SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/tech-data-minimization-derived-attribute

How can a service verify an age threshold while collecting less data?

Request a yes or no derived attribute, not the full birth date.

Start playing free

  1. Request an over-threshold result ✔
  2. Store every identity field
  3. Publish the birth date

Why: Data minimization asks for only what the function requires. A signed over-threshold result can answer the authorization question without revealing the person's exact birth date.

Huh, didn't know that: Collecting less personal data also reduces what can be exposed in a later breach.

The dad joke
The form asked for less and got exactly the answer it needed.
Like this card?
Play the game

References

Answer: Request an over-threshold result. Data minimization asks for only what the function requires. A signed over-threshold result can answer the authorization question without revealing the person's exact birth date.

  1. NIST SP 800-63C Privacy pages.nist.gov/800-63-4/sp800-63c/privacy
    RPs need to request only the minimal information that they need in order to function
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhat can a messaging provider sometimes learn despite encrypted content?Security & PrivacyWhich three goals form the CIA triad?Security & PrivacyWhich password property most directly increases resistance to guessing?

That's stuff everyone should know.