Verify age without building identity trails

Kenya is right to demand strong protection for children online. But there is a dangerous way to achieve it: make every user reveal who they are to prove how old they are.

That would turn child protection into identity infrastructure. Age assurance is becoming one of the hardest problems in digital governance. Platforms need reliable ways to distinguish adults from children when access to pornography, gambling or other age-restricted services is at stake.

Obvious solutions like uploading a national ID, submitting a selfie, scanning a passport or consulting identity databases can create new stores of sensitive information and targets for attackers.

The policy question should, therefore, change. How little identity must a platform learn to make the age decision safely?
Kenya has the legal foundation for that approach.

The Data Protection Act requires personal data to be adequate, relevant and limited to what is necessary.

The Office of the Data Protection Commissioner (ODPC) says age-verification methods involving children must be proportionate, privacy-preserving, compliant with data minimisation and grounded in risk. It also requires data protection by design and impact assessment for such mechanisms.

The Communications Authority's child-online-protection guidelines reinforce this.

Kenya should turn those principles into a Minimum Identity Principle. An online service should learn no more about a person than is necessary to establish the age-related fact required for access.