pdf

Ofcom: guidance on highly effective age assurance (Part 3)

Ofcom HEAA Guidance (Part 3) directs providers of Part 3 services on implementing highly effective age assurance satisfying accuracy, robustness, reliability, and fairness criteria under chunk 15, chunk 22, and chunk 24.

Verified at publication, 2026-11-12 11:37 UTC

52 provisions in 26 parts · official text ↗

trbfpseuipsvmemccm

impact by vertical

Summary

What this law does

Provides guidance under the Online Safety framework for regulated Part 3 services to implement highly effective age assurance processes meeting technical accuracy, robustness, reliability, and fairness criteria while complying with UK data protection requirements.

Why it matters to Signicat and its customers

No Signicat-specific relevance narrative is stored for this instrument; the stored applicability is shown below.

Who is bound: providers of Part 3 services; Service providers; regulated user-to-user service provider; credit card issuers; Services likely to be accessed by children · Regulators: Ofcom; Information Commissioner's Office

Media Entertainment: Regulated user-to-user and search services must implement highly effective age assurance to prevent children accessing harmful or restricted content.
Commerce: Commercial online platforms deploying age gates must evaluate assurance methods against Ofcom robustness, accuracy, reliability, and non-circumvention standards.

Key obligations each linked to the provision it comes from

Under 3.2, 3.3, 3.5, and 3.6, service providers must implement an end-to-end age assurance process that is highly effective at correctly determining whether or not a user is a child. Providers must be able to demonstrate that methods are implemented to ensure the overall process is highly effective and follow a data protection by design approach. Under 3.6, regardless of whether methods are built in-house or purchased from a third-party or system-level provider, the regulated user-to-user service provider remains responsible for ensuring the process is highly effective, including the initial age check and information sharing via age tokens.

chunk 15

age_assurance.document_or_eid_basedage_assurance.estimationsharing.securedata_protection.processor_controls

Age assurance mechanisms describe technical modalities for establishing whether a user is over 18. Open banking shares confirmation of status over 18 with relying parties with user consent. Photo-ID matching compares uploaded ID documents against user images at upload. Facial age estimation evaluates facial features. MNO checks verify the removal of content restriction filters. Credit card checks verify validity via issuing banks to evidence adult status. Digital identity services and reusable wallets allow users to store and share verified attributes.

chunk 17

age_assurance.document_or_eid_basedage_assurance.estimationidentity_proofing.data_verificationidentity_proofing.reusable_identity

Under 4.11 and 4.15, service providers should ensure age assurance methods are evaluated against appropriate metrics under test lab conditions to establish whether a user is a child. Under 4.16, where age estimation is used, providers should apply a challenge age approach. Under 4.18 and 4.19, users estimated below the challenge age must undergo a second age assurance step to confirm they are over the required age. The challenge age should be set at an appropriate level according to technical accuracy limits, such as managing a risk of estimating a 17-year-old's age by 7 years by setting a buffer of 8 years so that if the relevant age is 18, the Challenge Age would be 25.

accuracy criterion

age_assurance.estimationage_assurance.document_or_eid_basedorchestration.workflow_risk_decisioning

Under 4.27 and 4.28, service providers must implement age assurance tested across diverse conditions (such as poor lighting or blur) to minimise real-world discrepancies. Under 4.29, providers must identify and mitigate circumvention accessible to children. Under 4.30, where processes rely on ID documents, mobile numbers, emails, or credit cards, providers must possess means to verify that details belong to the user accessing the service. Under 4.34, photo-ID methods must detect falsified or manipulated documentation. Under 4.36, providers should evaluate whether and how frequently repeated age checks are necessary based on service features, while observing data protection necessity and proportionality.

implementing age assurance

age_assurance.estimationage_assurance.document_or_eid_basedidentity_proofing.biometric_livenessidentity_proofing.documentauthentication.sca_psd2

Under 4.45, where service providers implement age assurance methods relying on artificial intelligence or machine learning, they are expected to take steps to ensure suitable testing during development to produce reproducible results. Under 4.46, there should be regular monitoring and measurement of key performance indicators once deployed, including root cause analysis and retraining when unexpected or unreliable predictions are observed. Under 4.47, for methods like credit card age checks, open banking, and MNO checks, providers should ensure they fulfil technical accuracy, robustness, and fairness. Under 4.48 and 4.49, providers are expected to have confidence in evidence trustworthiness.

implementing age assurance 3

age_assurance.estimationage_assurance.document_or_eid_basedidentity_proofing.data_verificationtrust_framework.dvs_certification

Under 4.59 to 4.61, service providers should ultimately ensure that the age assurance process used is highly effective at correctly determining whether a particular user is a child. Alongside fulfilling the criteria, the process should be easy to use and work for all users so as not to unduly prevent adult users from accessing legal content. Providers should consider the principles set out in Table 4.2 regarding accessibility and interoperability, assessing impact on users sharing protected characteristics, considering offering a variety of methods, designing accessible user journeys, providing pre-check information, and staying up to date with interoperable methods.

chunk 43

age_assurance.document_or_eid_basedage_assurance.estimationaccessibility.wcag_conformance

Under 4.62 to 4.67, service providers must consider appropriate steps to ensure their age assurance processes are accessible, easy to use, and work effectively for all users regardless of characteristics or membership in a certain group. Inaccessible processes may wrongly prevent users from accessing services they should otherwise be able to use. Providers should explain what the process does and how it works.

accessibility principle

accessibility.wcag_conformanceage_assurance.document_or_eid_based

Under 5.11, services likely to be accessed by children have a duty when deciding on and implementing safety measures to have particular regard to the importance of protecting users from a breach of any statutory provision or rule of law concerning privacy. Under 5.12 and 5.13, providers may demonstrate compliance by detailing in their written record how privacy was considered when implementing highly effective age assurance, including conducting a DPIA, providing child-friendly privacy information, documenting processing activities, maintaining data protection policies and staff awareness records, tracking completed staff training, and documenting technical and organisational security measures. Matters involving non-compliance with data protection laws may be referred to the ICO under 5.11.

chunk 49

age_assurance.document_or_eid_baseddata_protection.processor_controlsevidence.audit_trail

Part summaries

0 of 0 parts have a verified summary.

L1 unavailable for current verification: the overall summary needs every part verified. Provisions and the verified summaries remain readable.

Verification findings (79)

synthesis coverage: missing/unverified L2 guidance-on-highly

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#guidance-on-highly

synthesis coverage: missing/unverified L2 effective-age-assurance

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#effective-age-assurance

synthesis coverage: missing/unverified L2 for-part-3-services

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-3

synthesis coverage: missing/unverified L2 contents

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#section

synthesis coverage: missing/unverified L2 1-overview

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-5

synthesis coverage: missing/unverified L2 2-introduction

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#2-introduction

synthesis coverage: missing/unverified L2 background-to-the-guidance

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#children-s-access-assessment

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#protection-of-children-codes

synthesis coverage: missing/unverified L2 navigating-the-guidance

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-9

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#section-3-age-assurance-methods

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#section-4-criteria-to-ensure-an-age-assurance-process-is-highly

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#effective

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#section-5-privacy

synthesis coverage: missing/unverified L2 3-age-assurance-methods-and

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#3-age-assurance-methods-and

synthesis coverage: missing/unverified L2 processes

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-15

synthesis coverage: missing/unverified L2 kinds-of-age-assurance-that-are-capable-of-being-highly

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#kinds-of-age-assurance-that-are-capable-of-being-highly

synthesis coverage: missing/unverified L2 effective

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-17

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-22

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-23

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-24

synthesis coverage: missing/unverified L2 kinds-of-age-assurance-that-are-not-capable-of-being

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#kinds-of-age-assurance-that-are-not-capable-of-being

synthesis coverage: missing/unverified L2 highly-effective

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-19

synthesis coverage: missing/unverified L2 4-criteria-to-ensure-an-age

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#4-criteria-to-ensure-an-age

synthesis coverage: missing/unverified L2 assurance-process-is-highly

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#assurance-process-is-highly

synthesis coverage: missing/unverified L2 the-technical-accuracy-criterion

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#what-is-technical-accuracy

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#why-is-technical-accuracy-important

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#how-can-service-providers-have-regard-to-the-technical

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#accuracy-criterion

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#accuracy-criterion-2

synthesis coverage: missing/unverified L2 the-robustness-criterion

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#what-is-robustness

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#why-is-robustness-important

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#how-can-service-providers-have-regard-to-robustness-when

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#implementing-age-assurance

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#implementing-age-assurance-2

synthesis coverage: missing/unverified L2 the-reliability-criterion

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#what-is-reliability

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#why-is-reliability-important

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#how-can-service-providers-have-regard-to-reliability-when

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#implementing-age-assurance-3

synthesis coverage: missing/unverified L2 the-fairness-criterion

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#what-is-fairness

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#why-is-fairness-important

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#how-can-service-providers-have-regard-to-fairness-when

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#implementing-age-assurance-4

synthesis coverage: missing/unverified L2 additional-principles-for-providers-to-consider

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-43

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#accessibility-principle

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#interoperability

synthesis coverage: missing/unverified L2 5-privacy-and-data-protection

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-46

synthesis coverage: missing/unverified L2 the-data-protection-regime

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-47

synthesis coverage: missing/unverified L2 ico-guidance-on-data-protection-and-age-assurance

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-48

synthesis coverage: missing/unverified L2 having-regard-to-privacy-under-the-act

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-49

synthesis coverage: missing/unverified L2 6-technical-glossary

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#metrics-used-to-measure-the-accuracy-of-age-assurance

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#metrics-used-to-measure-the-accuracy-of-age-assurance-2

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#additional-terms-used-in-this-guidance

Instrument tier unavailable

Change history as published

No captured publisher history.

Pending effects amendments not yet applied to this text

No captured pending effects.

Full TOC · table of contents Expand all parts

26 parts · 52 provisions. Open a provision for its text and, where available, its one-line summary.

Guidance on highly · 1 provisions

Guidance on highly

effective age assurance · 1 provisions

effective age assurance

For Part 3 services · 1 provisions

For Part 3 services

Contents · 1 provisions

Contents Section

1. Overview · 1 provisions

1. Overview

2. Introduction · 1 provisions

2. Introduction

Background to the guidance · 2 provisions

Background to the guidance Children’s Access Assessment

Background to the guidance Protection of Children Codes

Navigating the guidance · 5 provisions

Navigating the guidance

Navigating the guidance Section 3: Age assurance methods

Navigating the guidance Section 4: Criteria to ensure an age assurance process is highly

Navigating the guidance effective

Navigating the guidance Section 5: Privacy

3. Age assurance methods and · 1 provisions

3. Age assurance methods and

processes · 1 provisions

processes

Kinds of age assurance that are capable of being highly · 1 provisions

Kinds of age assurance that are capable of being highly

effective · 4 provisions

effective

Kinds of age assurance that are not capable of being · 1 provisions

Kinds of age assurance that are not capable of being

highly effective · 1 provisions

highly effective

4. Criteria to ensure an age · 1 provisions

4. Criteria to ensure an age

assurance process is highly · 1 provisions

assurance process is highly

The technical accuracy criterion · 5 provisions

The technical accuracy criterion What is technical accuracy?

The technical accuracy criterion Why is technical accuracy important?

The technical accuracy criterion How can service providers have regard to the technical

The technical accuracy criterion accuracy criterion?

The robustness criterion · 5 provisions

The robustness criterion What is robustness?

The robustness criterion Why is robustness important?

The robustness criterion How can service providers have regard to robustness when

The robustness criterion implementing age assurance?

The reliability criterion · 4 provisions

The reliability criterion What is reliability?

The reliability criterion Why is reliability important?

The reliability criterion How can service providers have regard to reliability when

The reliability criterion implementing age assurance?

The fairness criterion · 4 provisions

The fairness criterion What is fairness?

The fairness criterion Why is fairness important?

The fairness criterion How can service providers have regard to fairness when

The fairness criterion implementing age assurance?

Additional principles for providers to consider · 3 provisions

Additional principles for providers to consider

Additional principles for providers to consider Accessibility principle

Additional principles for providers to consider Interoperability

5. Privacy and data protection · 1 provisions

5. Privacy and data protection

The Data Protection Regime · 1 provisions

The Data Protection Regime

ICO guidance on data protection and age assurance · 1 provisions

ICO guidance on data protection and age assurance

Having regard to privacy under the Act · 1 provisions

Having regard to privacy under the Act

6. Technical glossary · 3 provisions

6. Technical glossary Metrics used to measure the accuracy of age assurance

6. Technical glossary Additional terms used in this guidance

Impact profile

Transportation

Banking finance

Public sector health

Energy, utilities & telco

Insurance pensions

Services

Media entertainment

Manufacturing construction

Commerce

Dimensions

Mechanism strength

Signicat obligation

Urgency

Pending

Penalties

not supplied

Definitions

No captured definitions.

References

uk:ofcom/heaa-guidance-part3