Microsoft adds age-awareness APIs that can tell if users are children, teens, or adults

by · BleepingComputer

Microsoft is adding new age-awareness APIs to Windows 11 that will allow apps to determine whether someone is a child, teenager, or adult without exposing their exact date of birth.

The new Windows Age API uses information associated with a Microsoft account and can return age ranges such as under 10, 10-12, 13-15, 16-17, and 18+.

"Apps receive only the age-related signal needed for the experience and not sensitive personal data such as full date of birth," Microsoft explained.

If you're a developer, you will be able to use GetUserAgeRangeAsync to retrieve those age groups, while GetAgeVerificationStatusAsync can tell an app whether a user's age has actually been verified rather than simply self-reported.

Microsoft says this could allow apps to automatically adjust features and safeguards for younger users without requiring parents to configure every app individually.

The company specifically says the technology also applies to AI experiences, where age-appropriate protections are becoming increasingly important.

Microsoft also wants you to verify your age once

Windows will work alongside Microsoft Age Verification, or MAV, which stores a verified age status with your Microsoft account.

"Verify once → use everywhere," Microsoft says, with apps able to check that verification status through the Windows Age APIs rather than repeatedly asking users to prove their age.

Age verification is already available through Microsoft storefronts in Singapore, Brazil, and Australia, with more regions planned as regulatory requirements expand.

Microsoft is also increasing the visibility of parental controls during Windows setup in regions including France.

The Windows Age APIs are broadly available to Windows Insiders now and will roll out to all Windows users soon.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report