How should I handle age verification in signups?

Question

I have a website where the minimum sign up age is 13 years old. In my sign up form there's a datepicker for selecting their age. The user would enter their date of birth, if they turn out to be below 13 years of age, they receive an error message such as:

You must be at least 13 years old to sign up to this website.

However, after seeing this error message they could easily change their date of birth to something over 13 and sign up anyway.

To circumvent this, I could lock the age field after it's first 'validated', but this would cause other issues. (What if they accidentally entered the wrong date of birth?)

So how should I handle age verification in sign up forms?

Answer 1

..they could easily change their date of birth to something over 13 and sign up anyway

One way to combat this is if the error was thrown, set up a cookie that will always show that error over the form and not allow resubmission for the next 12-24 hours or till the session ends (browser is closed).

But as for:

What if they accidentally entered the wrong date of birth?

There's no actual way of figuring that out, you could build in some safety measures like, when they try to submit, don't actually submit and show a modal with all the info and ask them to recheck and give the options to Edit or Continue.

Or prompt them somehow to verify if the information is correct before submitting.

You need to accept the fact that there's not perfect way of doing this, at the end of the day people make mistakes and they also lie (about their age in this case).

PS: Some websites apply some extreme measures such as, ok, you created the account but you can only verify your account and access the content by sending a photo of your ID, therefore making sure of the identity and birth date but, like I said, that's a little extreme and you could loose a lot of users due to the fact that people don't trust others with their ID and they are right to do so.

edX.org requires a government-issued photo ID before allowing you to pursuit certificate for a course.

Answer 2

You can't really force someone not to lie, and it's hard to tell apart a lie from an honest mistake.

However, you could check whether the age is below 13, and then asking user to confirm entered data is correct - without indicating anything is necessarily wrong. This won't bother those who are above 13, and can prevent some people from submitting the wrong date (this could tip off some people who would lie afterwards, but it's 13 y.o.s we're talking about, not criminal masterminds).

I also remember a while ago Google did an interesting thing - I don't remember the exact reason, but a certain period of time after registration it asked me to reenter my date of birth. Failing that, it locked out my account and asked to associate a credit card with it to confirm and unlock the account. It's a fair assumption to make that all people will remember their dates of birth, and liars probably won't know which lie they used on a registration form. Also, credit card works better for age verification, since government IDs can contain some legally confidential information (social security and equivalent numbers) and credit card validity can be automatically checked. You can tweak it a bit and it can double as a security feature.

Though any scheme of that kind sounds like a losing battle to me - nothing stops a person from crating a new account tomorrow, after learning of the requirements (and even clearing cookies; I can confirm this 13 y.o. did know about that, ymmv).