Dwarpal tells a website whether someone is old enough, from a few seconds of camera — and keeps no photos. The website learns one thing: old enough, or not.
Three steps, a few seconds each. The website never sees your face.
Step 1
The website opens the check over its page. You look at your camera for a few seconds and turn your head when asked, so a photo can't simply stand in for you.
Step 2
An AI estimates your age from a few frames. It says yes only when it is sure you are over the website's age; when it isn't sure, it says so, and the website can offer a stronger check instead of a guess.
Step 3
The frames are checked once, in memory, and gone. The website receives a signed answer for its age line — old enough, or not — and nothing else.
An age check shouldn't cost you your privacy. These hold for every check, by design rather than by policy.
The figures of the age model running now, read from it as this page loads. Each age line trades keeping minors out against sending adults to a stronger check.
| Age line | Under the age who pass, at most | Adults 3+ years over turned away, at most | Adults just over sent to a stronger check |
|---|---|---|---|
| 13+ | not measured | not measured | not measured |
| 16+ | not measured | not measured | not measured |
| 18+ | not measured | not measured | not measured |
| 21+ | not measured | not measured | not measured |
Model stub. “At most” is a 95 % upper bound for any single age in the five years under the line. These lines don't yet meet Dwarpal's own release standard (2 % for every age and group), so this model decides test checks only.
Your server creates a session; your page opens the check; your server verifies the signed answer. The developer guides cover the rest.
import { DwarpalClient } from "@dwarpal/node";
const dwarpal = new DwarpalClient({
apiKey: process.env.DWARPAL_API_KEY!, // on your server only
baseUrl: "https://api.dwarpal.example",
});
export async function createAgeCheck(): Promise<string> {
const session = await dwarpal.createSession({
policy: "uk_osa_18",
returnUrl: "https://shop.example/age-check/complete",
});
return session.url;
}import { VerifyAgeButton } from "@dwarpal/react";
<VerifyAgeButton createSession={createAgeCheck}>
Verify my age
</VerifyAgeButton>The guides — the browser and Node.js SDKs, and a checklist before going live — are in the repository's docs/developers folder, with the API's OpenAPI document.
What the main rules ask of an age check, and how Dwarpal's design answers it.
What it asks
“Highly effective” age assurance: technically accurate, robust, reliable and fair. Ofcom lists facial age estimation among the methods that can qualify, with an age line set above the legal age.
How Dwarpal answers
Lines set with a margin below them, checked against the risk budget; a live-person check; a stronger check when unsure.
What it asks
Age assurance that is accurate, reliable, robust, non-intrusive and non-discriminatory. The EU's age-verification blueprint proves “over N” without revealing identity.
How Dwarpal answers
Only “over N” leaves Dwarpal; errors are measured for each group; people are told what happens before the camera starts.
What it asks
Age verification for sexual content in many states, upheld by the Supreme Court in Free Speech Coalition v. Paxton (2025).
How Dwarpal answers
A signed age token that the website's server verifies itself, with each check's method and policy recorded.
What it asks
Reasonable steps to keep under-16s off social media. The national trial recommends layers: estimation first, something more definite when uncertain.
How Dwarpal answers
That layering is Dwarpal's design: pass, fail, or a stronger check — with a line at 16.
What it asks
Anyone under 18 is a child, whose data needs verifiable parental consent; minors shouldn't be able to fake their age.
How Dwarpal answers
An adult check that keeps no identity — usable for the consenting parent too. Aadhaar Secure QR is planned, not built.
A draft summary, not yet reviewed by a lawyer, and not legal advice. Dwarpal is in development and hasn't been assessed under any of these rules.
What people ask before they look at the camera.
No. The frames from your camera are checked in memory, during one request, and never written anywhere. What is kept is numbers about the check — scores and the outcome — for the website's retention period.
No. It learns only whether you meet its age line, in a token Dwarpal signs. Not your estimated age, not a photo, not who you are.
Faces don't carry birth certificates. To keep people under the age out, the AI says yes only when it is sure, and people just over the age are the hardest to be sure about. When it isn't sure, you can confirm your age with a passport or ID card instead.
It is built not to be: you are asked to turn your head in an order chosen for that check, and a separate model looks for screens and prints. It isn't perfect, and the results of the attacks tried so far are published in its practice statement.
Its errors are measured for each age and group of people. The model now running doesn't yet meet Dwarpal's own standard for that, which is why it decides test checks only.
A website using Dwarpal should always offer another way. Dwarpal's own stronger check, with an ID document, needs a camera too, for its selfie.
Amber Cellars, a made-up wine shop, uses Dwarpal at its door, with the same few lines of code.