AdultInfra Get a test plan

Age and geo gating at the edge

How to enforce per-jurisdiction age and geo policy at the edge: token issuance, segment-level gating, decision logging, and why storing raw identity documents is the wrong design.

THE PROBLEM Different jurisdictions require different gating, and enforcement scattered across apps is inconsistent and unauditable.

LAST REVIEWED

Age and geo gating fails when it is implemented per application, per endpoint, and per release. A mobile app gates one way, the web player another, and the API a third — and the segment URLs leak around all of them. The durable design centralises the decision at the edge and gates the media, not just the page that links to it.

The mechanism

Gating has two separable parts: deciding whether a request is allowed (policy), and enforcing that decision on every byte that matters (entitlement). Most breaches come from enforcing policy on the HTML page while leaving segments and manifests reachable directly. A determined or merely curious client that guesses a segment URL bypasses the gate entirely. Enforcement must live on the media path, at the edge, and it must be consistent across web, app, and API.

Per-jurisdiction policy

Policy varies by jurisdiction and by content class, and it changes over time. Model it as data, not code:

  • Jurisdiction of the viewer from a reliable geo signal, with a defined fallback when the signal is uncertain.
  • Content classification (for example, gated vs. general) attached to each asset.
  • Policy rules that map jurisdiction plus classification to an outcome: allow, verify, or deny.
  • Fallback behaviour when geo is unknown — fail closed for gated content.

Keeping policy as configuration lets legal changes ship without an application deploy. Age assurance requirements, consent, likeness, and territorial rights are the customer’s compliance decisions; the edge’s job is to execute them consistently and prove that it did.

Gating token issuance and segment access

Gate in two stages:

  1. Issuance. After your authorisation and age-assurance step, the edge (or your API behind it) issues a short-lived, scoped token bound to the viewer, the content, and the jurisdiction decision. Token issuance is where identity and age checks happen — once.
  2. Access. Every manifest and segment request carries the token. The edge validates it and checks that the requested object is within the token’s scope before serving. An unentitled request never reaches origin.

This is the same token-binding used against hotlinking, reused for compliance. Crucially, keep the token out of the media cache key so gating does not destroy caching: validate entitlement per request, cache objects by identity. Use RFC 9213 (CDN-Cache-Control) to set region-appropriate edge freshness while browsers stay short.

Geo signals and their failure modes

Any single geo signal is wrong sometimes. Combine a database lookup with network-level signals, treat VPN and hosting-range addresses with suspicion for gated content, and define what happens when the signals disagree. The failure mode to avoid is silent permissiveness: an unknown jurisdiction that defaults to “allow” is a compliance hole. Prefer fail-closed for gated content and a clear verification path for legitimate viewers the signal misclassifies.

Logging jurisdiction decisions

You cannot audit what you did not record. Log, per gated decision: timestamp, viewer/ASN (not raw identity), jurisdiction signal and confidence, content classification, policy version, and outcome. Keep logs structured and immutable enough to answer a regulator’s or a rights-holder’s question. Do not log raw identity documents — see below. RFC 9211 (Cache-Status) and standard request logs cover the delivery side; the policy decision needs its own structured record.

Why storing raw ID is the wrong design

Storing copies of passports, licences, or selfie videos creates a high-value breach target and a data-minimisation liability, and it rarely serves a delivery need. The edge does not need the document — it needs a decision and a token that reflects it. Design so identity verification happens in a purpose-built system you control, and the edge receives only a signed assertion: “this session is age-verified for this jurisdiction and this content”. That keeps the sensitive data out of the delivery path, reduces breach exposure, and makes the token the unit of audit.

What good looks like

  • Policy is configuration, versioned and logged, not hard-coded.
  • Tokens are scoped to viewer, content, and jurisdiction, and validated on every segment.
  • Geo uncertainty fails closed for gated content.
  • No raw identity documents in the delivery layer; only signed assertions.
  • Decisions are logged with policy version for audit.

How to prove it

Probe your own gated content directly — request a segment URL with no token, an expired token, and a token from another jurisdiction — and confirm the edge refuses before origin. Contact us to run that probe across web, app, and API against a controlled slice.