Vai al contenuto
VerifieroVerifiero

← Centro di conoscenza Verifiero

Questa pagina è disponibile solo in inglese.

Does your business really need to see the customer's entire ID?

Verifiero AB · · 5 min di lettura

Two mobile phones: on the left an ID card is photographed, showing name, date of birth, address, ID number, photo and nationality; on the right the app confirms only that the person is over 18.
Illustration: simplified picture of how an age check can work. It does not show the app's actual interface. Alex Example is a fictional person. The text in the illustration is Swedish.

A customer wants to buy something with an 18+ age limit. All the business really needs to know is one thing: yes, this person is over 18. Yet the customer is often asked to photograph their entire ID document, with name, date of birth, ID number and photo. This article is about why there is a smarter way to ask, and what it means for those of you building digital services.

We have got used to sharing more than we need to

A photo of a passport or driving licence has become a standard step in many flows: on marketplaces, in rental services, at gambling operators and in apps where people meet strangers. It is easy to build, and customers recognise the step.

But every copy of an ID document is data the business is responsible for. It needs a clear purpose, secure storage, timely deletion, and you must be able to account for it if the customer asks. The more copies there are in systems, inboxes and support tickets, the more there is to protect.

So the question is not only how you verify the customer, but what you actually need to know.

The future of identity verification is about asking smarter

Take the age limit as an example. Basically, there are two ways to handle it:

Option 1: a copy of the ID document

  • The customer photographs the whole ID document.
  • You receive name, date of birth, ID number, photo and everything else on it.
  • You have to review, store and protect the image yourselves.

Option 2: a limited, verified detail

  • The customer sees what is being requested and approves.
  • You receive the detail you asked for, for example age.
  • The rest of the ID document is not shared with you.

Both answer whether the customer is old enough. The second option does it with far less information: age instead of name, address and date of birth.

Try it yourself: approve the detail that is requested, or see what happens if you decline.

Request
Example with fictional details

Your service wants to know: Over 18

  • Full name

    Full name: Not shared

  • Photo

    Photo: Not shared

  • Date of birth

    Date of birth: Not shared

  • Nationality

    Nationality: Not shared

  • Home address

    Home address: Not shared

  • ID number

    ID number: Not shared

  • Over 18

    Over 18: Shared
With Verifiero

1 detail shared

Simplified demonstration with fictional details.

The principle is often called selective disclosure: the person being verified shares only what is needed in that particular situation. It is closely related to one of the core principles of the GDPR, data minimisation (Article 5(1)(c)): personal data must be adequate, relevant and limited to what is necessary for the purpose.

The EU is moving in the same direction

Selective disclosure is also part of the EU's own initiatives.

On 14 July 2025, the European Commission published guidelines on the protection of minors under Article 28 of the Digital Services Act. They recommend age verification to restrict access to, for example, pornography and gambling, and where national rules set a minimum age for certain services. According to the Commission, the methods should be accurate, reliable, robust, non-intrusive and non-discriminatory. The guidelines are not binding, but the Commission uses them as a benchmark when assessing whether platforms comply with Article 28(1).

On the same day, the Commission made a blueprint for an EU age verification solution available. According to the European Commission, it lets users prove they are over 18 without sharing any other personal information, and it became feature-ready on 15 April 2026.

On 29 April 2026, the Commission adopted a recommendation on age verification. It sets out the actions Member States are encouraged to take so that all EU citizens have access to robust and privacy-preserving age verification by 31 December 2026. The solution can be rolled out as a standalone app or integrated into a European Digital Identity Wallet.

The wallets are based on the EU regulation on a European digital identity, Regulation (EU) 2024/1183. According to the European Commission, Member States will make wallets available to every citizen, resident and business by the end of 2026, and users share only what is necessary. How and when the solutions reach users is up to each Member State.

Still, the direction is clear: showing one detail should not require showing everything.

What does this mean for businesses?

If you are responsible for a sign-up or checkout flow, three questions are a good place to start.

What do we need to verify?

Is it age, identity, nationality or something else? Start from the requirement, not from what is easiest to collect. Often a single detail is enough.

How easy is it for the customer?

Every extra step is a point where the customer may hesitate. Someone who understands why a detail is requested, and can see that nothing more is shared, finds it easier to say yes.

What information do we need to receive and keep?

What you never receive, you do not have to store, protect or delete. Review which details are kept after a verification today, and whether they are really needed afterwards.

This is general information, not legal advice. Which requirements apply depends on your business.

Verifiero – confirm what needs confirming

Verifiero is built on the same principle. Users register once in the Verifiero app with a passport, ID card or driving licence and a face scan. When a business then asks for something, the user sees what is being requested and approves or declines every share.

You connect the requests to your service through the Verifiero API. You choose which details to ask for and receive only what the user has approved. To check an age limit, you can ask for just the detail you need, for example age, instead of name, address and date of birth. Read more about Verifiero for business.

How the data is protected and where it is stored is described in our Trust Center.

Want to see the difference between a regular ID card and a limited share? Try the difference yourself on the home page, or try the login demo.

A question to take with you

If we built our verification flow from scratch today, would we still collect the same information?

Verifiero – Prove who you are. Not everything about you.

Sources

Sources checked on 20 October 2026.