For most of the web’s history, confirming a visitor’s age meant clicking a button that said “I am over 18.” That button asked nothing and proved nothing, and a growing set of laws now treats it as insufficient. In March 2026, Brazil’s ECA Digital — the Estatuto da Criança e do Adolescente Digital, Lei 15.211/2025 — came into force and, per the Brazilian Senate, requires reliable age-verification mechanisms at each access, expressly setting aside simple self-declaration (vedada a autodeclaração) for content not appropriate for minors. The obligation reaches across social media, games, apps and messaging, app stores, operating systems, and video platforms, and it asks operating systems and app stores to pass a reliable age signal to applications through a secure interface.
The law is deliberately technology-neutral — it sets the requirement, and leaves the method open. That is the interesting part for anyone who builds identity systems, because the obvious methods sit in tension with each other. Asking every user to upload a government ID to every website satisfies the law and creates exactly the kind of identity-linked record that data-protection regimes work to avoid. Brazil’s own institutions have noticed this tension: as the legal analysis collected by Migalhas records, the Federal Public Ministry and the data-protection authority ANPD have pointed toward privacy-preserving approaches built on verifiable credentials, and ANPD has set out minimum principles — proportionality, accuracy, data protection — that a compliant method should meet.
This edition is about the architecture that answers the question well: how a digital wallet can establish that someone is old enough without revealing who they are or when they were born.
Three ways to answer the same question
There are, broadly, three ways to confirm that a visitor is over 18, and they differ enormously in what they reveal.
The first is self-declaration — the old button. It reveals nothing because it verifies nothing.
The second is document presentation: the user uploads a passport or driver’s license, or submits to a face scan, often through a third-party vendor. This verifies effectively, and it also transfers a complete identity record — name, document number, full date of birth, photograph — to a party that only needed to know one thing. Where that record is retained, it becomes a standing asset that has to be protected.
The third is a selective-disclosure credential. The user holds a credential issued by a trusted authority — a government identity body, for example — inside a digital wallet, and the wallet releases only the attribute a given interaction requires. Asked whether the holder is over 18, the wallet answers that question, and only that question. This is the model the standards bodies have organized around, and the foundational version of it is the one we covered in our April 23 edition on the full lifecycle of a verifiable credential: a credential is issued once, held by the person, and presented many times, with the holder deciding each time how much to share.
How a wallet proves “over 18” — and how a zero-knowledge proof goes further
Selective disclosure already narrows what is shared from a whole document down to a single field. Zero-knowledge proofs narrow it further still: they let a wallet prove a statement about an attribute without revealing the attribute itself.
A zero-knowledge proof, as our February edition on zero-knowledge proofs explained with a driver’s license, rests on two properties. Soundness means the holder cannot produce a valid proof of a false statement — a person under 18 cannot generate a proof that they are over 18. Zero-knowledge means the proof discloses nothing beyond the statement’s truth. Applied to age, the wallet proves the predicate “date of birth is more than 18 years ago” and returns a verifiable yes, while the birthdate itself stays in the wallet. The Electronic Frontier Foundation, describing the same mechanism, notes that a person can confirm they are over a threshold without showing an ID document or even disclosing their exact age.
This is no longer theoretical. In July 2025, Google open-sourced a zero-knowledge-proof implementation for age verification, published under an open license at github.com/google/longfellow-zk, designed to work with the ISO mDoc mobile-document format and W3C Verifiable Credentials so that a holder can prove they are over a given age without revealing their birthdate or identity.
The standards underneath, and the EU as a working reference
The reason these proofs travel between a government issuer, a citizen’s wallet, and a website is a shared standards stack, the same one this newsletter has tracked across editions. Age attestations are expressed using the attribute model of ISO/IEC 18013-5, the Mobile Driving Licence standard at the heart of our May 14 edition on how the mobile driver’s license works, alongside W3C Verifiable Credentials. They are presented to a website over the W3C Digital Credentials API and OpenID for Verifiable Presentations (OpenID4VP), the protocol that lets a browser request a specific attribute and a wallet respond with a verifiable answer.
The most developed public reference is the European Union’s age-verification solution. Per the European Commission and its official age-verification portal, the Commission made a blueprint available on 14 July 2025 and a feature-ready solution on 15 April 2026, with a pilot under way among several front-runner Member States ahead of wider availability, and the solution built on the same specifications as the EUDI Wallet rolling out across the EU by the end of 2026. The Commission’s Age Verification Manual documents the stack precisely: the proof-of-age data model is based on the ISO/IEC 18013-5 attribute schema, presentation runs over the W3C Digital Credentials API and OpenID4VP, and zero-knowledge-proof support is being added so a holder can prove a threshold — adaptable to 13, 18, 65, and others — without disclosing any further attribute.
Brazil and the EU thus arrive at the same architectural answer from different legal starting points: a credential the citizen holds, a single attribute released on request, and open standards underneath so the proof is portable.
Where Sovra fits
This is the architecture Sovra already builds on. Age verification done well is a specific application of a general capability: a government or trusted authority issues a verifiable credential, the citizen holds it in a wallet, and only the attribute a given interaction needs is released. Sovra issues and verifies credentials on exactly the open standards this conversation runs on — W3C Verifiable Credentials, ISO 18013-5, and OpenID4VP.
In practice that maps to two layers. SovraID is the verifier side — the infrastructure an institution or platform uses to request and check a single attribute such as an over-18 assertion. SovraWallet is the citizen side — where the credential lives and from which selective disclosure is made — with credential integrity anchored through SovraChain. An over-18 proof is a new presentation of a credential type this architecture is already designed to support, rather than a separate system to stand up. The most direct way to understand selective disclosure is to see it live.
For institutions across Latin America watching Brazil’s framework take effect, the practical reading is that the privacy-respecting path the regulators point toward — verifiable credentials with selective disclosure — is built on standards that are open, shared, and already operational.
Worth reading this week
From The Identity Brief — the editions that ground the mechanics above: Zero-Knowledge Proofs Explained With Your Driver’s License (the cryptography behind a “yes” that reveals nothing else), How the Mobile Driver’s License Works (May 14, the ISO 18013-5 credential family used for age attestations), The full lifecycle of a verifiable credential (April 23, the issue-hold-present model), and What Agentic Gov Requires (May 21, selective disclosure in a broader institutional setting). The full Sovra knowledge base is at sovra.io/knowledge.
Primary sources on the rules — the Brazilian Senate’s summary of ECA Digital entering into force and, for the implementation debate, the Migalhas analysis of age verification under ECA Digital.
The EU reference implementation — the European Commission’s age-verification policy page, the official age-verification developer portal, and the EU Age Verification Manual with the full standards stack.
The cryptography and its limits — Google’s open-source longfellow-zk zero-knowledge age-verification library, the W3C Verifiable Credentials Data Model 2.0, and the EFF’s measured note on why zero-knowledge proofs alone are not a complete digital-ID privacy solution.
Continue the conversation
More on selective disclosure, the verifiable-credentials stack, and how an over-18 proof is constructed across W3C and ISO 18013-5 formats is available at sovra.io/knowledge.
If your platform or institution is working through age-verification requirements — in Brazil, across Latin America, or aligned to the EU model — and weighing how a selective-disclosure credential could fit, contact us.
The Identity Brief is published weekly by Sovra, the Digital Identity Stack for the Institutional World.