Signal Collection — Overview
How to collect and send supplementary signals for age assessment across web, iOS, and Android. Essential for web applications where no OS age signal exists.
Why Supplementary Signals Matter
The Arcadia Age API uses a two-phase Signal Fusion engine. On native apps, Phase 1 treats the OS-provided age signal as primary. Phase 2 evaluates supplementary evidence to either corroborate or override that signal.
On the web — where no OS signal exists — supplementary signals become the primary assessment mechanism. This is where signal collection matters most: browsers have no Apple or Google age API, so A3's behavioral and contextual signals are the only path to compliance.
Sending only the two required fields (os_signal and user_country_code) gives
you a baseline assessment. On native apps, adding supplementary signals improves
confidence scores and unlocks the OVERRIDE verdict. On the web (with
os_signal: "not-available"), they are essential for meaningful age
assurance and strengthen your audit trail under §1798.501(b)(2)(B).
More signal categories = higher confidence. The engine applies a coverage penalty when fewer than all five categories are present, reducing the maximum achievable confidence score.
The Five Signal Categories
| Category | Weight | What It Measures | Guide |
|---|---|---|---|
| Behavioral Metrics | 43% | Touch precision, scroll velocity, form timing, pressure variance, multi-touch frequency (touch mode); click precision, mouse velocity, path straightness, hover dwell time, typing speed, keystroke rhythm (pointer mode) | Behavioral Metrics |
| Input Complexity | 28% | Keyboard autocorrect reliance, word-length complexity | Input Complexity |
| Device Context | 10% | OS version, device model, accessibility settings, display scale | Device Context |
| Contextual Signals | 10% | IP classification, timezone consistency, referrer source | Contextual Signals |
| Account Longevity | 9% | Days since account creation | Account Longevity |
Weights are dynamically redistributed when categories are absent. If you only send Behavioral Metrics and Input Complexity, their effective weights become ~61% and ~39% respectively (proportional redistribution).
Coverage & Confidence
The engine penalizes sparse signal coverage to prevent high-confidence overrides based on a single signal type:
| Categories Provided | Max Confidence Factor | Example |
|---|---|---|
| 1 | 88.0% | Behavioral metrics only |
| 2 | 91.0% | Behavioral + input complexity |
| 3 | 94.0% | + device context |
| 4 | 97.0% | + contextual signals |
| 5 | 100.0% | All categories (no penalty) |
To trigger an OVERRIDE verdict, supplementary evidence must reach the 78%
"clear and convincing" threshold. With only one signal category, the maximum
achievable confidence is 88% of raw — meaning you need very strong evidence in
that single category to cross the bar. With all five categories, the full raw
confidence applies.
Privacy Principles
Every signal in this guide follows the same privacy contract as the API itself:
- On-device computation — raw biometric data (touch coordinates, keystroke timings, text content) stays on the user's device. You transmit only anonymized aggregate scores (0–1 ratios, pixel-per-second averages, event counts).
- No PII — none of the signals contain personally identifiable information. Touch precision is a number between 0 and 1, not a fingerprint.
- Zero retention — A3 processes your signals in memory and discards them
immediately. The
verification_tokenin the response is the only record, and you store it. - Internal evidence — most signals qualify as "internal clear and convincing information" under §1798.501(b)(2)(B), strengthening your legal position.
Two signals may use external databases: ip_type (IP reputation lookup)
and referrer_category (domain classification). When these are present, the
response sets internal_evidence_only: false. Omit them if your compliance
posture requires strictly internal evidence.
Interaction Modes
The engine supports three interaction modes that determine which behavioral sub-signals are scored:
| Mode | Value | When to use | Signals scored |
|---|---|---|---|
| Touch | touch | Mobile/tablet apps | Touch precision, touch scroll velocity, touch pressure, multi-touch frequency |
| Pointer | pointer | Desktop/laptop with mouse/trackpad | Click precision, mouse velocity, path straightness, hover dwell time, pointer scroll velocity, typing speed, keystroke rhythm |
| Hybrid | hybrid | Convertible devices with both inputs | All touch and pointer signals |
Set interaction_mode explicitly in your request, or omit it and the engine
will auto-detect based on which signals you provide. Form completion time and
face estimation work in all modes.
Desktop/web developers: Use interaction_mode: "pointer" with the
pointer-mode signals. Touch-specific signals like avg_touch_precision and
touch_pressure_variance are meaningless on desktop — the engine will ignore
them in pointer mode. See Behavioral Metrics
for the full pointer signal reference.
Integration Paths
Choose the depth of integration that fits your timeline:
Minimum (Required Fields Only)
Send os_signal and user_country_code. On native apps with an OS signal,
you get a verdict based on the primary indicator. On the web, send
os_signal: "not-available" — but without supplementary signals, confidence
will be limited.
Best for: initial integration and testing.
Recommended (2–3 Categories)
Add Behavioral Metrics and Input Complexity — the two highest-weighted categories (71% combined weight). This gives the engine enough evidence to detect age misrepresentation in most cases. This is the minimum recommended integration for web and desktop applications where no OS signal is available. Use pointer-mode signals for desktop users and touch-mode signals for mobile.
Best for: web/desktop apps needing compliance without heavy instrumentation, and native apps that want meaningful supplementary corroboration.
Full (All 5 Categories)
Send all five signal categories for maximum confidence and no coverage penalty. This is the gold standard for regulatory compliance and gives the engine the best chance of catching edge cases. Strongly recommended for web-only products where supplementary signals are the sole assessment basis.
Best for: web applications, cross-platform products, apps with strict compliance requirements, high-risk content, or enterprise customers demanding full audit trails.
Client & Server SDKs
A3 provides client SDKs for Web, iOS, and Android that passively collect 4 of the 5 signal categories automatically. All three produce identical JSON payloads, so your backend integration works the same regardless of platform. Backend examples for Node.js and Python are included.
See the full Client & Server SDKs guide for installation, framework-specific examples (React, Vue, SwiftUI, Jetpack Compose), and end-to-end integration walkthroughs.
Next Steps
Start with the highest-impact category and work your way down:
- Behavioral Metrics — 43% weight, the most impactful signals
- Input Complexity — 28% weight, often overlooked but powerful
- Device Context — 10% weight, enables hardware normalization
- Contextual Signals — 10% weight, requires server-side IP lookup
- Account Longevity — 9% weight, simplest to implement