Age Verification Compliance

Q: Which IDs and credentials does Stile accept?

Government-issued documents from 200+ jurisdictions — passports, driver's licenses, national IDs, residence permits — and ISO/IEC 18013-5 mobile driver's licenses from Apple Wallet and Google Wallet for the US states that issue them. The flow auto-routes to whichever credential the user presents; the merchant configures which credential types are acceptable for their ruleset.

Q: What does the eligibility signal contain?

A signed webhook with the eligibility decision, the matched age tier (18+, 21+, 25+, or a custom threshold), the jurisdiction Stile resolved against, a session ID, and an audit pointer. The merchant does not receive the document image, biometric template, or date of birth in the default configuration. Configurable retention windows are available for chargeback or fraud-investigation lookback.

Q: How is mDL handled differently from a document scan?

mDL flows present an in-wallet prompt — the user authenticates with the wallet, the wallet releases only the requested attribute (age tier), and the wallet's signed assertion is verified server-side per ISO/IEC 18013-5. There is no document image transmitted. The signed-webhook shape returned to the merchant is identical to the document path, so a single integration covers both.

Q: Where does verification run — client-side or server-side?

Capture happens in the user's browser or app via Stile's hosted iframe widget; the OCR, barcode cross-reference, liveness scoring, face match, and mDL signature verification all run server-side. The client never holds the verification result; the merchant receives it via the signed webhook bound to the session.

Q: Does Stile certify the liveness model against PAD standards?

Stile uses passive liveness with continuous model retraining against new spoof types. We do not currently claim ISO/IEC 30107-3 PAD certification — that statement requires an independent lab evaluation we have not yet completed. If a presentation-attack-detection certificate is required for your compliance regime, raise it before contracting and we will scope the lab evaluation.

One API for regulated eCommerce. Stile monitors US state rules and returns the right verification requirement for every session.

Document Capture
Liveness
Face Match
mDL
Age Tier
Signed Webhook

Read the docs Book a demo

// POST /v1/verification_sessions
{
  "type": "age",
  "workflow_id": "wf_01HQ9Z2N7K8VRPB",
  "jurisdiction": "US-CA",
  "return_url": "https://acme.com/verified"
}

// Webhook  verification_session.verified
{
  "type": "verification_session.verified",
  "data": {
    "object": {
      "id": "vks_4p9x2m",
      "object": "verification_session",
      "status": "verified",
      "type": "age",
      "current_method": "document_capture",
      "age_tier": "min_age_21",
      "jurisdiction": "US-CA",
      "verification_result": {
        "method": "document_capture",
        "confidence": 0.96,
        "age_verified": true,
        "face_match_passed": true
      }
    }
  }
}

Capabilities

One API for regulated age checks

Create a session, pass the merchant context, and let Stile apply the required rule before returning a signed result.

What is age verification compliance? Age verification compliance is the process of confirming a user meets the minimum age required by the applicable rule, without exposing unnecessary identity data. Stile checks accepted evidence and returns a signed age decision through a webhook. Stile verifies age against a credential-backed record; it does not estimate age from appearance.

Document scan

OCR plus barcode cross-reference for IDs across 200+ jurisdictions. Returns a normalized age tier matched to the merchant's ruleset.

200+ jurisdictionsPDF417 / MRZ

Liveness + face match

Passive liveness with anti-spoof scoring, paired against the document portrait. Sub-second; defeats injection, replay, and printed-photo attacks.

verifiedspoofed<1s

mDL + digital wallets

ISO/IEC 18013-5 mobile driver's licences. The wallet releases the age tier only; the merchant never sees the document.

ISO 18013-5Apple · Google

US jurisdictions

State age verification laws, resolved per session

Stile's compliance platform monitors US state requirements, including LA Act 440, TX HB 1181, UT SB 287, VA SB 1515, MS HB 1126, FL HB 3, and regulated alcohol, tobacco, and cannabis rules. Seven representative states shown; the full coverage map lives on /compliance/us.

State age verification laws, resolved per session
State	Minimum age	Rule source	Accepted documents
US-CA	21+	NMDAA · ABC Act	Driver's license · Passport · mDL
US-TX	18+	HB 1181 (adult content)	Driver's license · Passport · mDL
US-LA	18+	Act 440 (adult content)	Driver's license · Passport
US-FL	18+	HB 3 (adult content)	Driver's license · State ID
US-UT	18+	SB 287 (adult content)	Driver's license · Passport
US-VA	18+	SB 1515 (adult content)	Driver's license · Passport
US-MS	18+	HB 1126 (adult content)	Driver's license · Passport

How it works

How age verification works

Three steps. Create a session, collect evidence, receive a signed decision.

Capture

The merchant creates a session via POST. The hosted iframe handles document or wallet capture.

Document or wallet credential captured in-session

Verify

OCR and barcode cross-reference, mDL signature checks, liveness scoring, and portrait match. All server-side.

Liveness + face match run server-side

Signal

A signed webhook delivers the decision and the rule that applied. Verify the signature, then act.

Signed webhook returned with eligibility tier

POST /v1/verification_sessions
{
  "type": "age",
  "workflow_id": "wf_01HQ9Z"
}

ISO/IEC 18013-5 mDLiBeta PAD Level 1 & 2GDPR / UK GDPRHMAC-SHA256 webhooksWCAG 2.2 AA

Privacy

The merchant gets the answer, not the document

The default flow returns only what the merchant needs to enforce access: eligible or not eligible.

What the merchant receives

In the default configuration, the signed webhook returns only the eligibility decision and configured age threshold. The document image, biometric template, and date of birth never leave Stile.

Attribute disposition

age_tier: returned
status: returned
jurisdiction: returned
document_image: never
date_of_birth: never
biometric_template: never

Audit trail

Proof for the rule that applied

HMAC-SHA256-signed webhooks plus a verifiable audit chain. Counsel can see what was decided, when, which evidence was checked, and which rule was applied.

What you can hand to counsel

Every completed session records the rule Stile applied, the jurisdiction used, the verification result, the timestamp, and the signed event delivered to your system.

signed_eventjson

stile-signature: t=1747193410,v1=8c3d4f1a... {  "id": "evt_01HR3FK4S2NXQY6",  "type": "verification_session.verified",  "data": { "object": { "id": "vks_4p9x2m" } }}

Outcome

See the eligibility signal for your ruleset.

Tell us what you sell and where — we'll map the age-tier configuration.

Book demo

FAQ

Age verification, the parts buyers ask about

Government-issued documents from 200+ jurisdictions — passports, driver's licenses, national IDs, residence permits — and ISO/IEC 18013-5 mobile driver's licenses from Apple Wallet and Google Wallet for the US states that issue them. The flow auto-routes to whichever credential the user presents; the merchant configures which credential types are acceptable for their ruleset.

A signed webhook with the eligibility decision, the matched age tier (18+, 21+, 25+, or a custom threshold), the jurisdiction Stile resolved against, a session ID, and an audit pointer. The merchant does not receive the document image, biometric template, or date of birth in the default configuration. Configurable retention windows are available for chargeback or fraud-investigation lookback.

mDL flows present an in-wallet prompt — the user authenticates with the wallet, the wallet releases only the requested attribute (age tier), and the wallet's signed assertion is verified server-side per ISO/IEC 18013-5. There is no document image transmitted. The signed-webhook shape returned to the merchant is identical to the document path, so a single integration covers both.

Capture happens in the user's browser or app via Stile's hosted iframe widget; the OCR, barcode cross-reference, liveness scoring, face match, and mDL signature verification all run server-side. The client never holds the verification result; the merchant receives it via the signed webhook bound to the session.

Stile uses passive liveness with continuous model retraining against new spoof types. We do not currently claim ISO/IEC 30107-3 PAD certification — that statement requires an independent lab evaluation we have not yet completed. If a presentation-attack-detection certificate is required for your compliance regime, raise it before contracting and we will scope the lab evaluation.

Get started

Stop carrying state-by-state age rules

Tell us what you sell, where you sell it, and which checkout paths need verification. Stile will map the regulated-eCommerce use case to an age verification flow your team can integrate and your compliance team can review.

Book demo Read the docs

Hosted iframe or direct API, same signed result.

Age Verification Compliance

Document scan

Liveness + face match

mDL + digital wallets

State age verification laws, resolved per session

01Capture

02Verify

03Signal

What the merchant receives

What you can hand to counsel

01Which IDs and credentials does Stile accept?

02What does the eligibility signal contain?

03How is mDL handled differently from a document scan?

04Where does verification run — client-side or server-side?

05Does Stile certify the liveness model against PAD standards?

Capture

Verify

Signal