Verifying someone's age requires exactly one bit of information: yes or no.

Verifying someone's age requires exactly one bit of information: yes or no.

Most age verification systems collect a scanned identity document instead — name, address, date of birth, document number, photograph.

Article 5(1)(c) of the GDPR requires personal data to be adequate, relevant and limited to what is necessary. It has been in force since May 2018.

Eight years later, uploading your passport to buy a bottle of wine is still normal.

The law isn't the problem. The architecture is.