation path rather than an endless retry button.

Friction, chilling effects and the waterfall

The freedom of expression chapter turns on a behavioural point: people may simply leave. A social media age limit would "invariably lead to a significant uptick in adults' direct exposure to age assurance," the report says, noting that many adults have never been checked because platforms "prioritised low-friction age inference mechanisms in the first instance." Some may refuse. The report cites a Lucy Faithfull Foundation survey in which 47% of respondents said they had reduced their consumption of pornography after the UK's 2025 age check requirement for adult sites, while cautioning that the taboo around pornography makes that context unusual. Public fears that checks are a first step towards general online identification could also chill what people say and search for.

Its main answer is successive validation, also called "waterfalling." Users first face the lightest check, and the system escalates to more invasive methods only if that fails. The report cites Apple's approach in some jurisdictions, which first checks whether the user's Apple account has existed for at least as long as the minimum age, then whether a credit card is attached, and only then falls back to ID matching. It quotes Australia's eSafety Commissioner: "requiring all existing Australian account holders to prove their age using an age verification system may be unreasonable and is not necessary for compliance." Done well, waterfalling should mean "only a small number of of-age users are required to engage with digital identity-based, FAE, or equivalent methods" - and it also cuts per-check costs, since cheap signals clear most users before an expensive check is needed.

The report acknowledges the limits. Most low-friction signals, such as credit cards or email-based estimation, establish only that someone is over 18 and say little about whether a user is 15 or 17. Where the law prescribes a method, waterfalling may be confined to checking whether a user already holds a reusable credential.

Those limits matter for the KIDS Act's design, in which the under-15 check must run through the EU solution. The proposal does leave room for a narrow version of the waterfall: for existing accounts, Article 32 lets a provider skip the EU solution if it can establish with high confidence that the holder is over the threshold. Elsewhere in Europe, age limits have already run into resistance on the grounds the study discusses. France's Constitutional Council struck down an under-15 social media ban in August 2026, finding in part that it would have forced every user, adults included, to prove their age without a legal framework for how.

What the study leaves out

Several gaps stand out for the advertising and publishing industry. The financial chapter counts what services pay to run checks: integration, staff time and per-check fees. It does not estimate revenue effects from users who abandon a service at the age gate, even though the rights chapter says some adults "might instead opt out of service usage." For an ad-funded platform or publisher, lost users also mean lost impressions, a cost absent from the report's arithmetic.

Much of the evidence is second-hand. The per-check data comes from Ofcom's review of an unspecified number of UK services. Integration times come from vendor websites. Several forward-looking claims rest on personal communications. Australia's estimates are pre-implementation forecasts rather than measured outcomes, and the report itself notes that the Australian per-check figure of about €0.39 is more than five times the UK median.

The report also predates, or at least does not engage with, the KIDS Act text. Its currency conversion date of August 27, 2026 falls three weeks before the proposal's adoption, and it speaks throughout of "a future legislative instrument." The Commission says the study does not assess the proposal. That leaves open how its two-scenario analysis maps onto the regulation now before the European Parliament and the Council.

Why this matters for marketers and publishers

Age checks are moving from adult content into mainstream services where advertising budgets are spent. Australia's under-16 law has applied since December 2025, and Meta alone removed 756,000 under-16 accounts there in seven months. Turkey began barring social media accounts for under-15s on November 1, 2026, with profiling-based advertising banned for users aged 15 to 17. The UK government announced in June 2026 that it would follow Australia's under-16 model, with protections due in spring 2027.

In Europe, the Commission's enforcement under the Digital Services Act already turns on age. In April 2026, it preliminarily found that Instagram and Facebook failed to keep under-13s off, citing estimates that 10% to 12% of under-13s were accessing the services. The KIDS Act proposal would extend obligations to app stores, online games, operating systems, AI companions and general conversational chatbots.

For a marketer, the study's figures cut two ways. On cost, they suggest that compliance will not, by itself, be prohibitive for most publishers and platforms. On data, the study, the EDPB and the KIDS Act proposal converge on one point: an age signal collected under a mandate is not meant to become a targeting signal. The Digital Services Act already bars platforms from showing profiling-based ads to users they know to be minors, so the age signal shapes who can be targeted; the data behind that signal, however, is meant to stay sealed off from the ad stack. Not everyone in the industry favours this direction; Germany's digital economy association BVDW argued in February 2026 for education over bans, citing a Civey survey in which only 26% of adults backed a general ban.

The study makes the case that rights-respecting checks are affordable. Whether that case holds depends on infrastructure that most member states have yet to build.

Timeline

Summary

Who: The European Commission's DG CNECT, which procured the study from an external contractor; its author, Owen Bennett; and the online services, from social platforms and games to small e-commerce sites, that would have to run age checks under EU law. Regulators and vendors cited include Ofcom, Australia's eSafety Commissioner, Yoti, iDenfy, AgeVerif, Didit and k-ID.

What: A 69-page independent study finding that age checks interfere with privacy, non-discrimination and freedom of expression, but that the harms can be reduced through GDPR enforcement, privacy-preserving designs and a choice of methods. On costs, it estimates deployment at hundreds to low thousands of euros for most small and medium-sized services, cites a UK median of about €0.07 per check, and says digital ID checks are often free per check. It makes 13 recommendations and warns that the EU age verification app is available in only a small number of member states.

When: The study is dated October 2026 and was published by the Commission on November 4, 2026, seven weeks after the Commission proposed the EU KIDS Act on September 17, 2026.

Where: The European Union, with evidence drawn mainly from the United Kingdom and Australia, where broad age check requirements are already in force.

Why: The Commission is weighing how to put into practice the Special Panel on child safety online's July 2026 call for rights-respecting age assurance. The study gives it a cost and rights case for mandatory checks, while making clear that the case depends on member states rolling out the EU app and on keeping age data out of commercial profiling.