How Online Age Verification Actually Works in Ireland, and Why It Is Changing

Ask most people how a website checks their age and they will describe a date-of-birth box. Type a year, click continue, done. That is not verification. It is a declaration, and it has been failing for as long as it has existed. Anyone who has built a sign-up flow knows the difference between asking a question and checking an answer, and Irish law has now moved decisively onto the second side of that line.

The Gambling Regulation Act 2024, signed into law on 23 October 2024, writes identity and age checking into statute for the first time rather than leaving it to a regulator’s code of practice or an operator’s risk appetite. That has consequences for anyone building, buying or integrating identity software in Ireland, and it changes what a player sees on screen.

Consumer guides have begun tracking the same transition from the player’s side. Tech-Insider keeps a reference page on the Irish market, filed under online casino ireland, setting out what has come into force and what is still pending, and reading it alongside the statute shows where the gap between rule and practice sits.

This article stays on the technical side of that gap: what the checks do, what data they consume, and why the same requirement pulls in two directions at once. Gambling in Ireland is 18 and over, and nothing below is a route around that.

The three things a verification system is actually doing

Strip away the vendor language and any age assurance flow answers three separate questions, usually in this order.

First, does this identity exist? A name, address and date of birth that resolve to a real record somewhere. Second, is the person in front of the camera the person that identity belongs to? That is the hardest of the three. Third, has anything changed since the last time we asked? Identity is not a one-time event, and systems that treat it as one fail quietly.

Most Irish implementations answer the first with a document or a database, the second with a selfie and a liveness test, and the third with triggers that re-open the flow. Each has a different failure mode.

Document capture: the photograph is the easy part

When a user photographs a passport or a driving licence, almost none of the work is in the photograph. The system runs optical character recognition on the machine-readable zone, checks the check digits in that zone against the printed data, tests for the security features the document type should carry, and looks for the signatures of tampering: cloned fonts, a portrait resampled at a different compression level to the page around it, a screen photographed rather than a document.

The Irish driving licence and passport card both carry machine-readable data that makes this tractable. Utility bills and bank statements do not, which is why address documents are treated as weaker evidence. A PDF of a bill is trivially editable and a passport chip is not.

Document capture is also where most drop-off happens. Glare, a cropped corner, a dark kitchen at eleven at night. Providers quoting high pass rates are usually quoting images that reached the decision engine, not users who started.

Database lookup: the check the user never sees

Plenty of verifications never ask for a document at all. Instead the details entered at sign-up are matched against reference data: electoral registers, credit reference files, telco records, postal address files. If the name, address and date of birth resolve consistently across two independent sources, many risk models treat age as established without ever seeing a passport.

This is fast, cheap and invisible, and it is why some people are verified in two seconds while others are asked for identification. It also carries a structural bias. Thin-file individuals, meaning recent arrivals, students and people who move often, are far less likely to resolve cleanly. The system is not judging them, it simply has less to match against, and the result is that the people asked to do the most work are often those least able to produce a utility bill in their own name.

Liveness and the selfie match

Binding a person to a document requires two things that are often confused. Face matching compares the selfie to the portrait on the document and returns a similarity score. Liveness detection asks whether the camera is looking at a living human at all, rather than a photograph, a mask, a replayed video or a synthetic face.

Passive liveness analyses a single capture for the physical signals a real face produces: reflection behaviour, skin texture, depth cues, the way light falls across a three-dimensional object. Active liveness asks the user to turn the head, follow a dot or blink on cue. Passive is less intrusive and better for completion rates. Active is harder to defeat with a still image but easier to defeat with a prepared video, which is why the two are increasingly run together.

Generative video has made this an arms race rather than a solved problem. Any Irish team integrating a face-based check should be asking a supplier for its presentation attack detection testing and the standard it was tested against, not for a marketing figure on accuracy.

What the Gambling Regulation Act 2024 actually requires

Here is where Ireland stops being a matter of good practice and becomes a matter of statute. The Act deals with remote operators in a dedicated chapter, and is unusually specific for primary legislation.

Section 169 says a remote licensee may not open a gambling account unless the person is 18 or over and the licensee has verified both identity and age. It then names the acceptable evidence: either a document showing name, address and date of birth with a photograph of the person, or a document showing name and date of birth with a photograph, supported by two documents confirming the address.

Those supporting documents must have been issued within the previous six months and must be a utility bill, an insurance policy, or a document from the Revenue Commissioners or a Department of State.

Section 167 closes the obvious gap by prohibiting a remote licensee from providing gambling at all unless an account has been opened and registered first, removing any concept of play-first-verify-later. Section 168 requires a register of account-holders carrying name, address and date of birth. Section 158 makes permitting a child to participate an offence, with a defence only where the licensee was reasonably mistaken about the person’s age, judged by what a reasonable person would have concluded.

That last point is the one engineers should sit with. The defence is behavioural, not documentary. Ticking a box does not discharge it. Showing a considered, tested, monitored process might.

Re-verification: the triggers that pull a user back in

Verification decays. The Act recognises this concretely: section 171 requires a remote licensee to close an account where the holder has not gambled for thirteen months, with money in the account refunded, and where the operator cannot refund it after reasonable efforts, the money goes to the Authority for the Social Impact Fund. A dormant account is not left sitting as an unmonitored credential.

Beyond that, most well-designed systems re-open verification on a familiar set of signals: a change of address or name, a new payment instrument that does not match the account holder, a device or location pattern that breaks sharply from the established one, an expired document, a match against a self-exclusion or sanctions list refresh, or a manual review flag. The Act provides for a National Gambling Exclusion Register, being implemented on a phased basis, and once operative it becomes another list that accounts must be tested against continuously rather than once at sign-up.

The methods side by side

The GDPR tension nobody has fully resolved

Every method above except the last solves the age problem by collecting more personal data, often the most sensitive category of it. Verifying that someone is over 18 by photographing their passport means an operator now knows their document number, nationality, full date of birth and face. The regulator asked for one bit of information, over or under, and the implementation produced a file.

This is a real conflict, and Irish and European regulators have said so plainly. The European Data Protection Board adopted a statement on age assurance in February 2025, on which the Irish Data Protection Commission acted as a co-rapporteur, setting out principles for reconciling child protection with data protection. The direction of travel is towards processing only the age-related attributes strictly necessary, and towards tokenised models where a third party performs the check and the service receives only a threshold result rather than the underlying identity.

Irish Tech News has covered the practical end of this problem before, in research from Lero, the Science Foundation Ireland research centre for software, where a University College Dublin team found that children could bypass the age checks on every one of ten major social media apps simply by entering 16 as their age. The same study found biometric age recognition techniques carried their own limitations, and concluded that financial penalties, rather than the regulations themselves, were what actually moved providers to build stronger checks. That finding travels well into gambling. Enforcement, not drafting, changes engineering priorities.

The Act’s evidence list is also document-based rather than attribute-based. Section 169 allows the Authority to prescribe additional means of verification, which is the hook through which digital identity wallets and assured attribute exchange could eventually be recognised. Until that happens, the statutory floor is a photograph of a document and a six-month-old utility bill, a more data-hungry answer than the technology now requires.

Case study: what the UK did in 2019, and what it predicts for Ireland

Britain ran this experiment years ago, and the results are the best available guide to what Irish operators are about to encounter.

Before May 2019, remote operators licensed in Great Britain had a 72 hour grace period. A customer could deposit and gamble, and the operator had three days to confirm their age. The Gambling Commission removed that grace period with changes to its licence conditions and codes of practice taking effect on 7 May 2019.

From that date, operators had to verify name, address and date of birth before a customer could deposit funds, gamble with their own money or with bonus funds, or access free-to-play versions of gambling games. The reasoning on free-to-play was that a demo game functions as an invitation to gamble and familiarises the player with the product.

The observable consequences fell into a pattern worth anticipating. Sign-up conversion fell in the short term, because friction moved from after the deposit to before it. Operators responded by investing in silent database matching so most customers never saw a document request at all, which is why database lookup became the dominant first-line method rather than document capture.

Complaint volume shifted from withdrawal disputes, where customers had gambled and then failed verification when trying to take money out, towards onboarding friction, which is a much better class of complaint to have. And a market developed rapidly for identity providers, since almost no operator built this in-house.

Ireland is arriving at the same requirement by a different route, with two differences that matter. The Irish rule sits in an Act of the Oireachtas rather than in a regulator’s code, which makes it slower to amend but harder to argue with, and it carries criminal liability rather than only licence consequences. Ireland is also doing it on a phased timetable, which gives operators and their suppliers something Britain did not have: notice.

The prediction that follows is direct. Irish operators entering the new regime should expect verification to become a procurement decision rather than a development task, should expect database matching as the first line with documents as fallback, and should expect their real cost to sit in the exception queue rather than the happy path. The teams that fared best in Britain instrumented drop-off by step before the rule changed, not after.

Where the Irish rollout actually stands

This part requires care, because the position is still moving. The Gambling Regulatory Authority of Ireland was established in March 2025, a commencement order signed in early February 2026 brought licensing provisions into force, and the Authority opened business-to-consumer betting licence applications on 9 February 2026, with applicants required to publish a notice of intention in advance of filing.

The rollout is deliberately phased. The Authority’s own licensing guidance states that it is taking a phased approach to the different licence types, that it is engaging with the Revenue Commissioners on gaming licences and with the Courts Service and An Garda Siochana on lotteries, and that existing licence holders should continue to renew through the current bodies meanwhile. Remote betting came first. Gaming, the category that covers online casino, sits later in that sequence, and business-to-business licensing later again.

So the honest statement is this: Ireland does not yet have a settled population of fully licensed online casino operators under the new regime, and the operators Irish players encounter today are generally licensed elsewhere in the European Economic Area, most commonly in Malta. That is a description of the current reality, not a recommendation. For the current status of any category, check the Authority’s own register and licensing pages rather than any secondary source, including this one.

What a user should expect on screen, and what should worry them

A few observable signals separate a serious implementation from a poor one. A service that asks only for a date of birth has verified nothing. A service that lets money in before it verifies is running the model Britain abandoned in 2019 and Irish statute now forbids for licensed remote operators. A service that asks for a document but never a selfie has established that a document exists, not that you hold it. And a service that takes the full document when it only needed to know whether you are over 18 is over-collecting, which is a data protection question as much as a security one.

The statutory detail on all of this is short and readable. Section 169 of the Gambling Regulation Act 2024 sets out the evidence a remote licensee must obtain before an account is opened, and it takes about two minutes to read.

One last point. Age verification is a gate, not a safety system. It keeps under-18s out and does nothing for an adult whose gambling has stopped being recreational, and no amount of identity engineering addresses that. Problem Gambling Ireland, GamblingCare.ie and the HSE all provide free and confidential support, and the account-level tools the Act requires, including deposit limits and the coming National Gambling Exclusion Register, are the parts aimed at that problem rather than at the front door.

Frequently asked questions

Is entering my date of birth enough to satisfy Irish law?

No. For licensed remote operators, section 169 of the Gambling Regulation Act 2024 requires the licensee to verify both identity and age using photographic documentation, or photographic documentation supported by two recent address documents. The research on social media age gates shows how readily a self-declared date of birth is bypassed.

Why was I verified instantly when a friend was asked for a passport?

Almost certainly because your details resolved against reference databases and theirs did not. Electoral registers, credit files and address databases return a clean match for people with a settled address history and a thin result for recent arrivals, students or frequent movers. The document request is the fallback path, not a judgement about you.

Can a service verify my age without seeing my identity documents?

Technically yes, and this is where the field is heading. A tokenised model has a trusted third party perform the check and pass only a yes or no answer to the service. The European Data Protection Board pointed towards this approach in its 2025 statement on age assurance, though Irish statute currently names document-based evidence, with scope for the Authority to prescribe additional means later.

How long does an operator keep my verification data?

That depends on the retention period the operator can justify, which is a data protection question rather than a gambling one. Anti-money-laundering obligations typically require identity records to be kept for years after an account closes, so verification data usually outlives the account. Check the retention schedule in the privacy notice before uploading anything.

Are online casinos now licensed in Ireland?

Not yet as a settled position. Betting licensing opened first in February 2026, and gaming licensing, the category covering online casino, comes later in the phased rollout, with business-to-business licensing later again. Check the Gambling Regulatory Authority of Ireland’s licensing pages for current status rather than relying on a date quoted elsewhere.

Gambling is for over-18s only.