Age assurance duties under the Online Safety Act

Our approach to age assurance gives services a degree of flexibility in how to comply.

Our guidance sets out a non-exhaustive list of kinds of age assurance that we consider are capable of being highly effective at correctly determining whether or not a user is a child.  It also sets out methods we do not consider capable of being highly effective.

Methods capable of being highly effective at 18 include:

• Credit card checks
• Digital identity services
• Email-based age estimation
• Facial age estimation
• Mobile-network operator (MNO) age checks
• Open banking
• Photo-identification (photo-ID) matching

Methods not capable of being highly effective at 18 include:

• Self-declaration of age
• Age verification through online payment methods which do not require a user to be over 18 (debit cards)
• General contractual restrictions on the use of the service by children

We have developed guidance for publishers of pornography (Part 5 services) and Part 3 services to assist you in implementing HEAA to comply with your duties.

To ensure that an age assurance process is, in practice, highly effective at correctly determining whether or not a user is a child, you should ensure that the process fulfils each of the following four criteria.

Meet the four criteria

Technical accuracy

Technical accuracy is the degree to which an age assurance method can correctly determine the age of a user under test lab conditions.

Robustness

Robustness is the degree to which an age assurance method can correctly determine the age of a user in actual deployment contexts. Implement age assurance processes that have undergone tests in multiple environments during development.

Reliability

Reliability is the degree to which the age output from an age assurance method is reproducible and derived from trustworthy evidence.

Fairness

Fairness is the extent to which an age assurance method avoids or minimises bias and discriminatory outcomes.

Consider the two principles

As well as meeting the four criteria, your age assurance process should be easy to use and work for all users. This will also help you make sure that adult users can still access legal content. You should consider the following two principles when implementing age assurance methods or processes.

Accessibility

This is the principle that age assurance should be easy to use and work for all users, regardless of their characteristics or whether they are members of a certain group.

Interoperability

This means the ability for technological systems to communicate with each other using common and standardised formats.

Consider third-party or in-house age assurance solutions, and wider system level measures

You have the flexibility to purchase method(s) from a third-party vendor or choose to implement your own in-house age assurance method(s).

Using a third-party vendor

If you are using a third-party vendor, you can use Vet your vendor: A resource to help services conduct due diligence on their age assurance providers for a non-exhaustive list of key questions to ask as part of your due diligence when selecting and reviewing any vendor(s) you employ.

Implementing your own methods

If you are implementing your own method(s), you still need to do the appropriate due diligence. Use our vendor resource, as well as the relevant HEAA guidance, as a guide for the types of questions you should be considering when developing in-house solutions.

Additionally, there are wider system-level age assurance measures that could be used by service providers to distinguish between children and adults on the service, including providers of app stores and operating systems.

Ultimately, regardless of where the age assurance occurs in the ecosystem or whether it is implemented by the service provider or by a third-party, it is the service providers responsibility to ensure that the assurance process is highly effective.

Determine where to place your age gate to comply with your duties under the Act

Where you need to place your highly effective age check depends on the type of service, the content that is allowed on the service, and the risk level. If the principal purpose of a service is to host or disseminate a kind of primary priority content that is harmful to children, such as pornography, or priority content that is harmful to children, such as violent content, then HEAA should be used to prevent children from accessing the entire service. 'Principal purpose’ in this context refers to the main activity or objective of the service.

For pornography services, we outlined in a blog post that we consider that the safest approach to do this is by using a ‘front gate’, whereby the user sees only a blank landing page, with no content visible until they have completed the age check.

Other user-to-user services may need to use HEAA to target safety measures towards children to protect them from being exposed to harmful content they have identified through content moderation or in children’s recommender feeds.

User-to-user services should consult Ofcom’s Protection of Children Code for user-to-user services (PDF, 953 KB) for more information on the age assurance measures required for different user-to-user services, and to determine where to place your age gate to comply with your duties.

All age assurance methods involve the processing of personal data. As outlined in our Joint Statement with the ICO on age assurance (PDF, 708 KB), services can process personal data for age assurance, as long as the method used is necessary, proportionate for your risks, and complies with data protection legislation.

We’ve worked closely with the Information Commissioner’s Office (ICO) to adopt a cohesive approach supporting compliance with our respective regulatory regimes. Our HEAA guidance sets out where services should consult ICO guidance for further information on data protection requirements.

Compliance by service providers with both the online safety and the data protection regime is mandatory and should not be considered a trade-off.

Our Report on the use of age assurance (PDF, 1.51 MB) identifies privacy and data protection compliance as an area for improvement. Services must give users clear, accessible information about how their data is processed, used and deleted, especially where information is aimed at children. This may include plain English or child-friendly formats.

Once you have implemented your HEAA process, you should make sure that you are monitoring the effectiveness of your age assurance process. You should make changes to your age assurance process where appropriate to improve effectiveness.

In the Report on the use of age assurance (PDF, 1.51 MB), we identified three main areas where we observed shortcomings in services’ implementation of age assurance. Services should review their age assurance process against these areas and make improvements without delay:

1. Follow our HEAA guidance in full, including implementing a challenge age and liveness detection where relevant, repeating age checks and applying anti-circumvention measures where appropriate, consider offering a variety of age assurance methods, and implement an age assessment appeals process
2. Do your due diligence, including using Vet your vendor: A resource to help services conduct due diligence on their age assurance providers and measuring and monitoring performance using appropriate metrics
3. Comply with UK privacy and data protection obligations, consulting relevant ICO guidance

Section 8 of the Report on the use of age assurance (PDF, 1.51 MB) gives more detail on these areas and the suggested improvements.