Verified Person & Age Token for digital platforms.
VPAT is an open, cryptographically verifiable token standard that proves a user is a real person and belongs to a specific age group — without revealing their name, date of birth or ID number.
Platforms collect more data than they need.
Social networks, marketplaces and content platforms must answer simple questions: Is this a real person? and Is this user old enough?. But current solutions require full identity checks, ID document uploads and long-term storage of sensitive data.
Three critical challenges
- Fake & bot accounts scale faster than manual checks can handle.
- Youth safety requires reliable age checks without invasive identity collection.
- Regulations (e.g. eIDAS 2.0, DSA, AML) demand higher assurance and better privacy.
A minimal, standardized proof instead of full identity.
VPAT defines how trusted Identity Providers issue a compact, verifiable token that proves personhood and age group – without exposing personal details to the relying platform.
What VPAT introduces
- Verified Person Token – proves that the subject is a real, verified human.
- Age Token – provides age bands (13+, 15+, 18+, 21+) instead of birth dates.
- Service-scoped proofs – every platform receives a unique, non-linkable token.
- Governance model – defines trusted IdPs, LoA and compliance expectations.
Privacy-preserving by design.
VPAT follows a small set of principles that make it suitable for global platforms, EU deployments and independent security review.
- Minimal data disclosure. Platforms only receive information needed for access decisions – such as “age_over_18: true” – and nothing else.
- Standardized token format. VPAT defines a predictable JSON/JWT structure that is easy to implement, audit and interoperate with.
- Decentralized trust. Multiple Identity Providers (state, bank, telco, KYC) can issue VPAT tokens under a shared governance model.
- User-centric control. Users can hold multiple VPAT tokens, renew them and choose where they are presented.
- Built for scale. Token validation is lightweight, cacheable and compatible with large-scale CDNs and edge architectures.
How VPAT works in four steps.
VPAT can be layered on top of existing identity flows without requiring platforms to store identity data themselves.
Protocol overview
-
1Identity Provider verifies the user.
Using eID, bank ID, telco SIM registration or another regulated mechanism, the IdP confirms personhood and date of birth. -
2IdP issues a VPAT token.
A signed JWT is created containing personhood and age band claims, scoped to a specific relying party (platform). -
3The platform validates the token.
The relying party fetches the IdP’s public key, verifies the signature and checks expiry, audience and assurance level. -
4Access is granted with minimal data.
The platform learns only what is necessary (e.g. “verified_person = true”, “age_over_18 = true”), enabling safe onboarding and policy enforcement.
How VPAT differs from typical KYC or age checks.
VPAT is not another onboarding product – it is a protocol proposal that platforms, IdPs and regulators can align on.
High-level comparison
| Capability | VPAT | Typical solutions |
|---|---|---|
| Zero identity disclosure to platform | Yes | Often no |
| Standardized, open token format | Yes | Rarely |
| Compatible with eIDAS 2.0 / EUDI | Yes | Partially |
| Real person (bot resistance) proof | Yes | Limited |
| Platform-agnostic, multi-IdP model | Yes | Vendor-specific |
| Designed for independent security review | Yes | Varies |
Open draft, seeking review and collaboration.
VPAT is currently published as a public working draft, open to feedback from platforms, Identity Providers, regulators and security researchers.
Contact & collaboration
Author: Vojtěch Sejkora
Architect of the VPAT Standard and reference implementation.
VPAT is shared as an open proposal. If you work on trust & safety, digital identity, eIDAS 2.0, EUDI Wallets or youth safety, your feedback and collaboration are very welcome.