Windows Age API: How Microsoft's Age Verification Works

Microsoft has spelled out a Windows platform framework that lets apps request an age signal tied to a user's Microsoft Account, and it's calling that framework the Windows Age API. Microsoft says age verification is available in Microsoft Storefronts in Singapore, Brazil, and Australia; in Australia, the announced requirement specifically extends to Microsoft Store and Xbox storefronts (Microsoft Source LATAM, this week). Whether Xbox purchases in Singapore and Brazil see the same check isn't established in Microsoft's announcement, and there's no Windows setting you can flip on yourself, so for most PCs, nothing changes today. Microsoft's own framing draws a clear line: "every Windows consumer experience begins with identity," rooted in your Microsoft Account rather than the operating system as a whole (Microsoft Source LATAM).

That's easy to collapse into one headline, but three separate things are going on: the architecture Microsoft built (an age signal apps can check), the policy layer (which countries currently require a check), and adoption (which apps or services actually use that signal today). Only the storefront layer has a confirmed, consumer-facing rollout right now. The API underneath it is real, not a proposal on paper, and it's already available to Windows Insiders. What Microsoft hasn't described is broad consumer access, or named a single third-party app using it.

How the Windows Age API works for apps

An age signal only matters once something checks it, and three separate pieces have to line up before that happens: developers need access to the API, a Microsoft or third-party service needs to actually query it, and users need some way to see or control the result. Right now, only the first piece is confirmed at scale, through the Windows Insider program. Microsoft's announcement doesn't name a built-in Windows feature or third-party app that queries the signal beyond its own storefronts, and it doesn't describe a setting where a user turns any of this on or off.

The company describes a simple model behind Windows age verification for apps: your Microsoft Account establishes identity, that account carries an age signal, and the signal unlocks an age-appropriate experience along with matching parental controls (Microsoft Source LATAM). The API itself has three named pieces, and they haven't all shipped yet.

GetUserAgeRangeAsync returns a non-personally-identifying age band, not a birth date, drawn from five categories: under 10, 10-12, 13-15, 16-17, and 18+. That lets an app adjust what it shows while protecting birth-date data and general privacy (Microsoft Source LATAM).

GetAgeVerificationStatusAsync returns a verified age status for situations where a self-reported age isn't good enough on its own. CheckAgeStatusAsync hasn't shipped at all. It's built to extend an older API, CheckUserAgeConsentGroupAsync, and is meant to classify a user as a child, minor, or adult under global and regional rules. Microsoft says it's arriving "with a future update," with no build number or date attached to that promise (Microsoft Source LATAM).

Layered on top of the API is Microsoft Age Verification, or MAV, described as a centralized platform meant to let someone verify their age once and reuse that status across Microsoft's own experiences (Microsoft Source LATAM). That's the intended design. Whether it actually works that way across different Microsoft products today isn't something the announcement demonstrates one way or the other.

Because Microsoft describes the whole system around the Microsoft Account, shared PCs raise a question the announcement doesn't answer: how does the signal behave when several people use the same device, or when a local Windows account was never linked to an MSA in the first place? Worth watching if your household shares a login.

What's live, what's announced, and what's still just an API

Not everything Microsoft described moves at the same speed. Here's the rollout split into three states, from developer-only access to an announced but unconfirmed regional requirement:

• Available to Windows Insiders, without a described path for everyone else. The Windows Age APIs are broadly available on Windows Insider builds, and Microsoft says general availability is coming "soon," without a build number, version, or date attached (Microsoft Source LATAM). Microsoft's announcement doesn't describe a consumer test workflow or a user-facing setting tied to the API, and it doesn't name any third-party app currently using it.

• Live now, in three named storefront markets. Microsoft's announcement confirms that age verification is available in Microsoft Storefronts in Singapore, Brazil, and Australia (Microsoft Source LATAM). In Australia, the announced 18+ requirement specifically covers both Microsoft Store and Xbox storefronts (Microsoft Source Asia); the Singapore and Brazil confirmation doesn't separately name Xbox, so don't assume the same scope applies there yet. Neither announcement specifies which purchases, apps, or account types actually trigger a prompt in any of the three markets, so don't assume every transaction there prompts for verification.

• Announced in Australia, current status unclear. Microsoft emailed all Microsoft and Xbox account holders in Australia in late July, telling them they'll soon need to confirm they're over 18 to download apps and games rated for adult audiences through Microsoft Store and Xbox storefronts, tied to Australia's Age Restricted Material Online Safety Codes (Microsoft Source Asia).

Microsoft said on August 10 that the requirement would arrive "in the coming weeks." That announcement doesn't provide a later enforcement date, so treat the 18+ check as announced rather than confirmed active. If you hold an Australian Microsoft or Xbox account, check the Store or Xbox app directly rather than assuming the requirement is, or isn't, live based on that original wording.

What Microsoft account age verification protects, and what it doesn't explain

Two separate layers are at play here, and Microsoft's messaging mostly addresses one of them. The first is what an app receives: GetUserAgeRangeAsync hands apps a non-personally-identifying age category rather than a birth date, which is the privacy protection Microsoft emphasizes (Microsoft Source LATAM). The second layer, what the verification provider itself collects, retains, or shares to produce that category in the first place, is where the announcement goes quiet.

In Australia, Microsoft says users will be able to choose among several verification methods: email-based verification, facial age estimation, an official document scan, or a credit card, run through partners Yoti and Verifymy (Microsoft Source Asia). Microsoft's announcement doesn't specify retention and deletion practices for whichever method a user picks. Those specifics live in the providers' own policies, not in Microsoft's post.

Independent research offers a useful benchmark here, though none of it evaluates Microsoft's rollout directly. Researchers at the Knight-Georgetown Institute studied age assurance systems broadly and concluded that no single age signal is reliable enough on its own, that privacy protections vary sharply between verification methods, and that letting users choose their preferred method generally protects privacy better than forcing everyone through a fixed sequence (KGI, earlier this year). That gives readers a benchmark for assessing Microsoft's multi-method design; KGI did not evaluate this rollout.

The same researchers note that common systems can require users to hand over identifying information or a facial image, leaving them dependent on an age-verification provider's handling and security practices, often with no prior relationship to that provider (KGI). KGI also found that every current age-assurance approach can be circumvented to some degree, regardless of method.

On facial age estimation specifically, a NIST evaluation of six algorithms found accuracy varies with image quality, gender, and a person's region of birth, with error rates almost always higher for female faces (NIST, in 2024, updated in early 2025). NIST didn't test Yoti or Verifymy, so none of that shows either vendor shares those specific error patterns. It's still a reason to treat any accuracy claim from a facial-estimation vendor with some skepticism until it's been independently tested.

What Microsoft hasn't answered yet

The September announcement describes capability more than confirmed use. Beyond Microsoft's own storefronts, it doesn't name a single third-party developer or non-Microsoft Windows app adopting the age API.

There's a U.S. policy signal worth flagging, though it's not evidence of an imminent domestic rollout. The FTC said earlier this year that, under specified conditions, it generally won't pursue COPPA enforcement against general-audience and mixed-audience services that collect data solely to verify a user's age, provided they limit how that data is used and delete it promptly afterward (FTC, earlier this year). That's an incentive structure for U.S. companies operating under those conditions, not proof that a Windows age check is headed to American accounts on any particular timeline.

This rollout leans on emailed prompts, and that makes it an easy target for impersonation no matter where the underlying API stands. Unsolicited emails asking for personal verification are simple to fake. Rather than clicking a link inside an email, open the Microsoft Store, the Xbox app, or account.microsoft.com directly and look for the verification prompt there. Treat any request for a document scan, a facial photo, or payment details with the same caution as an unexpected request for financial information.

What to do now

If you hold an Australian Microsoft or Xbox account, don't assume the 18+ requirement is active or inactive based on the "coming weeks" language from Microsoft's August announcement; open the Store or Xbox app and look for an actual prompt before acting on anything tied to it. If you're in Singapore or Brazil, storefront verification is confirmed, but trust only a prompt that appears inside the Store or Xbox app itself, not one that arrives by email.

Everywhere else, Microsoft has not announced a user-facing Windows setting or a broader consumer rollout. Insiders may have access to the underlying APIs, but joining the Insider program isn't documented as a way to activate age verification in ordinary apps. Wait for Microsoft to announce general availability, or to name specific apps using the signal, before treating this as something to enable, test, or configure.