Age gates and crawler evidence: what a public audit can establish

Treat the gate as part of the system

An age gate is not simply a nuisance for a scanner. It is a boundary the operator has chosen or may be required to maintain. An audit should describe how that boundary behaves: whether it overlays content, redirects all routes, returns an interstitial document, or requires a verified session. The observer should not accept an eligibility declaration on somebody else’s behalf.

Separate three test conditions

Our proposed worksheet has three columns: a fresh public request, a browser interaction performed by an authorized adult reviewer, and verified crawler evidence supplied by the operator. A result in one column is not evidence for another. A successful browser session does not demonstrate that a crawler received the same page. A scanner challenge also does not prove that all human visitors are blocked.

What the guidance says

Google distinguishes legally mandatory interstitials from promotional interruptions and discusses verified Googlebot handling. Verification matters: a request that merely names Googlebot is not equivalent to a verified Google request. Any operator-specific configuration should preserve the required human eligibility boundary and be reviewed against the applicable requirements rather than copied from a generic audit.

Source: Google: intrusive and mandatory interstitials · Google: verify crawler requests

Report the observation accurately

Store the tested URL, final URL, timestamp, observer identity, response code, content type, and whether useful public content was actually available in the access-controlled working record. If the response is an age gate, state that the content behind the gate was not evaluated. Do not convert every unavailable signal into a zero. Mark dependencies as unknown so the report does not imply that missing evidence proves missing implementation.

A useful remediation ticket

The ticket should describe a specific reproducible issue, such as unrelated informational URLs all resolving to one consent document. It should name the affected representation, the intended audience, the evidence needed to verify a fix, and the controls that must remain intact. It should not instruct a third party to bypass the gate or infer that a technical change establishes compliance. Confidential tickets are not public case studies.