Age verification without an app: a web page is enough

Definition: age verification without an app

Age verification without an app is an age check carried out directly in the phone's web browser, from a web page, without downloading anything. The customer opens the page by scanning a QR code and uses their phone's camera from that page.

This guide is for operators of parcel lockers and smart lockers, and for retailers offering unattended pickup or click and collect for age-restricted products: alcohol, CBD, pharmacy or parapharmacy products. How the check works overall is described in our guide to automated age verification.

Why an app creates friction at pickup

The age check at pickup happens at a precise moment: the customer is standing at the locker and wants to collect their order. Asking them to install an app at that moment adds several steps that have nothing to do with the pickup:

1. Find the app in their phone's app store.
2. Download and install it, on whatever connection is available on site.
3. Open it and accept its terms, sometimes create an account.
4. Finally do the verification, then go back to the locker.

For the customer, the app is used once: for this pickup. Every extra step is another chance for the customer to give up on the pickup or to contact customer service.

A web page removes the first three steps. The customer goes straight from the QR code to the verification.

How does age verification in the browser work?

With AgePass, the customer journey takes a few gestures, all on the customer's own phone:

1. QR code scan. The customer scans the QR code displayed on the locker with their phone's camera. An age verification web page opens.
2. Camera permission. The browser asks the customer whether the page may use the camera. The customer accepts.
3. Face centred. Guided by the camera preview, the customer centres their face on the screen.
4. Result. AgePass verifies their age automatically, in a few seconds. If the age is validated, the unlock authorisation is sent to the locker. If not, the locker stays closed.

AgePass verifies age only, by face scan. AgePass does not verify the customer's identity.

Reading a QR code does not require a dedicated app on recent smartphones either. Apple documents how to scan a QR code with the iPhone camera. On Android, Google states that smartphones running Android 9 or later read QR codes with the standard camera app.

How does a web page access the camera?

Browsers give access to the camera through a standard interface, getUserMedia, defined by the W3C in the Media Capture and Streams specification. According to the MDN documentation for getUserMedia, this interface follows three rules:

• HTTPS only. Camera access is only possible in a secure context, meaning a page loaded over HTTPS.
• Customer permission. The browser must ask the user for permission before turning on the camera, at least the first time.
• Visible indicator. The browser must display an indicator showing that the camera is in use.

MDN lists this interface as widely available across browsers since September 2017. On mobile, a page can ask for the front camera, the one facing the user, by preference.

If the customer refuses permission, the browser blocks access and the page cannot use the camera. The face scan cannot take place, the age is not validated and the locker stays closed.

What browser-based verification means on the ground

A web page takes the app out of the journey, but it relies on three conditions on the customer's side:

• A smartphone with a front camera and an up-to-date browser. The customer uses their own phone.
• Camera permission. The customer has to accept the browser's request.
• An internet connection. The verification page loads from the network: the customer's phone needs a connection at the time of pickup.

For the operator, two points are worth checking before a pilot:

1. Mobile coverage at the locker. A locker installed in a basement or a car park may have poor reception.
2. The fallback process. A customer without a smartphone, without a connection or who refuses the scan cannot validate their age at the locker. What happens next (handover at a counter after a check, return to sender, refund) is up to the retailer's and the operator's own procedure, to be defined before launch.

What the operator does not have to do

Browser-based verification moves the effort away from the locker network:

• No app to publish. No mobile development, no app store publication, no app updates to push to customers.
• No new hardware. The customer uses their own phone's camera: no camera or tablet needs to be installed on the locker.
• No locker replacement. AgePass integrates via API, without replacing existing lockers or kiosks and without overhauling the operator's information system.

Integration via API takes a few days to a few weeks, depending on the size of the network. The operator-side steps are covered in our guide to age verification for parcel lockers.

Comparison: app or web page?

Key takeaways

• At pickup, the customer uses an app only once: installing it in front of the locker adds steps unrelated to the pickup.
• With AgePass, the customer scans the QR code on the locker, a web page opens, they allow the camera and centre their face: their age is verified in a few seconds.
• Browsers access the camera through a standard interface, over HTTPS only, after the customer gives permission.
• The customer needs a smartphone with a camera and an internet connection at the time of pickup.
• The operator has no app to publish and no locker to replace: AgePass integrates via API.

Answers to common questions about AgePass are in the FAQ.

Try the no-app journey

A 30-minute video demo shows the full journey, from scanning the QR code to the locker opening. Book a demo to see age verification in the browser, or join the waiting list to run a free 2-month pilot, with no commitment, on an existing pickup point.