That initiative, which has maintained a low profile until recently, has scored two big wins. First, Meta announced in December that it would launch age keys on Instagram this year. The Free Speech Coalition, a nonprofit trade association for the adult entertainment industry, has also endorsed age keys as a privacy-preserving way to access pornographic material without compromising identity or security.

Although Privately partners with k-ID on age checks for social and gaming platforms, Privately has not joined the OpenAge Initiative. However, other leading age-check providers have signed on, including Incode, Persona, Socure, and Veratad, as well as platform owners like Meta and game developers like Konami.

K-ID’s corporate affairs officer, Luc Delaney, told Ars that age keys are stored in a password manager and are built on FIDO passkey technology that’s “as secure as the login that I use for my bank.”

For users accustomed to storing passwords, letting their devices store an age key may feel natural, especially since it doesn’t require opening an account or sharing an email address. Julian Corbett, the head of the OpenAge Initiative and a co-founder of k-ID, told Ars that some platforms have seen higher adoption of the tech than expected. On one platform that recently launched age keys, for example, about 80 percent of users chose to save them, he said.

For platforms, age keys could become a cost-effective solution. Because the only cost to the OpenAge Initiative is an encrypted handshake when the age signal is shared, platforms could perform “a million age checks using age keys for $3,000,” Delaney said.

Participating platforms can set limits on which types of age estimation are accepted and how recently the age check must have been completed. Any age keys lacking the right signals will be rejected.

The OpenAge Initiative’s website provides more details, including developer guides explaining how its double-blind system is designed to protect privacy. Essentially, when someone uses an age key, the age-check service provider requests access to the platform without knowing who the user is. Meanwhile, the OpenAge Initiative knows who the user is but doesn’t know which platform is receiving the age signal. The age check provider ultimately decides “yes” or “no,” granting or denying platform access.