Captured source text (L5)
processes
3.1In this section, we set out a non-exhaustive list of the kinds of age assurance that we
consider are capable of being highly effective at correctly determining whether or not a
user is a child, and those that are not capable of doing so.
3.2Throughout this section, we refer to age assurance methods and processes.
• An age assurance method refers to a particular system or technology that underpins an
age assurance process.
• An age assurance process refers to the end-to-end process through which the age
assurance method or combination of methods are implemented to determine whether
or not a particular user is or is not a child. The effectiveness of an age assurance
method will depend on how it is implemented, including whether by itself or in
combination with other methods. The age assurance process as a whole needs to be
highly effective at correctly determining whether or not a particular user is a child.
3.3We set out below a non-exhaustive list of the kinds of age assurance that we consider are
capable of being highly effective at correctly determining whether or not a user is a child.9
We recognise that age assurance methods are developing at pace and this list may expand
in time. It is for the service provider to determine which age assurance method(s) to use in
order to implement an age assurance process that is appropriate to meet its duties under
the Act. Implementing one of the example methods is not a guarantee that the service is
acting in accordance with the requirements of the Act – service providers need to be able to
demonstrate that the method has (or methods have) been implemented in such a way that
ensures the overall process as a whole is highly effective.
3.4We also provide examples of methods that we do not consider are capable of being highly
effective at correctly determining whether or not a user is a child. Service providers should
not rely on these methods alone to determine whether a user is a child in the absence of
other measures.
3.5All age assurance methods involve the processing of personal data. As such, service
providers who are required to implement age assurance are also subject to the
requirements of the UK’s data protection regime and should follow a data protection by
design approach. The ICO has issued guidance on how these requirements should be met,
as outlined in the ‘Privacy and data protection’ sub-section below, which will assist service
providers to implement highly effective age assurance while protecting user privacy in line
with the data protection regime.
3.6Service providers have the flexibility to choose to build an in-house age assurance method
or purchase a method from a third-party age assurance provider. Additionally, we recognise
that there may be wider system-level age assurance methods that service providers could
9 The kinds of age assurance in this list may be referred to by different names, and each kind may be
implemented in a number of ways. We have used high-level descriptions to assist service providers in
understanding the options that are available to them, but it is for each provider to consider which age
assurance methods and processes will be most appropriate for complying with the duties under the Act.
7
use to distinguish between children and adults on their service, for example, involving
providers of devices, app stores, browsers operating systems, or relevant kinds of
authentication systems. Regardless of where the age assurance occurs in the ecosystem or
whether it is implemented by the service provider or by a third-party, it is the responsibility
of the regulated user-to-user service provider to ensure that age assurance is implemented
in such a way that it is highly effective at determining whether or not a user is a child.
Should service providers opt to use wider system-level age assurance, they must ensure the
initial age check and the process to share this information with the regulated service (e.g.
through age tokens) are highly effective. 10
Full captured verbatim text
3.1 In this section, we set out a non-exhaustive list of the kinds of age assurance that we consider are capable of being highly effective at correctly determining whether or not a user is a child, and those that are not capable of doing so. 3.2 Throughout this section, we refer to age assurance methods and processes. • An age assurance method refers to a particular system or technology that underpins an age assurance process. • An age assurance process refers to the end-to-end process through which the age assurance method or combination of methods are implemented to determine whether or not a particular user is or is not a child. The effectiveness of an age assurance method will depend on how it is implemented, including whether by itself or in combination with other methods. The age assurance process as a whole needs to be highly effective at correctly determining whether or not a particular user is a child. 3.3 We set out below a non-exhaustive list of the kinds of age assurance that we consider are capable of being highly effective at correctly determining whether or not a user is a child.9 We recognise that age assurance methods are developing at pace and this list may expand in time. It is for the service provider to determine which age assurance method(s) to use in order to implement an age assurance process that is appropriate to meet its duties under the Act. Implementing one of the example methods is not a guarantee that the service is acting in accordance with the requirements of the Act – service providers need to be able to demonstrate that the method has (or methods have) been implemented in such a way that ensures the overall process as a whole is highly effective. 3.4 We also provide examples of methods that we do not consider are capable of being highly effective at correctly determining whether or not a user is a child. Service providers should not rely on these methods alone to determine whether a user is a child in the absence of other measures. 3.5 All age assurance methods involve the processing of personal data. As such, service providers who are required to implement age assurance are also subject to the requirements of the UK’s data protection regime and should follow a data protection by design approach. The ICO has issued guidance on how these requirements should be met, as outlined in the ‘Privacy and data protection’ sub-section below, which will assist service providers to implement highly effective age assurance while protecting user privacy in line with the data protection regime. 3.6 Service providers have the flexibility to choose to build an in-house age assurance method or purchase a method from a third-party age assurance provider. Additionally, we recognise that there may be wider system-level age assurance methods that service providers could 9 The kinds of age assurance in this list may be referred to by different names, and each kind may be implemented in a number of ways. We have used high-level descriptions to assist service providers in understanding the options that are available to them, but it is for each provider to consider which age assurance methods and processes will be most appropriate for complying with the duties under the Act. 7 use to distinguish between children and adults on their service, for example, involving providers of devices, app stores, browsers operating systems, or relevant kinds of authentication systems. Regardless of where the age assurance occurs in the ecosystem or whether it is implemented by the service provider or by a third-party, it is the responsibility of the regulated user-to-user service provider to ensure that age assurance is implemented in such a way that it is highly effective at determining whether or not a user is a child. Should service providers opt to use wider system-level age assurance, they must ensure the initial age check and the process to share this information with the regulated service (e.g. through age tokens) are highly effective. 10