AgeOnce

What the vendor is

AgeOnce is an age verification API for businesses. Its homepage describes it as a privacy-first service that returns a signed age threshold and an Audit ID to the platform, not passport scans or face photos, and it calls itself age verification for high-risk businesses. For a site operator the flow is a redirect: the visitor goes to AgeOnce, completes a check, and comes back with a signed result that the operator's server validates before granting access. The homepage lists Adult Content Platforms among its use cases, and its US compliance page is written for adult sites facing the state laws modeled on Texas HB 1181, which it says 27 states now enforce. Other pages address custom apps, marketplaces, streaming platforms, forums and WordPress stores.

The company name is not settled on the pages. The footer reads AgeOnce Inc., but the Merchant Terms say AgeOnce "is currently operated as an independent project" and that the company intends to complete formal registration, for example as a Delaware limited liability company, as the business grows. The registered entity will then be the named counterparty.

What it sells an operator

The product is the verification step and the status token it returns. The homepage says a new user completes an ID and liveness check in under 30 seconds, and a returning user re-proves with a light face check instead of a new upload. Because verification runs on a network, a user who has verified on any AgeOnce site can verify on another instantly. The API returns a signed result; the docs show a validation response carrying an age_verified flag, a min_age value and a verification_id, and the FAQ says the age token is valid for 10 minutes by default. Thresholds of 16+, 18+ and 21+ are supported. Each successful check returns a Transaction ID that the operator can store with an order or account and later search in the dashboard's Audit Logs, which show when and how the verification was completed.

Integration routes are the REST API, OAuth 2.0 with token validation, and SDKs for Node.js, Python, PHP, Go, Ruby and Java. The WordPress plugin covers WooCommerce checkout, an optional store sign-up gate, and content restriction by category, tag, post, page, product or custom post type, plus a manual lock on individual posts. The streaming page is the most relevant for adult operators: it argues for gating at the content boundary rather than at sign-up, and lists adult creator subscription pages, paid adult tiers, pay-per-view livestream purchases, tip flows on restricted streams and membership sites with mature libraries as surfaces to gate, with the token validated server-side before the player loads or the stream connects.

Pricing is by usage. The homepage says the company charges only for successfully verified age statuses, with no fees for failed attempts or bot traffic. The free plan includes up to 100 verifications a month, needs no card to start, and stays free for as long as the operator uses it. The Merchant Terms say usage-based charges are metered from verification events and that subscription plans renew automatically at the then-current rates. The pricing page states its model in words, a one-time ID check followed by a 3-second face scan for returning visitors, and its text prints no paid plan rates.

The terms that decide the choice

Adult sites are an intended customer: the US compliance page walks adult operators through the state laws and describes the design those statutes expect, a government ID check before access, a signed result and Audit ID kept on file, and no identifying information retained. The Merchant Terms carry no adult-specific content rule. Their acceptable use section forbids using the platform to harass, defraud or unlawfully discriminate against end users, to bypass age-restricted laws, to process data for advertising or profiling unrelated to age verification, or to distribute malware. Merchants must also present AgeOnce fairly to their users, including its 16+ minimum platform age, request only the lowest threshold their legal duty requires, and never try to re-identify users from verification results.

Retention is described in different terms across the pages. The homepage and FAQ say biometric data is processed in real time and not stored, and that the company keeps only the fact of a successful verification. The Data Processing Agreement lists "facial geometry scans and the mathematical face templates derived from them, stored in protected form" among the personal data it processes, and says templates for end users who keep using AgeOnce with other merchants "may remain in their own user records". The DPA makes AgeOnce a processor for end-user data and a controller for account data, and names Google for optional sign-in and Sentry for monitoring as sub-processors.

Money terms sit in the Merchant Terms. Fees are payable in advance, are non-refundable unless the terms or an order form say otherwise, and are processed by Stripe; the customer bears taxes, and late payment can bring suspension after notice and late-payment interest where the law allows. Either side may end the agreement at the close of the current subscription period by written notice, and the WordPress FAQ says a paid plan can be canceled with one click in the dashboard. In October 2026 the terms cap each party's liability at the greater of the fees paid in the 12 months before a claim or $1,000, with carve-outs for confidentiality, indemnity and payment. The platform is provided as is, with no warranty on the accuracy of document reading or face matching, and the terms call age verification a risk-mitigation tool rather than a guarantee of anyone's age. Merchants indemnify AgeOnce against claims tied to their own age-verification obligations.

Disputes with US-based merchants go first to 30 days of informal resolution and then to binding individual arbitration administered by JAMS, seated in Wilmington, Delaware, under Delaware law, with a 30-day opt-out by written notice. For merchants formed outside the United States the arbitration clause does not apply.

Getting started and support

The homepage describes a typical integration as one that takes a day or less: add a redirect URL, handle the callback, validate the token and set a session flag. The FAQ gives finer estimates, from 30 minutes to a few hours for a basic setup, 5 to 10 minutes for WordPress with the plugin, 30 to 60 minutes for Node.js, Python or PHP, and several hours for a custom build. The WordPress documentation sets out a checklist: install the plugin, create an account, copy the redirect URI into the dashboard, paste the client ID and secret, choose the protected products or pages, and test in a private browser window. The plugin needs WordPress 5.0 or newer, PHP 7.4 or newer, HTTPS and an active account, plus WooCommerce 5.0 or newer for checkout protection. A live demo runs on the site.

The contact page promises a reply within one business day to questions about the API, WordPress and WooCommerce, compliance or an integration. The Merchant Terms describe support as best effort by email during normal business hours unless a plan states otherwise, and say scheduled maintenance will be announced in advance where feasible.

Company and track record

Beyond the entity question, AgeOnce gives no founding year, headquarters, team or client list. The homepage claims GDPR compliance, BIPA and CCPA readiness, eIDAS 2.0 alignment and AES-256 encryption, as the vendor's own statements. The company publishes regulatory guides on US state, UK and EU age verification rules, with the US page dated to October 2026 and a running blog on laws such as Texas HB 1181 and New York's SAFE for Kids Act.

Who it suits

AgeOnce is filed under age verification only. It suits a paysite, creator platform or adult streaming service that wants checks on paid or restricted surfaces, server-side token validation and light reverification for returning members, and a WooCommerce store selling restricted goods that wants a plugin with a free start and billing per verified status. It suits less well an operator that wants a registered company as counterparty today, one consistent statement on face-template retention, or published plan rates. Its strength is a record model built for the retention bans in US adult-content laws: the operator keeps a threshold, a timestamp and an Audit ID rather than identity documents.