On June 30, 2026, the UK Home Office laid regulations allowing licensed premises in England and Wales to accept digital proof of age for alcohol sales as an additional option alongside physical ID, expected in force by autumn 2026. The announcement contained a sentence worth reading twice. The policing minister promised digital ID would give people "a quick and secure way to prove age without revealing any additional personal details."
That is a government writing selective disclosure into licensing law. Prove one fact, reveal nothing else. It is also, almost word for word, a description of what a zero-knowledge proof does. As someone who works on privacy infrastructure, I think the goal is exactly right. The open question is whether the systems built under these rules will deliver that sentence as math, or as a promise.
What the rules guarantee, and what they leave open
Under the new rules, a venue accepts an age check from a certified Digital Verification Service, a provider registered under the UK's trust framework. The provider verified your passport or driving licence once, and afterwards vouches for your age wherever you present the app. The venue never checks your documents itself. It accepts the provider's credential and trusts the framework behind it.
This is a real improvement over handing a passport to bar staff. But the privacy sits with the provider. It sees your identity documents at sign-up, and what it keeps or can observe afterwards depends on how it built its system and the policies it runs under. Providers carry real obligations under the trust framework, including data protection by design and data minimisation. A policy can be excellent and still be a policy. It is audited rather than enforced by math, and it can change.
The rules themselves do not settle this. They are neutral on implementation, so a provider built on ZK proofs could be certified under the same framework. The law has opened a door, and what walks through it is up to the providers.
The technology the minister was describing
The minister's sentence has an exact technical counterpart. Zero-knowledge proofs, or ZK proofs, let you prove a statement is true without revealing the data behind it. Applied here, that means proving "born before July 2008" without disclosing a birthdate, a name, or which document the fact came from.
The flow changes in one important place. An issuer you trust, a government or a certified provider, signs a credential containing your date of birth exactly once. From then on, your device generates a proof for each check, showing the credential carries a valid signature from a recognized issuer and the birthdate inside it falls before the required cutoff. The verifier runs the math and learns only what the check requires, in this case whether the holder is old enough.
Three properties fall out of that design. The check is verification, so the venue confirms cryptography instead of taking a provider's word. The issuer is out of the loop after issuance, so nobody accumulates a log of where you prove your age. And because the check is just a proof a machine can run, it drops into a self-checkout, an online storefront, or an API without a human inspecting anything.
This is buildable today
This is a common design pattern on Midnight. The developer FAQ uses this exact case as its example of how to think in Midnight: the assertion that someone is over a threshold belongs in public state, while the birthday behind it stays private. Contracts are written in Compact, a TypeScript-inspired language that compiles those public assertions and private witnesses into ZK circuits, so you write the age check and the compiler generates the cryptography.
The position I want you to leave with
Age assurance is arriving as law, and every implementation will make a choice between two architectures that look identical at the counter. One rests on trusting the company that verified your identity to keep behaving well. The other proves the one required fact and cannot leak what it never received.
If you are evaluating or building an age-assurance system, the question to ask is concrete. Does the verifier receive my attribute from a database, or a proof about my attribute that never contained it?The UK rules require confidence in the claim, and a ZK proof is the strongest form of confidence a claim can carry.
And if you want to build the better answer, the path is short. Start with the docs and write the check in Compact. If you hit something the network cannot express yet, propose the fix through a Midnight Improvement Proposal. The builders already working on this hang out in our Discord.
Autumn 2026 is when digital age checks become normal. What kind they become is still being decided.
Sources for the UK regulation: Office for Digital Identities and Attributes announcement and the written ministerial statement.
Top comments (0)