Author: Privacy Lens Africa
Introduction
As children increasingly engage online, a fundamental regulatory question emerges: how can we create safer online environments for minors without undermining their privacy and other digital rights? Age assurance, the process of establishing or estimating a user’s age to determine eligibility to access certain online content, products, or services, is gaining global attention as a potential tool to address this challenge.
In Africa, however, the regulatory landscape remains complex. While data protection frameworks and child online protection initiatives are developing across the continent, it remains unclear how existing laws require or guide age assurance. Should age assurance be a mandatory safeguard for digital platforms, a measure adopted in specific circumstances, or a regulatory intervention that requires clearer legal foundations?
Beyond child protection, age assurance raises critical questions about privacy, data minimization, proportionality, and the risk of excluding users who cannot readily verify their age. This article examines the evolving legal and regulatory approaches to age assurance in Africa, exploring whether the continent faces a regulatory gap or is witnessing a new trend in digital governance.
Understanding Age Assurance
Age assurance is not foreign to data protection laws. Although traditional data protection frameworks do not describe it as ‘age assurance,’[1] it still manifests in other forms. For example, these laws require data controllers to verify the age of users to determine how their information will be handled.[2] This is a form of age assurance. The European Commission defines age assurance as ‘the umbrella term for the methods that are used to determine the age or age range of an individual to varying levels of confidence or certainty, and the three primary categories of age assurance methods are: age estimation, age verification and self-declaration.’ The International Association of Privacy Professionals (IAPP) defines age assurance as ‘approaches or tools that help estimate or assess a child’s age and, therefore, allow services to be tailored to their needs or access to be restricted where required.’ The central theme in both definitions is age determination, age estimation or age assessment.
Why is age assurance important? This question was succinctly answered by the European Commission in its 2024 research report on age assurance typologies and requirements. It identified three main ways in which age assurance is legally relevant, namely:
- where laws set minimum age requirements for accessing potentially harmful products or services or undertaking certain legal acts,
- where a duty of care requires the protection of children, or
- where contractual terms restrict access based on age.
Even in these cases, platforms may also voluntarily implement age assurance without legal or contractual requirements.
Age Assurance Under African Data Protection Laws
The legal landscape for age assurance in Africa shows strong consensus on the need for data controllers to implement age and parental consent verification mechanisms.[3] The definition of a ‘child’ also varies across jurisdictions, influencing the scope of these protections.
Kenya is among the countries that explicitly mandate age and consent verification in their law, further expounded in secondary regulation. Section 33 of the Kenyan Data Protection Act requires a data controller or data processor to implement appropriate mechanisms to verify age and obtain consent of the parent or guardian to process a child’s personal data. In addition to this explicit provision, the Office of the Data Protection Commissioner (ODPC) issued a comprehensive Guidance Note on Processing Children’s Data in November 2025. This guidance explicitly addresses ‘age verification’ as an important tool for protecting children’s data, stating that methods must be proportionate, privacy-preserving and adhere to the principle of data minimization.[4] It notes that age verification methods include requiring users to enter their date of birth, using identity documents, implementing age gates, or conducting age checks with a secure third-party service.[5]
Similarly, in Nigeria, Section 31 of the Nigeria Data Protection Act (NDPA) 2023 requires data controllers to obtain parental or guardian consent and apply “appropriate mechanisms” to verify such consent and age when processing the data of a child under 18.[6] Section 31(3) further provides that, for purposes of this section, presenting any approved government identification document is an appropriate mechanism. This directly approves collecting more data, raising further data protection concerns.
Malawi takes it a step further to require implementation of an appropriate mechanism to verify age or the mental capacity of a natural person lacking legal capacity to exercise the rights of a data subject, and the identity of the parent or legal guardian providing the consent.[7] This broad obligation will require more data and resources. Other countries with similar general mandates on age and consent verification include Ethiopia,[8] Zambia,[9] and Botswana.[10]
Ghana’s revised data protection framework is also moving towards the same direction. Section 68(3) of the Data Protection Bill, 2025, requires data controllers to make reasonable efforts to verify that a parent or legal guardian has given consent before processing a child’s personal data. Crucially, Section 68(6) of the Bill stipulates that where a child provides personal data directly to an application or platform, the data controller “shall implement age verification mechanisms to determine whether parental consent is necessary.”[11] This explicit mandate places a direct technical obligation on platforms operating in Ghana. This aligns with the European Commission’s view that digital service providers bear the primary responsibility for ensuring proportionate age assurance.
Uganda established its age verification requirements through secondary regulation. The Data Protection and Privacy Act 2019 prohibits processing a child’s personal data unless parental or guardian consent is obtained, or the processing is required by law or necessary for research or statistical purposes, but does not include verification mandates.[12] The 2021 Data Protection and Privacy Regulations introduced a verification requirement by providing that every data collector, controller, and processor shall establish a system to ascertain the age of persons whose personal data is collected, used or stored and where the data subject is a child, they shall ascertain the manner of obtaining consent from a parent or legal guardian where necessary.[13] The provision is unclear on whether parental or guardian consent verification is required, but it could be implied.
Countries with Consent Verification and no Age Verification
Our research shows that some countries require consent verification but not age verification. For example, South Africa’s Protection of Personal Information Act (POPIA) prohibits processing children’s personal information under Section 34, subject to general authorizations in Section 35, but remains silent on technical mechanisms for age assurance. It requires a competent person’s consent to process a child’s information. It further requires data controllers to refrain from any action intended to encourage or persuade a child to disclose more personal information than is reasonably needed for a specific purpose. This could be read as directly opposing the idea of excessive data collection.[14] Other African countries exhibit further nuances. Seychelles mandates verification of the consent of a parent or guardian where a child’s data is processed but does not require age verification.[15] Similarly, the Democratic Republic of Congo’s Digital Code[16] and Mauritius’s Data Protection Act[17] mandate consent verification without extending the same obligation to age.
Yet, some countries require parental consent to process a child’s data but do not mandate consent or age verification. For example, Tanzania’s Personal Data Protection Act 2022 also prohibits processing a child’s data without written parental consent, a provision actively enforced by the Personal Data Protection Commission (PDPC), as seen in the 2025 case of Nyangoma Mwesingwa v Cecilia Maliganya, where a business owner was fined for commercially exploiting a minor’s image without consent.[18] Rwanda’s Law on Personal Data Protection and Privacy (Article 9) also requires parental or guardian consent to process the personal data of a child under 16. Notably, Rwanda, through the ICT Ministry, is considering a child online protection regulation, particularly for social media access, which will likely include robust age-verification provisions.
Regulatory Actions and Collaborative Efforts
Recognizing the limits of relying solely on statutory consent and age-verification requirements, African regulators and policymakers are increasingly turning to collaborative initiatives, public consultations, and strategic frameworks to address child online safety and age assurance.
In Nigeria, parallel regulatory and legislative approaches to child online protection are underway. In March 2026, the Minister of Communications, Innovation, and Digital Economy, in partnership with the Nigeria Data Protection Commission (NDPC), launched a national public consultation to gather citizens’ views on introducing age restrictions for social media use. This survey explored potential policy approaches, including minimum age requirements, strengthened age-verification systems, and platform accountability. The survey found that 83.4% of respondents supported some form of restriction on minors’ social media use, while concerns included harmful content, digital addiction, and online grooming. Discussions also highlighted potential measures such as age restrictions, digital identity verification, and stronger platform accountability, underscoring the growing importance of age assurance in Nigeria’s child online protection agenda. The Minister said Nigeria needs to focus on implementing safeguards, noting that it already has elements of digital identity infrastructure and platform verification systems that could support enforcement. He added that enforcement will require collaboration among government agencies, parents, schools, and technology companies. The NDPC aligned with the Minister’s remarks on the importance of safeguards and collaborative enforcement, adding that strengthening legal awareness, promoting a duty-of-care model for digital platforms, addressing privacy and age-verification concerns, and ensuring greater accountability by platform providers is crucial.
Prior to this, in December 2025, the House of Representatives passed the Child Online Access Protection Bill (HB.244), a landmark legislative effort to create a safe, responsible, and protected digital environment for Nigerian children. The bill compels Internet Service Providers (ISPs) and digital platforms to take proactive steps to restrict access to, or promptly remove, content that is harmful, violent, exploitative, or illegal, with a specific focus on Child Sexual Abuse Material (CSAM). It also provides for parental consent to be mandated through codes of practice.
Meanwhile, in February 2026, the Nigerian Communications Commission (NCC) issued its Internet Code of Practice 2026, setting new obligations for Internet Access Service Providers and for online platforms, digital service providers and application service providers operating in Nigeria. It covers internet access and traffic management, customer information and data security, spam, child online safety, unlawful content, artificial intelligence and emerging technologies, and governance requirements for certain digital platforms and service providers.
More recently, following increased news about child online harms and more countries contemplating social media bans for children, the Federal Ministry of Education, in collaboration with the Nigerian Communications Commission (NCC), announced plans to regulate internet access for children under 16 as part of Nigeria’s efforts to strengthen child online protection. Speaking on 10 September 2026, the Education Minister stated that security agencies would issue further guidelines in the coming weeks to address cyber threats and inappropriate online exposure. The proposed measures raise important questions about age assurance, protecting children’s privacy, and balancing online safety with children’s access to digital learning and information.
South Africa has witnessed a growing debate spearheaded by industry bodies. The Internet Service Providers’ Association (ISPA) has called for a local debate on age verification, noting that while protecting minors from harmful online content is a top priority, bans are “blunt instruments” with serious consequences, including privacy concerns associated with age verification. ISPA emphasizes that South Africa’s existing legal framework governing online harms is not fit for purpose and requires a balance between Constitutional rights and POPIA. Notably, South Africa’s POPIA and its implementing regulations do not include provisions on age verification.
At the continental level, regulatory efforts have focused on promoting the best interests of the child in the digital environment, without specifically identifying age verification as a means of achieving this objective. In May 2024, the African Union Executive Council adopted the Child Online Safety and Empowerment Policy, which establishes key principles for safeguarding children’s rights to safety and privacy online. The Policy seeks to support Member States in developing strategies and programs to promote child online safety and empowerment. Although it does not prescribe age verification requirements, it calls on Member States to promote age-centered design and set minimum standards to protect children in the digital environment. Building on this momentum, UNICEF and the GSMA launched the Africa Taskforce on Child Online Protection in Kigali in October 2025 to harmonize protection efforts, deepen cooperation among states and promote shared digital safety standards across the continent. This multi-stakeholder platform brings together governments, the mobile industry, civil society, and youth representatives from countries including Nigeria, Rwanda, and Zambia to coordinate efforts to protect children online and implement regional frameworks across Africa.
This continental approach aligns with national developments, where frameworks vary between mandatory age verification and a sole focus on consent. Meanwhile, participation in international joint statements and continental policies highlights a collective effort toward harmonized child safety standards across Africa.
Zambia, notably, launched its National Child Online Protection Strategy (2025–2029) shortly after, backed by a $1.8 million budget to safeguard children in digital spaces. Meanwhile, Nigeria and Rwanda have been exploring policy approaches to child online protection. In March, Nigeria launched stakeholder consultations to obtain feedback on proposed social media age regulation. Nigeria held a stakeholder engagement in June to discuss the survey results. In April, Rwanda followed a similar approach and launched a public survey to gather views on social media use among children under 16, to inform potential regulatory interventions. Although neither initiative has yet resulted in regulatory measures, Nigeria’s consultation specifically sought input on privacy and age verification, including whether age verification is an adequate mechanism for regulating children’s access to social media and what minimum data should be required for this purpose.
Implications for Data Protection
Implementation evidence shows that age assurance is not a silver bullet for child online safety. In Australia, despite strict minimum-age mandates that removed millions of accounts, regulatory evaluations found that nearly two-thirds of minors with active accounts were never prompted to verify their age. Children routinely circumvent these controls by using older relatives’ profiles, creating fake dates of birth, employing VPNs, or spoofing facial estimation systems. Similarly, while the United Kingdom’s Online Safety Act prompted millions of daily checks, Ofcom’s evaluation raised serious doubts regarding the reliability of age inference methods, highlighting that technical checks alone cannot substitute for broader, multi-layered protective frameworks.
The trajectory of age assurance in Africa presents significant implications for data governance. The primary challenge is implementing age verification systems without inadvertently undermining the privacy rights they aim to protect. Requiring users to submit government-issued identification or biometric data to access digital platforms creates massive repositories of sensitive personal data, increasing the risk of data breaches and surveillance.
Furthermore, the lack of harmonization across the continent creates a fragmented compliance landscape for digital platforms. A platform operating across Africa must navigate varying definitions of a “child” (ranging from under 16 to under 18) and differing standards for what constitutes an “appropriate mechanism” to verify age and parental consent.
Operationalising Age Assurance
For digital platforms and data controllers broadly operating in Africa, operationalising age assurance requires a shift from passive compliance to privacy-by-design. Simple age-gating checkboxes are increasingly untenable amid active regulatory enforcement and growing public concern. Organizations must implement proportionate age assurance mechanisms aligned with their services’ risk profile. For high-risk platforms, this may involve privacy-preserving age estimation technologies that assess age without retaining biometric data. For general services, platforms must integrate parental consent verification processes seamlessly into the user experience. Digital service providers, including social media platforms, online gaming services, search engines, app stores, and other online platforms that may be used by children and young people, must engage with local regulators and participate in public consultations to help shape age assurance frameworks that are technically feasible, contextually appropriate for the African digital landscape, and fundamentally respectful of users’ privacy rights.
[1] Although some countries are amending their laws to include specific age assurance requirements. For eg, DRC’s recent proposed amendments to its Digital Code to provide for the protection of minors in the digital environment mandates providers to implement proportionate age assurance. Senegal is also developing a law on Child Online Protection, which includes mandatory age assurance requirements on digital service providers.
[2] For example, Kenya’s Data Protection Act 2019 section 33(2).
[3] For example, the Nigeria Data Protection Act 2023, Section 31.
[4] Guidance Note on Processing Children’s Data, page 20.
[5] Ibid.
[6] Nigeria Data Protection Act, 2023, Section 31.
[7] Malawi’s Data Protection Act 2024, Section 17.
[8] Personal Data Protection Proclamation No. 1321/2024 (Ethiopia) Article 11(3)
[9] Zambia’s Data Protection act, Section 17(3).
[10] Data Protection Act 2024, Section 29(2)
[11] Ghana Data Protection Bill, 2025, Section 68.
[12] Data Protection and Privacy Act, Section 8.
[13] Section 11.
[14] Protection of Personal Information Act, 2013 (South Africa), Sections 34 and 35
[15] Section 23(2) Data Protection Act 2023
[16] Article 247.
[17] Section 30.
[18] Personal Data Protection Act, 2022 (Tanzania) Section 30(4); Nyangoma Mwesingwa V Cecilia Maliganya Complaint NO. PDPC/CMP/002/2025.