Threat modeling age-based content restrictions: what we learned at EIC 2026

Several stages of the threat modeling workshop

At the European Identity and Cloud Conference (EIC 2026) in Berlin, we ran a hands-on threat modeling workshop using LEGO® SERIOUS PLAY® as a facilitation method. The session built on the approach described in our earlier W3C post on threat modeling with LEGO® SERIOUS PLAY®, but used a more specific case: age-based content restrictions.

The choice was deliberate. EIC is one of the places where the digital identity market is visible while it is still taking shape. At EIC 2025, much of the conversation was about personal wallets: how to build them, distribute them, and get them adopted by relying parties, governments, and users. At EIC 2026, the discussion had shifted. AI was everywhere, and in identity that meant agent identity, non-human identities, workload identity, delegation, and intent verification in agentic scenarios.

The age-based content restriction use case

That does not mean human identity has disappeared from the agenda. It means the harder questions are now tied to concrete uses. Age-based content restrictions are one of those cases.

They are difficult because regulators are asking for operational solutions now, while the technical architecture is still unsettled. A design that affects access, privacy, anonymity, and interoperability can also create exclusion, surveillance, censorship, or reuse of the same infrastructure for other purposes.

This was also reflected in October 2025, when W3C and IAB organized a joint workshop on age-based restrictions for access to online content. That workshop focused on technical and architectural choices without assuming that there is a single correct solution.