Selective disclosure: prove you're over 18 without handing over your address

Every Friday night, at doors across Australia, the same exchange plays out. A patron hands over a plastic licence to prove one thing: they are over 18. The card answers that question. It also hands over their name, home address, date of birth and licence number.

The venue needed a yes or no. It received enough detail to profile, contact or impersonate that patron. That gap between the question and the answer is the overshare problem.

One question, five disclosures

A plastic licence is all or nothing. You cannot cover the address line and still pass the check. Every field is printed on the same card, so every check exposes them all.

It gets worse when copies are made. Some venues scan or photocopy IDs, and retention practices vary widely. Those images can sit in guest databases for years. Each one is a standing liability if systems are ever breached.

A date of birth and address together are useful to fraudsters. They anchor identity theft, and they cannot be reissued like a password. None of this is the doorperson's fault — the format forces it. To fix the overshare, you have to change the credential itself.

What selective disclosure actually means

Selective disclosure flips the model. The W3C Verifiable Credentials standard defines it as a holder's ability to make "fine-grained decisions about what information to share". In plain terms: share the field that was asked for, and nothing else.

Three roles make this work. The issuer creates and signs the credential — for a mobile driver's licence (mDL), a licensing authority. The holder keeps it in a wallet on their phone. The verifier — your venue — asks a question and checks the signature on the answer.

• Each field is individually hashed and covered by the issuer's signature, so it can be verified alone.
• A verifier can request one attribute without touching the rest.
• Derived answers, such as over-18, can stand in for raw data like a birthdate.
• Fields that are not requested never leave the phone.

Over 18 at the door, end to end

Picture a patron at a venue entrance with an mDL on their phone. The reader at the door sends a request for a single attribute: age_over_18. Nothing has moved yet.

The patron's phone shows the request and lists exactly what is being asked. They tap approve. The phone releases a signed response over the local connection.

The reader now holds two things. First, a cryptographically signed yes or no on the over-18 question. Second, the licence portrait, so staff can match the face in front of them.

No date of birth changed hands. No address, no licence number. This is not a concept demo: ISO/IEC 18013-5, the international mDL standard, defines these age attestations directly. A licence can attest "over 18" without revealing the birthdate behind it. The same request works at a bottle-shop counter or a self-service checkout.

Why a yes/no can be trusted

A fair question follows: why trust an answer when the evidence stays hidden?

Because the answer is signed by the issuer, typically a government licensing authority. Under ISO/IEC 18013-5, disclosed values are checked against hashes the issuer signed at issuance. Change one value and the signature check fails.

The credential is also bound to the device presenting it. During the exchange, the phone proves it holds the private key tied to that credential. A screenshot, a forwarded file or a cloned wallet should not pass that test.

Trust shifts from people to mathematics. Staff no longer squint at holograms under torchlight. A convincing fake card can fool a busy doorway; forging a valid issuer signature is a different order of problem.

What it means for your business

Data you never collect is data you cannot lose. That is the commercial heart of selective disclosure.

Australian Privacy Principle 3 expects organisations to collect only personal information that is reasonably necessary. The OAIC's guidance warns that over-collection may contravene APP 3 and can worsen the harm from a breach. It points to data minimisation as the safer default.

An age check that stores no birthdate is minimisation in practice. Breach responses cost money and reputation, and a smaller holding shrinks both exposures. For a venue or retailer, the flow-on effects are worth listing.

• Smaller breach surface: routine age checks leave no scans, photocopies or birthdates behind.
• A simpler privacy story: one signed attribute is easier to justify than a full identity record.
• Less handling risk: staff never hold a card or read an address aloud.
• Cleaner evidence: a verifiable result of the check, without the personal data attached.

Selective disclosure is not a compliance silver bullet. State liquor rules and record-keeping duties still apply, and they vary. But it moves your starting point from collect everything to collect the answer.

Consent is the default, not a setting

Nothing moves without the holder's approval. The request appears on their screen with every requested field listed. Decline, and the verifier receives nothing at all.

There is no handing the phone across, either. The exchange runs over NFC or Bluetooth while the device stays in the patron's hand. In a Friday-night queue, that matters: the whole flow takes seconds.

The consent step also changes the tone at the door. The patron is not surrendering a document. They are answering a question, on their own terms, with proof attached.

Where TENSAI fits

Smart Solutions builds this flow into working hardware. Our TENSAI readers and SDK verify mobile driver's licences to ISO/IEC 18013-5, with selective disclosure and age attestations supported end to end. You can explore the platform on our mDL page or walk through the age-verification use case in detail.

If you run doors, counters or checkouts, the question is worth sitting with. Your patrons are happy to prove they are over 18. They should not have to hand over their address to do it.