You want to know how many sites in your sample ask the visitor how old they are. The literature will not tell you, and this page is mostly about why, and about what you have to build and write down yourself.

Of the 5,855 papers in the publication corpus whose full text is on disk, 38 use any age-assurance phrase at all — age verification, age assurance, age gate, age estimation, age check and nine further forms, including verify their age and prove their age; the exact pattern is on the provenance page. Reading all 38: one has age assurance as its research question, four more measure it in a section, six hit it as an obstacle to a measurement about something else, and the rest — 20 mentions and 7 papers where the phrase is a de-columning artefact or the name of an unrelated ML task — are neither. One of the five is about the web; the other four are about Android apps.

Meanwhile the UK requires “highly effective age assurance” on pornography services since July 2025, the European Commission has shipped a reference age-verification app and preliminarily found Meta in breach of the DSA for accepting a self-declared birth date, the US Supreme Court upheld the Texas age-verification statute in June 2025, and Google Play has been returning per-jurisdiction age signals to Android apps since March 2026. The deployment surface is moving several years ahead of the published measurement — and the one large deployment measurement that does exist was produced by a regulator using statutory information notices, not by a crawl. If you are reading this because you want to measure it, you are not late; you are early.

The single biggest source of incomparable numbers here is that the term spans a range from a button to a government identity credential. The ordering below is this page's own, but it is the axis both [1Yao, Yifan; McCollum, Shawn; Sun, Zhibo; Zhang, Yue (2025): "Easy As Child's Play: An Empirical Study on Age Verification of Adult-Oriented Android Apps", in: Proceedings of the USENIX Security Symposium. (Link)] and Ofcom sort on — cost to the subject, and resistance to a determined minor, rise together.

Three methods Ofcom names are not rows above because they do not have a distinct crawl signature: open banking, mobile network operator age checks and email-based age estimation. If you are classifying what you observe, they will land in the ID-lookup or device-signal buckets. Ofcom's list is explicitly non-exhaustive, so “not named” is not the same as “excluded” — only the two self-declaration rows are actually ruled out.

Four consequences for a measurement:

• The cheap end is what the literature measured and the expensive end is what the regulator now counts. Both halves of that are population-bound: the age gate is the most common mechanism among 1,165 verifying Android apps in a 2024 snapshot [1Yao, Yifan; McCollum, Shawn; Sun, Zhibo; Zhang, Yue (2025): "Easy As Child's Play: An Empirical Study on Age Verification of Adult-Oriented Android Apps", in: Proceedings of the USENIX Security Symposium. (Link)], while Ofcom reports “facial age estimation and photo ID matching the most commonly deployed” among the 32 UK services it analysed in 2026. They are not the same population and neither is “the web”. Ofcom's January 2025 guidance names “open banking, photo ID matching, facial age estimation, mobile network operator age checks, credit card checks, digital identity services and email-based age estimation” as capable of being highly effective, and states that “methods including self-declaration of age and online payments which don't require a person to be 18 are not highly effective”.¹⁾ A 2019 prevalence figure for “sites with an age gate” is therefore a figure for a category the current rules explicitly exclude. Do not present it as a compliance rate.
• The last row is invisible to a network measurement. Apple ships a DeclaredAgeRange framework in iOS, iPadOS and macOS 26.0 that hands an app an age range without a server ever seeing a request.²⁾ Google Play's Age Signals API “started returning age signals for users in Brazil” on 17 March 2026 and for Texas accounts created after 28 May 2026.³⁾ On the web the equivalent is the W3C Digital Credentials API: Chrome shipped presentation support in Chrome 141 — the origin trial ran from 134 on desktop and 128 on Android and has closed — and lists issuance support against Chrome 155, which has not arrived; Chrome 153 was the stable release on 8 September 2026.⁴⁾ A crawler that instruments navigator.credentials.get can see that one; nothing on the network sees the two mobile ones.
• The privacy properties differ as much as the strength does. A PoPETs 2026 framework paper working through digital identification systems gives age verification as its worked example of unlinkability — “An age verification app generates one-time use credentials so that a user's sessions can not be linked” [2Woodruff, Allison; Balfanz, Dirk; Drewry, Will; Raykova, Mariana (2026): "A Risk Assessment Framework for Digital Identification Systems", in: Proceedings on Privacy Enhancing Technologies. (DOI)] — which is what the EU blueprint is building and what a document upload is not. If you are classifying mechanisms, classify them on what the verifier learns and what the issuer learns, not only on how hard they are to fool.
• No paper in the corpus has measured the mix on the web. The one paper that classified mechanisms at scale did it on Android, and it is from 2025. The only breakdown of what is deployed on the web comes from the UK regulator, below.

There is no enum in the extraction schema for age assurance, so the population is a full-text probe followed by a hand audit of every candidate. The probe is deliberately phrase-level, and its width matters: an earlier version without a word boundary before age matched voltage signal and image signal and returned a candidate set of 233 papers, nine tenths of it electromagnetic side-channel work.

That gives 5 papers out of the 38 candidates — 13.2% precision, and 0.1% of the corpus. Two of them are inside the 1,120 papers that ran a crawl.

Read these as five separate studies of five different populations, not as a series.

• 3.67% of adult-only Android apps implement any age verification at all — 1,165 of 31,750 apps carrying Google Play's “17+” tag, themselves drawn from 693,334 apps [1Yao, Yifan; McCollum, Shawn; Sun, Zhibo; Zhang, Yue (2025): "Easy As Child's Play: An Empirical Study on Age Verification of Adult-Oriented Android Apps", in: Proceedings of the USENIX Security Symposium. (Link)]. Of the 1,165, the weakest mechanism is the most common: the age gate is “the most widely implemented method (31.84%)”, and biometric verification “the least utilized (8.48%)”. The store rating is not the age the app enforces either: “Despite being rated as 17+, 152 apps actually enforce an age limit of 21 years”, and 309 set it at 16.
• 20% of pornographic websites showed any age-verification mechanism in 2019 from the USA, the UK and Spain, and 14% from Russia [3Vallina, Pelayo; Feal, Álvaro; Gamba, Julien; Vallina-Rodriguez, Narseo; Anta, Antonio Fernández (2019): "Tales from the Porn: A Comprehensive Privacy Analysis of the Web Porn Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]. Read the denominator before reusing this. It is not the paper's 6,843-site corpus: the authors found their own keyword detector too false-positive-prone to trust — “specially so in age-related keywords that appear often in the content of the websites” — and so “only investigate a subset of the top-50 most popular pornographic websites manually”, in four countries. 20% is therefore at most ten sites, hand-checked. The mechanism was a warning and a button, and the paper's own assessment of it is the sentence to quote in your related work: “if our automatic crawler manages to bypass the mechanism, a child could do it as well”. The one real verification product of the era went unobserved: “we did not find any instance of AgeID being deployed during our study”.
• Deployment is conditioned on where you appear to be, and not monotonically. In the same hand-checked set, 8% of the sites that did not verify from the other countries did verify from Russia, and 12% verified everywhere except Russia [3Vallina, Pelayo; Feal, Álvaro; Gamba, Julien; Vallina-Rodriguez, Narseo; Anta, Antonio Fernández (2019): "Tales from the Porn: A Comprehensive Privacy Analysis of the Web Porn Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]. A single-vantage crawl gets neither number — and neither does an automated one, on this paper's own account.
• A deployed facial age-estimation model is not uniformly accurate. Extracting the local vision models from the TikTok and Instagram Android apps, “we evaluate the effectiveness of age verification. We find that age verification, if done using the model deployed by TikTok, is less effective for younger demographics” [4West, Jack; Thiemt, Lea; Ahmed, Shimaa; Bartig, Maggie; Fawaz, Kassem; Banerjee, Suman (2024): "A Picture is Worth 500 Labels: A Case Study of Demographic Disparities in Local Machine Learning Models for Instagram and TikTok", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)]. This is the only paper in the corpus that measures how well an age-assurance mechanism works, as opposed to whether it is present — although age is only one of its two case studies, and the paper is framed as an on-device-ML fairness audit rather than as an age-assurance study.
• Self-report is not deployment. 16% of 50 surveyed child-directed-app developers said they use age gates to obtain parental consent, and 6% said their own gate could be “trivially bypassed by providing a birth year” — and when the same authors tested those organisations' apps from Californian IP addresses they “did not observe any mechanisms for obtaining verifiable parental consent” at all [5Alomar, Noura; Egelman, Serge (2022): "Developers Say the Darnedest Things: Privacy Compliance Processes Followed by Developers of Child-Directed Apps", in: Proceedings on Privacy Enhancing Technologies. (DOI)]. If your design is a developer survey, you need the crawl too.
• Where a measurement did classify mechanisms, it found many. 137 expert-approved children's apps used “a total of 13 different methods” for age assurance, most commonly asking for a year of birth (12 apps) [6Ekambaranathan, Anirudh; Zhao, Jun; Van Kleek, Max (2022): "Poster: An Analysis of Privacy Features in 'Expert-Approved' Kids' Apps", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)]. A poster, n=137 — but it is the only taxonomy in the corpus derived from watching children's apps rather than from a regulator's list, and the only one at all outside [1Yao, Yifan; McCollum, Shawn; Sun, Zhibo; Zhang, Yue (2025): "Easy As Child's Play: An Empirical Study on Age Verification of Adult-Oriented Android Apps", in: Proceedings of the USENIX Security Symposium. (Link)]'s six Android categories.

The reason a web-side prevalence figure is hard to find in the literature is not that nobody has one. Ofcom published a statutory report on 16 July 2026 under s157 of the Online Safety Act 2023, and it is the largest deployment measurement of age assurance this page has been able to find.⁵⁾ Its method is the part to notice:

• Over 69 million age checks were completed across those 32 services between July and December 2025, “a 23-fold increase on the previous six months”. The report notes the true UK total is likely materially higher.
• The top 10 most popular UK pornography services have all implemented age assurance, and 64 of the top 100 had as of June 2026 — “with a further 10 geo-blocking UK users”. That last clause is the Blocking and geodifference problem arriving in this one: a crawl from a UK vantage point records those ten as unreachable, not as unverified.
• Children's exposure to a non-self-declaration method rose from 25% in July 2025 to 43% in January 2026, and among 8–17-year-olds who recalled being asked to prove their age, facial age estimation was the most commonly recalled method.
• Facial age estimation and photo ID matching are the most commonly deployed methods across the analysed services.
• On the mechanism the platforms built themselves, the report records “serious doubts about the efficacy of some age inference models, which analyse a user's activity and behaviour on a platform to estimate whether they are a child or an adult”.

Set that against the corpus: the only web-side figure in it is 20% of at most fifty sites, hand-checked in 2019. The gap is not that the phenomenon is unmeasurable. It is that the only instrument that currently works at scale is a legal power, and the resulting numbers are unauditable by anyone outside the regulator. That is the research opportunity: no independent, crawl-based estimate of the same quantities — with a published detector and a published error rate — appears in these seven venues, and none was found outside them either.

Candidates by year, with the verdict split. The point of the table is the last two columns, not the first.

* 2025 and 2026 are provisional venue-years: CCS 2026 and IMC 2026 have not been held, and IEEE S&P and WWW 2026 abstracts are not in the selection source. See Corpus.

PoPETs carries 17 of the 38 candidates and every other venue is in single figures. 17 of the 38 candidates are from 2025–2026, which is 44.7% of the candidates against 20.2% of the corpus — the topic is being talked about more. Only one of those 17 measures anything, but with one to two measurement papers per year across the whole window, that is a small-n observation and not a trend.

Six of the 38 papers are not about age assurance at all. They ran into it. That is more papers than measure it, it is the thing least likely to be in anyone's related-work section, and it is probably why your own crawl will care.

• It removes categories from your population. An app-store study across Google Play and the App Store reports that “some potentially interesting app categories, such as dating apps, require age verification to install them. We could not provide any of the available verification measures at the required scale” [7Breuer, David; Becker, Lucas; Hollick, Matthias (2026): "Ad Personalization and Transparency in Mobile Ecosystems: A Comparative Analysis of Google's and Apple's EU App Stores", Proceedings on Privacy Enhancing Technologies 2026(1):604-630. (DOI)]. That is a sampling frame silently cut down by a deployment decision.
• It stops the crawler before the thing you wanted to measure. A large-scale SSO study lists the artefacts that prevented its crawler from finding a login page: “These include age-verification prompts from adult websites” and sales banners, “which often must be dismissed before any other interaction is possible” [8Ardi, Calvin; Calder, Matt (2023): "The Prevalence of Single Sign-On on the Web: Towards the Next Generation of Web Content Measurement", in: Proceedings of the ACM Internet Measurement Conference. (DOI)].
• It hides the content you are counting. An iOS automation study interacting with children's apps by hand found that in “seven out of 20 apps, we observed at least one ad, typically after bypassing challenging flows such as parental gates”, age verification or gameplay progression [9Moti, Zahra; Janssen-Groesbeek, Tom; Monteiro, Steven; Continella, Andrea; Acar, Gunes (2025): "WhisperTest: A Voice-Control-based Library for iOS UI Automation", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)]. An automated crawl that stops at the gate reports zero ads for those apps.
• It becomes a research-conduct decision. A YouTube advertising study verified its own experiment accounts: “we used a mobile VPN and selfie verification in Australia, Ireland, and the UK, while in the US and Canada, it was enough to confirm the age by clicking on a button” [10Mai, Cat; Coelho, Bruno; Kieserman, Julia; Matsumoto, Lexie; Spinelli, Kyle; Yang, Eric; Andreou, Athanasios; Greenstadt, Rachel; Lauinger, Tobias; McCoy, Damon (2025): "More and Scammier Ads: The Perils of YouTube's Ad Privacy Settings", in: Proceedings on Privacy Enhancing Technologies. (DOI)]. Those researchers submitted real faces to a platform to obtain an experimental condition, and the requirement varied by country.
• It is chosen around. A study of AI “nudification” services collected its data from “a region in the U.S. that does not have an age verification law for explicit content” [11Gibson, Cassidy; Olszewski, Daniel; Brigham, Natalie Grace; Crowder, Anna; Butler, Kevin R. B.; Traynor, Patrick; Redmiles, Elissa M.; Kohno, Tadayoshi (2025): "Analyzing the AI Nudification Application Ecosystem", in: Proceedings of the USENIX Security Symposium. (Link)], and required its own researchers to be over 18 where such a law applied.
• It is excluded from adjacent datasets by construction. The closest thing to a web-forms census of age screening says explicitly that “Many websites use standalone age verification forms that only ask for age but no other identifiers. These web forms are not included in the dataset” [12Cui, Hao; Trimananda, Rahmadi; Markopoulou, Athina (2025): "Understanding Privacy Norms through Web Forms", in: Proceedings on Privacy Enhancing Technologies. (DOI)]. A study of what web forms collect cannot be cited as evidence about age screening.

Two detection methods are published in the corpus, six years apart and on different platforms. Both are worth reading before you write a third.

Neither is a general detector, and the gaps are where the work is:

• The gate is not an HTTP status. It is a DOM overlay served with a 200, exactly like the block pages Blocking and geodifference deals with, and the same three habits apply: record the status, the final URL, the body hash and the first couple of kilobytes of every response, so a later pass can find the interstitial you did not know to look for.
• The gate is almost always a third party, which is the most promising thing about it. Ofcom found that “Almost all analysed pornography services relied exclusively on third-party vendors, with only one analysed pornography service using an in-house solution”, and that services “receive minimal outcome signals from third-party age assurance providers”. A mechanism supplied by a handful of vendors is detectable the same way a tracker is — by the third-party origins loaded before the first interaction — which puts the method within reach of the machinery on Requests and Filter lists rather than requiring a bespoke DOM heuristic. Nobody has published such a vendor list; the certification schemes the services named to Ofcom (the UK Age Check Certification Scheme, NIST testing, ISO-based certifications) are where to start building one, and the resulting list is the artefact this field is missing.
• It can be a redirect chain instead. Some deployments send the visitor to a separate verification origin and back. If your pipeline keeps only the final URL, the hop is the only trace, and if it keeps only the initial URL the gate is invisible.
• It sets state before consent. A gate that remembers you clicked “I am 18” is a cookie or a localStorage entry written before any consent interaction, and often on the first load. It is therefore a confounder for Consent and for anything in Cookies that counts pre-consent storage — and, separately, a signal you can detect: a first-party cookie written at the moment an overlay was dismissed.
• It defeats stateless crawling. Stateful and stateless crawls disagree here by construction, because the whole point of the gate's cookie is to not show it twice; see Stateful stateless.
• Language. The 2019 keyword list covers eight languages — English, Spanish, French, Portuguese, Russian, Italian, German and Romanian, chosen as “the most common default languages in our list of pornographic websites” [3Vallina, Pelayo; Feal, Álvaro; Gamba, Julien; Vallina-Rodriguez, Narseo; Anta, Antonio Fernández (2019): "Tales from the Porn: A Comprehensive Privacy Analysis of the Web Porn Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]. That is a list tuned to one sample, not a general one, and any prevalence claim over a multilingual population inherits the language coverage of its keyword list; see Multilingual support.

Four artefacts, all checked on 2026-09-15. There is no dataset of age gates and no filter list for them; this is what there is.

Two things that do not exist and that you will need:

• A population of sites plausibly in scope of an age rule. [3Vallina, Pelayo; Feal, Álvaro; Gamba, Julien; Vallina-Rodriguez, Narseo; Anta, Antonio Fernández (2019): "Tales from the Porn: A Comprehensive Privacy Analysis of the Web Porn Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] built its 6,843 from three curated adult directories plus Alexa's Adult category — and Alexa was retired in 2022, so that construction cannot be repeated. Whatever you build instead is a methodological contribution in its own right, and belongs in the paper rather than in a footnote. Website selection and Website classification are the general machinery.
• A hostname list for verification vendors. Nobody has published one, and it is the single highest-leverage thing to build, for the reason in the detection section: the gate is nearly always a third party. The certification schemes the UK services named to Ofcom — the Age Check Certification Scheme, NIST testing, ISO-based certifications — are a seed list of vendors to resolve to hostnames, and Filter lists is how to express the result.

“Sites with an age gate” is not a quantity. Three things have to be fixed before it becomes one, and the corpus shows what happens when they are not.

1. Which population. The two academic figures that exist are over the hand-checked porn sample [3Vallina, Pelayo; Feal, Álvaro; Gamba, Julien; Vallina-Rodriguez, Narseo; Anta, Antonio Fernández (2019): "Tales from the Porn: A Comprehensive Privacy Analysis of the Web Porn Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] and over an app store's “17+” tag [1Yao, Yifan; McCollum, Shawn; Sun, Zhibo; Zhang, Yue (2025): "Easy As Child's Play: An Empirical Study on Age Verification of Adult-Oriented Android Apps", in: Proceedings of the USENIX Security Symposium. (Link)]. Neither is a sample of the web, and neither generalises to a Tranco slice. If your population is a ranking list, say what fraction of it could plausibly be in scope of any age rule at all — most of it cannot — or your denominator will swamp your numerator.
2. Which jurisdiction you appeared to be in. Not where your VPS is: where the site thought you were. The 20%-vs-14% and the 8%/12% asymmetry in [3Vallina, Pelayo; Feal, Álvaro; Gamba, Julien; Vallina-Rodriguez, Narseo; Anta, Antonio Fernández (2019): "Tales from the Porn: A Comprehensive Privacy Analysis of the Web Porn Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] are the whole finding, and they come from repeating the same manual check from four countries. Since 2025 this has become sharper, not softer: the UK duty applies to services likely to be accessed by UK children, Texas's statute to Texas visitors, and Google Play returns age signals for Brazil and for Texas accounts specifically. Read Crawling location before choosing, and verify the vantage rather than assuming it.
3. What you counted as a gate. Per the table at the top of this page, a click-through and a document upload are both “an age gate” in ordinary speech and are different measurements. Publish the mechanism breakdown or publish a rule, and expect a reviewer to ask which of the eight rows you included.

One more denominator trap, specific to this topic: the app-store rating is not the gate. A “17+” or PEGI rating is a self-declared label about content, not a mechanism that checks anybody. Two papers measure the label rather than the gate — a 2013 comparison of Android and iOS maturity ratings found them inconsistent with the platforms' own policies [15Chen, Ying; Xu, Heng; Zhou, Yilu; Zhu, Sencun (2013): "Is This App Safe for Children? A Comparison Study of Maturity Ratings on Android and iOS Applications", in: Proceedings of the ACM Web Conference. (DOI)], and a 2023 study collected 11,270 ad views across 25,000 apps and identified 1,289 ad violations from 775 apps, “with roughly half of the app promotions not in compliance with host apps' content ratings” [16Zhao, Yanjie; Liu, Tianming; Wang, Haoyu; Liu, Yepang; Grundy, John; Li, Li (2023): "Are Mobile Advertisements in Compliance with App's Age Group?", in: Proceedings of the ACM Web Conference. (DOI)]. Useful work; not age assurance.

Ethics covers the ordinary web-measurement case: crawl politely, do not harm the site, get the review, consider the people behind the data. None of that answers the four questions this topic raises, and a methods section that cites a generic IRB approval has not addressed them.

This is a real gap on this wiki. Ethics should grow a section on it, and until it does, treat the four bullets above as the checklist a reviewer will apply.

Most of the literature a search for “age” returns is not about age assurance. It is about whether services aimed at children handle data lawfully — COPPA in the US, the GDPR's Article 8 and the age-appropriate design codes in Europe. 36 papers in the corpus name COPPA in their legal assessment, out of the 402 that assessed any law at all; exactly one of those 36 is also in the age-assurance population above.

The distinction is worth stating in your own paper, because reviewers conflate them:

• Age assurance asks does the service establish how old this visitor is. The unit is a mechanism. The denominator is services in scope of an age rule.
• Children's-privacy compliance asks given that this service is for children, what does it do with their data. The unit is a data flow. The denominator is child-directed services, and establishing that a service is child-directed is itself a classification problem with its own ground truth.

That second denominator is where the methodological interest is, and the corpus has four good constructions of it:

• The platform's own programme. [17Reyes, Irwin; Wijesekera, Primal; Reardon, Joel; Elazari Bar On, Amit; Razaghpanah, Abbas; Vallina-Rodriguez, Narseo; Egelman, Serge (2018): "“Won’t Somebody Think of the Children?” Examining COPPA Compliance at Scale", in: Proceedings on Privacy Enhancing Technologies. (DOI)] analysed 5,855 Android apps enrolled in Google Play's Designed for Families programme (no relation to this corpus's 5,855 full-text papers — a coincidence, and an unfortunate one) — apps that had agreed to COPPA compliance as a condition of listing — and observed 235 of them (4.0%) actually reaching GPS coordinates, with 28% touching permission-protected sensitive data. The denominator is exact and checkable, and it is emphatically not “children's apps”.
• A trained classifier over a general crawl. [13Moti, Zahra; Senol, Asuman; Bostani, Hamid; Zuiderveen Borgesius, Frederik J.; Moonsamy, Veelasha; Mathur, Arunesh; Acar, Gunes (2024): "Targeted and Troublesome: Tracking and Advertising on Children's Websites", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] fine-tuned a multilingual model on page <title> and <description> metadata, ran it over Common Crawl, and hand-verified 2,004 child-directed websites in 48 languages; crawling them from five vantage points, about 90% embedded at least one tracker and about 27% carried targeted advertising.
• Store metadata plus a rating scheme. [18Sun, Ruoxi; Xue, Minhui; Tyson, Gareth; Wang, Shuo; Camtepe, Seyit; Nepal, Surya (2023): "Not Seen, Not Heard in the Digital World! Measuring Privacy Practices in Children's Apps", in: Proceedings of the ACM Web Conference. (DOI)] and [19Alomar, Noura; Reardon, Joel; Girish, Aniketh; Vallina-Rodriguez, Narseo; Egelman, Serge (2025): "The Effect of Platform Policies on App Privacy Compliance: A Study of Child-Directed Apps", in: Proceedings on Privacy Enhancing Technologies. (DOI)] key on store categories, PEGI and Teacher Approved badges — cheap, and it inherits the label's error, which is the thing [15Chen, Ying; Xu, Heng; Zhou, Yilu; Zhu, Sencun (2013): "Is This App Safe for Children? A Comparison Study of Maturity Ratings on Android and iOS Applications", in: Proceedings of the ACM Web Conference. (DOI)] measured and found unreliable.
• The service's own age-tiered accounts. [14Figueira, Olivia; Trimananda, Rahmadi; Markopoulou, Athina; Jordan, Scott (2024): "DiffAudit: Auditing Privacy Practices of Online Services for Children and Adolescents", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] audits what an online service sends when the account is registered as a child versus an adolescent versus an adult — a differential design that needs no child-directedness classifier at all, because the service's own age tier is the treatment.

Also here: [20Medjkoune, Tinhinane; Goga, Oana; Senechal, Juliette (2023): "Marketing to Children Through Online Targeted Advertising: Targeting Mechanisms and Legal Aspects", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] on ad targeting that reaches children, and [19Alomar, Noura; Reardon, Joel; Girish, Aniketh; Vallina-Rodriguez, Narseo; Egelman, Serge (2025): "The Effect of Platform Policies on App Privacy Compliance: A Study of Child-Directed Apps", in: Proceedings on Privacy Enhancing Technologies. (DOI)] on what changed when the platforms tightened their policies. If you are writing about children's privacy rather than about age gates, start from those and from Mobile and app measurement: 25 of the 36 COPPA papers carry the mobile platform tag and only 9 carry web, so this is mostly an Android literature.

Given how fast this is moving, everything below is stated with the date it was verified rather than in the present tense. None of it is a finding; it is the reason the measurement gap matters.

The measurement consequence of the whole table is one sentence: the same URL fetched from two countries is two different experiments — which the 2019 paper already showed — and since 2025 the difference is something the law requires rather than something a site chose, while since March 2026 the same Android app on two devices may differ too.

There is a second consequence for anyone choosing a population now. Every academic figure on this page, and Ofcom's own 2026 report, is about pornography and adult-only apps. From Spring 2027 the UK duty extends to ordinary social media for under-16s, and Ofcom has already recorded “serious doubts” about the age-inference systems those platforms currently use. A crawl designed today against adult sites will be measuring the smaller half of the problem by the time it is published.

A reviewer should be able to reconstruct your gate count from the methods section alone. That needs:

1. The population, and why it is in scope of any age rule. Not “the Tranco top 10k” — say what fraction of it plausibly hosts age-restricted content and how you decided.
2. Which of the eight mechanisms you counted, and the rule that separates a gate from a cookie banner, a paywall and a login wall — all of which can present as a full-page overlay on the first load. Nobody has published such a rule; the features to build one from are a date-of-birth or age input, the tokens 18 and 21 near a confirm control, the eight-language keyword set [3Vallina, Pelayo; Feal, Álvaro; Gamba, Julien; Vallina-Rodriguez, Narseo; Anta, Antonio Fernández (2019): "Tales from the Porn: A Comprehensive Privacy Analysis of the Web Porn Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] widened to your own sample, a third-party verification origin, and a first-party cookie written at the moment the overlay is dismissed. A cookie banner names a purpose and a paywall names a price; a gate names an age.
3. Your vantage points, plural, and the verification that each one presented as the country you intended — Crawling location has the methods.
4. Statefulness. Whether the crawler carried the gate's own cookie between loads, and what it did to your counts.
5. The detector's error rate, measured against a hand-labelled sample. [1Yao, Yifan; McCollum, Shawn; Sun, Zhibo; Zhang, Yue (2025): "Easy As Child's Play: An Empirical Study on Age Verification of Adult-Oriented Android Apps", in: Proceedings of the USENIX Security Symposium. (Link)] does this — 100 apps sampled from each side of its own output, hand-verified, 3 false positives and 2 false negatives — and it is the only one of the two that does. [3Vallina, Pelayo; Feal, Álvaro; Gamba, Julien; Vallina-Rodriguez, Narseo; Anta, Antonio Fernández (2019): "Tales from the Porn: A Comprehensive Privacy Analysis of the Web Porn Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] reports no evaluation of its age-verification detector and abandoned it for manual checking. Sampling from your own output bounds precision well and recall badly; a sample drawn from the population rather than from the positives is the thing still missing.
6. What you did at the gate — clicked through, entered a date, or stopped — stated as an experimental condition in the same way Consent treats the banner. “We crawled the landing page” is the no-interaction condition, not the post-gate web.
7. The ethics decisions in the four bullets above, individually, not as “our institution approved this”.

Every corpus figure on this page comes from scripts/report_age_assurance.mjs, which prints the probe, the hand verdict for all 38 candidates, and a verbatim-quote check of 25 anchor sentences against the source PDFs. A second script, scripts/aa_quotespans.mjs, pulls every quoted span out of this page's own source and checks each one. Neither reads the prose around a number, so a figure stated in the page's own words rather than inside a quotation mark is checked by hand, not by a guard — the numbers in that position are 14%, 12%, 6%, 28%, 309, 12, 137/150/470, 27%, 25,000, 1,289 and 775. The script, its unedited output, the full verdict map, the discarded probe variants and the external sources that were rejected are on age_assurance. Corpus-level caveats — venue scope, the selection funnel, the provisional 2025–2026 years, extraction stability — are on Corpus.

Five limitations belong on the page itself:

1. Five papers is not a literature. Every corpus number in the What has actually been measured section is a single study's result about a single population, and none of them has been replicated. Treat them as existence proofs and as related work, not as base rates.
2. The regulator's figures are self-reported under compulsion, not measured. Ofcom's 69 million, 25%→43% and 64-of-100 come from information notices to 32 services plus Ofcom's own children's-experience survey, not from a crawl. They are the best deployment numbers that exist and they are not independently checkable; the report says so about circumvention itself.
3. The candidate set is a phrase probe, so it under-recalls by construction. A paper that measured age gates without ever using one of those fourteen phrases is invisible to it. Widening the probe to mechanism words — date of birth, identity verification, facial age, parental gate — added no new measurement papers, but that is a bounded negative, not a proof.
4. The corpus is seven venues. CCS, IMC, NDSS, PoPETs, USENIX Security, TheWebConf and IEEE S&P, 2010–2026. The usability, policy and legal literature on age assurance sits largely outside these venues — CHI, SOUPS, FAccT and law reviews are not in the corpus, and this page cannot speak to them. The absence measured here is an absence from the security and measurement venues, which is the claim worth making and the only one supported. It is not an absence of knowledge about deployment — see the regulator's report.
5. The regulatory table is not a legal analysis and is not exhaustive. It names, for each row, one primary source read on 2026-09-15.

1. Ofcom's Report on the use of age assurance (16 July 2026) — read this before the papers. 92 pages, and the largest deployment measurement this page could find anywhere; it is also the clearest statement of what a crawl would have to reproduce.
2. [1Yao, Yifan; McCollum, Shawn; Sun, Zhibo; Zhang, Yue (2025): "Easy As Child's Play: An Empirical Study on Age Verification of Adult-Oriented Android Apps", in: Proceedings of the USENIX Security Symposium. (Link)] — the only paper whose research question is age assurance. Read §2.2, Age Verification in Adult-Oriented Apps, whose Table 2 is the mechanism taxonomy, and §6, Attacking Apps with Age Verification, for the bypasses.
3. [3Vallina, Pelayo; Feal, Álvaro; Gamba, Julien; Vallina-Rodriguez, Narseo; Anta, Antonio Fernández (2019): "Tales from the Porn: A Comprehensive Privacy Analysis of the Web Porn Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] — §7.2 is the web case, the multi-vantage design, and the honest assessment of what the detector could and could not see.
4. [4West, Jack; Thiemt, Lea; Ahmed, Shimaa; Bartig, Maggie; Fawaz, Kassem; Banerjee, Suman (2024): "A Picture is Worth 500 Labels: A Case Study of Demographic Disparities in Local Machine Learning Models for Instagram and TikTok", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] — the only measurement of whether a deployed mechanism works (in one of its two case studies), and a clean template for the ethics of measuring an age model without measuring children.
5. [5Alomar, Noura; Egelman, Serge (2022): "Developers Say the Darnedest Things: Privacy Compliance Processes Followed by Developers of Child-Directed Apps", in: Proceedings on Privacy Enhancing Technologies. (DOI)] — read it for the self-report-versus-observation gap, which will bite any survey design here.
6. [17Reyes, Irwin; Wijesekera, Primal; Reardon, Joel; Elazari Bar On, Amit; Razaghpanah, Abbas; Vallina-Rodriguez, Narseo; Egelman, Serge (2018): "“Won’t Somebody Think of the Children?” Examining COPPA Compliance at Scale", in: Proceedings on Privacy Enhancing Technologies. (DOI)] — the reference construction for a children's-privacy denominator, and the kind of paper several of the age-assurance title probe's candidates turned out to be.

[1]

Yao, Yifan; McCollum, Shawn; Sun, Zhibo; Zhang, Yue (2025): "Easy As Child's Play: An Empirical Study on Age Verification of Adult-Oriented Android Apps", in: Proceedings of the USENIX Security Symposium. (Link)

[2]

Woodruff, Allison; Balfanz, Dirk; Drewry, Will; Raykova, Mariana (2026): "A Risk Assessment Framework for Digital Identification Systems", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[3]

Vallina, Pelayo; Feal, Álvaro; Gamba, Julien; Vallina-Rodriguez, Narseo; Anta, Antonio Fernández (2019): "Tales from the Porn: A Comprehensive Privacy Analysis of the Web Porn Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[4]

West, Jack; Thiemt, Lea; Ahmed, Shimaa; Bartig, Maggie; Fawaz, Kassem; Banerjee, Suman (2024): "A Picture is Worth 500 Labels: A Case Study of Demographic Disparities in Local Machine Learning Models for Instagram and TikTok", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[5]

Alomar, Noura; Egelman, Serge (2022): "Developers Say the Darnedest Things: Privacy Compliance Processes Followed by Developers of Child-Directed Apps", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[6]

Ekambaranathan, Anirudh; Zhao, Jun; Van Kleek, Max (2022): "Poster: An Analysis of Privacy Features in 'Expert-Approved' Kids' Apps", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[7]

Breuer, David; Becker, Lucas; Hollick, Matthias (2026): "Ad Personalization and Transparency in Mobile Ecosystems: A Comparative Analysis of Google's and Apple's EU App Stores", Proceedings on Privacy Enhancing Technologies 2026(1):604-630. (DOI)

[8]

Ardi, Calvin; Calder, Matt (2023): "The Prevalence of Single Sign-On on the Web: Towards the Next Generation of Web Content Measurement", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[9]

Moti, Zahra; Janssen-Groesbeek, Tom; Monteiro, Steven; Continella, Andrea; Acar, Gunes (2025): "WhisperTest: A Voice-Control-based Library for iOS UI Automation", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[10]

Mai, Cat; Coelho, Bruno; Kieserman, Julia; Matsumoto, Lexie; Spinelli, Kyle; Yang, Eric; Andreou, Athanasios; Greenstadt, Rachel; Lauinger, Tobias; McCoy, Damon (2025): "More and Scammier Ads: The Perils of YouTube's Ad Privacy Settings", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[11]

Gibson, Cassidy; Olszewski, Daniel; Brigham, Natalie Grace; Crowder, Anna; Butler, Kevin R. B.; Traynor, Patrick; Redmiles, Elissa M.; Kohno, Tadayoshi (2025): "Analyzing the AI Nudification Application Ecosystem", in: Proceedings of the USENIX Security Symposium. (Link)

[12]

Cui, Hao; Trimananda, Rahmadi; Markopoulou, Athina (2025): "Understanding Privacy Norms through Web Forms", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[13]

Moti, Zahra; Senol, Asuman; Bostani, Hamid; Zuiderveen Borgesius, Frederik J.; Moonsamy, Veelasha; Mathur, Arunesh; Acar, Gunes (2024): "Targeted and Troublesome: Tracking and Advertising on Children's Websites", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[14]

Figueira, Olivia; Trimananda, Rahmadi; Markopoulou, Athina; Jordan, Scott (2024): "DiffAudit: Auditing Privacy Practices of Online Services for Children and Adolescents", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[15]

Chen, Ying; Xu, Heng; Zhou, Yilu; Zhu, Sencun (2013): "Is This App Safe for Children? A Comparison Study of Maturity Ratings on Android and iOS Applications", in: Proceedings of the ACM Web Conference. (DOI)

[16]

Zhao, Yanjie; Liu, Tianming; Wang, Haoyu; Liu, Yepang; Grundy, John; Li, Li (2023): "Are Mobile Advertisements in Compliance with App's Age Group?", in: Proceedings of the ACM Web Conference. (DOI)

[17]

Reyes, Irwin; Wijesekera, Primal; Reardon, Joel; Elazari Bar On, Amit; Razaghpanah, Abbas; Vallina-Rodriguez, Narseo; Egelman, Serge (2018): "“Won’t Somebody Think of the Children?” Examining COPPA Compliance at Scale", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[18]

Sun, Ruoxi; Xue, Minhui; Tyson, Gareth; Wang, Shuo; Camtepe, Seyit; Nepal, Surya (2023): "Not Seen, Not Heard in the Digital World! Measuring Privacy Practices in Children's Apps", in: Proceedings of the ACM Web Conference. (DOI)

[19]

Alomar, Noura; Reardon, Joel; Girish, Aniketh; Vallina-Rodriguez, Narseo; Egelman, Serge (2025): "The Effect of Platform Policies on App Privacy Compliance: A Study of Child-Directed Apps", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[20]

Medjkoune, Tinhinane; Goga, Oana; Senechal, Juliette (2023): "Marketing to Children Through Online Targeted Advertising: Targeting Mechanisms and Legal Aspects", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)