Watchtower/Law library/Ofcom: guidance on highly effective age...
As last captured

pdf

Ofcom: guidance on highly effective age assurance (Part 3)

Ofcom HEAA Guidance (Part 3) directs providers of Part 3 services on implementing highly effective age assurance satisfying accuracy, robustness, reliability, and fairness criteria under chunk 15, chunk 22, and chunk 24.

Verified at publication, 2026-11-12 11:37 UTC

52 provisions in 26 parts · official text ↗

trbfpseuipsvmemccm
impact by vertical

Summary

What this law does

Provides guidance under the Online Safety framework for regulated Part 3 services to implement highly effective age assurance processes meeting technical accuracy, robustness, reliability, and fairness criteria while complying with UK data protection requirements.

Why it matters to Signicat and its customers

No Signicat-specific relevance narrative is stored for this instrument; the stored applicability is shown below.

Who is bound: providers of Part 3 services; Service providers; regulated user-to-user service provider; credit card issuers; Services likely to be accessed by children · Regulators: Ofcom; Information Commissioner's Office

Media Entertainment
Regulated user-to-user and search services must implement highly effective age assurance to prevent children accessing harmful or restricted content.
Commerce
Commercial online platforms deploying age gates must evaluate assurance methods against Ofcom robustness, accuracy, reliability, and non-circumvention standards.

Key obligations each linked to the provision it comes from

Under 3.2, 3.3, 3.5, and 3.6, service providers must implement an end-to-end age assurance process that is highly effective at correctly determining whether or not a user is a child. Providers must be able to demonstrate that methods are implemented to ensure the overall process is highly effective and follow a data protection by design approach. Under 3.6, regardless of whether methods are built in-house or purchased from a third-party or system-level provider, the regulated user-to-user service provider remains responsible for ensuring the process is highly effective, including the initial age check and information sharing via age tokens.
chunk 15
age_assurance.document_or_eid_basedage_assurance.estimationsharing.securedata_protection.processor_controls
Age assurance mechanisms describe technical modalities for establishing whether a user is over 18. Open banking shares confirmation of status over 18 with relying parties with user consent. Photo-ID matching compares uploaded ID documents against user images at upload. Facial age estimation evaluates facial features. MNO checks verify the removal of content restriction filters. Credit card checks verify validity via issuing banks to evidence adult status. Digital identity services and reusable wallets allow users to store and share verified attributes.
chunk 17
age_assurance.document_or_eid_basedage_assurance.estimationidentity_proofing.data_verificationidentity_proofing.reusable_identity
Under 4.11 and 4.15, service providers should ensure age assurance methods are evaluated against appropriate metrics under test lab conditions to establish whether a user is a child. Under 4.16, where age estimation is used, providers should apply a challenge age approach. Under 4.18 and 4.19, users estimated below the challenge age must undergo a second age assurance step to confirm they are over the required age. The challenge age should be set at an appropriate level according to technical accuracy limits, such as managing a risk of estimating a 17-year-old's age by 7 years by setting a buffer of 8 years so that if the relevant age is 18, the Challenge Age would be 25.
accuracy criterion
age_assurance.estimationage_assurance.document_or_eid_basedorchestration.workflow_risk_decisioning
Under 4.27 and 4.28, service providers must implement age assurance tested across diverse conditions (such as poor lighting or blur) to minimise real-world discrepancies. Under 4.29, providers must identify and mitigate circumvention accessible to children. Under 4.30, where processes rely on ID documents, mobile numbers, emails, or credit cards, providers must possess means to verify that details belong to the user accessing the service. Under 4.34, photo-ID methods must detect falsified or manipulated documentation. Under 4.36, providers should evaluate whether and how frequently repeated age checks are necessary based on service features, while observing data protection necessity and proportionality.
implementing age assurance
age_assurance.estimationage_assurance.document_or_eid_basedidentity_proofing.biometric_livenessidentity_proofing.documentauthentication.sca_psd2
Under 4.45, where service providers implement age assurance methods relying on artificial intelligence or machine learning, they are expected to take steps to ensure suitable testing during development to produce reproducible results. Under 4.46, there should be regular monitoring and measurement of key performance indicators once deployed, including root cause analysis and retraining when unexpected or unreliable predictions are observed. Under 4.47, for methods like credit card age checks, open banking, and MNO checks, providers should ensure they fulfil technical accuracy, robustness, and fairness. Under 4.48 and 4.49, providers are expected to have confidence in evidence trustworthiness.
implementing age assurance 3
age_assurance.estimationage_assurance.document_or_eid_basedidentity_proofing.data_verificationtrust_framework.dvs_certification
Under 4.59 to 4.61, service providers should ultimately ensure that the age assurance process used is highly effective at correctly determining whether a particular user is a child. Alongside fulfilling the criteria, the process should be easy to use and work for all users so as not to unduly prevent adult users from accessing legal content. Providers should consider the principles set out in Table 4.2 regarding accessibility and interoperability, assessing impact on users sharing protected characteristics, considering offering a variety of methods, designing accessible user journeys, providing pre-check information, and staying up to date with interoperable methods.
chunk 43
age_assurance.document_or_eid_basedage_assurance.estimationaccessibility.wcag_conformance
Under 4.62 to 4.67, service providers must consider appropriate steps to ensure their age assurance processes are accessible, easy to use, and work effectively for all users regardless of characteristics or membership in a certain group. Inaccessible processes may wrongly prevent users from accessing services they should otherwise be able to use. Providers should explain what the process does and how it works.
accessibility principle
accessibility.wcag_conformanceage_assurance.document_or_eid_based
Under 5.11, services likely to be accessed by children have a duty when deciding on and implementing safety measures to have particular regard to the importance of protecting users from a breach of any statutory provision or rule of law concerning privacy. Under 5.12 and 5.13, providers may demonstrate compliance by detailing in their written record how privacy was considered when implementing highly effective age assurance, including conducting a DPIA, providing child-friendly privacy information, documenting processing activities, maintaining data protection policies and staff awareness records, tracking completed staff training, and documenting technical and organisational security measures. Matters involving non-compliance with data protection laws may be referred to the ICO under 5.11.
chunk 49
age_assurance.document_or_eid_baseddata_protection.processor_controlsevidence.audit_trail

Part summaries

0 of 0 parts have a verified summary.

L1 unavailable for current verification: the overall summary needs every part verified. Provisions and the verified summaries remain readable.

Verification findings (79)

synthesis coverage: missing/unverified L2 guidance-on-highly

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#guidance-on-highly

synthesis coverage: missing/unverified L2 effective-age-assurance

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#effective-age-assurance

synthesis coverage: missing/unverified L2 for-part-3-services

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-3

synthesis coverage: missing/unverified L2 contents

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#section

synthesis coverage: missing/unverified L2 1-overview

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-5

synthesis coverage: missing/unverified L2 2-introduction

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#2-introduction

synthesis coverage: missing/unverified L2 background-to-the-guidance

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#children-s-access-assessment

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#protection-of-children-codes

synthesis coverage: missing/unverified L2 navigating-the-guidance

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-9

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#section-3-age-assurance-methods

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#section-4-criteria-to-ensure-an-age-assurance-process-is-highly

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#effective

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#section-5-privacy

synthesis coverage: missing/unverified L2 3-age-assurance-methods-and

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#3-age-assurance-methods-and

synthesis coverage: missing/unverified L2 processes

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-15

synthesis coverage: missing/unverified L2 kinds-of-age-assurance-that-are-capable-of-being-highly

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#kinds-of-age-assurance-that-are-capable-of-being-highly

synthesis coverage: missing/unverified L2 effective

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-17

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-22

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-23

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-24

synthesis coverage: missing/unverified L2 kinds-of-age-assurance-that-are-not-capable-of-being

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#kinds-of-age-assurance-that-are-not-capable-of-being

synthesis coverage: missing/unverified L2 highly-effective

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-19

synthesis coverage: missing/unverified L2 4-criteria-to-ensure-an-age

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#4-criteria-to-ensure-an-age

synthesis coverage: missing/unverified L2 assurance-process-is-highly

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#assurance-process-is-highly

synthesis coverage: missing/unverified L2 the-technical-accuracy-criterion

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#what-is-technical-accuracy

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#why-is-technical-accuracy-important

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#how-can-service-providers-have-regard-to-the-technical

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#accuracy-criterion

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#accuracy-criterion-2

synthesis coverage: missing/unverified L2 the-robustness-criterion

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#what-is-robustness

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#why-is-robustness-important

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#how-can-service-providers-have-regard-to-robustness-when

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#implementing-age-assurance

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#implementing-age-assurance-2

synthesis coverage: missing/unverified L2 the-reliability-criterion

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#what-is-reliability

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#why-is-reliability-important

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#how-can-service-providers-have-regard-to-reliability-when

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#implementing-age-assurance-3

synthesis coverage: missing/unverified L2 the-fairness-criterion

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#what-is-fairness

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#why-is-fairness-important

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#how-can-service-providers-have-regard-to-fairness-when

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#implementing-age-assurance-4

synthesis coverage: missing/unverified L2 additional-principles-for-providers-to-consider

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-43

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#accessibility-principle

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#interoperability

synthesis coverage: missing/unverified L2 5-privacy-and-data-protection

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-46

synthesis coverage: missing/unverified L2 the-data-protection-regime

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-47

synthesis coverage: missing/unverified L2 ico-guidance-on-data-protection-and-age-assurance

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-48

synthesis coverage: missing/unverified L2 having-regard-to-privacy-under-the-act

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#chunk-49

synthesis coverage: missing/unverified L2 6-technical-glossary

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#metrics-used-to-measure-the-accuracy-of-age-assurance

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#metrics-used-to-measure-the-accuracy-of-age-assurance-2

synthesis coverage: missing evaluation uk:ofcom/heaa-guidance-part3#additional-terms-used-in-this-guidance

Instrument tier unavailable

Change history as published

No captured publisher history.

Pending effects amendments not yet applied to this text

No captured pending effects.

Full TOC · table of contents Collapse parts

26 parts · 52 provisions. Open a provision for its text and, where available, its one-line summary.

Guidance on highly · 1 provisions
Guidance on highly uk:ofcom/heaa-guidance-part3#guidance-on-highly
effective age assurance · 1 provisions
effective age assurance uk:ofcom/heaa-guidance-part3#effective-age-assurance
For Part 3 services · 1 provisions
For Part 3 services uk:ofcom/heaa-guidance-part3#chunk-3
Contents · 1 provisions
Contents Section uk:ofcom/heaa-guidance-part3#section
1. Overview · 1 provisions
1. Overview uk:ofcom/heaa-guidance-part3#chunk-5
2. Introduction · 1 provisions
2. Introduction uk:ofcom/heaa-guidance-part3#2-introduction
Background to the guidance · 2 provisions
Background to the guidance Children’s Access Assessment uk:ofcom/heaa-guidance-part3#children-s-access-assessment
Background to the guidance Protection of Children Codes uk:ofcom/heaa-guidance-part3#protection-of-children-codes
Navigating the guidance · 5 provisions
Navigating the guidance uk:ofcom/heaa-guidance-part3#chunk-9
Navigating the guidance Section 3: Age assurance methods uk:ofcom/heaa-guidance-part3#section-3-age-assurance-methods
Navigating the guidance Section 4: Criteria to ensure an age assurance process is highly uk:ofcom/heaa-guidance-part3#section-4-criteria-to-ensure-an-age-assurance-process-is-highly
Navigating the guidance effective uk:ofcom/heaa-guidance-part3#effective
Navigating the guidance Section 5: Privacy uk:ofcom/heaa-guidance-part3#section-5-privacy
3. Age assurance methods and · 1 provisions
3. Age assurance methods and uk:ofcom/heaa-guidance-part3#3-age-assurance-methods-and
processes · 1 provisions
processes uk:ofcom/heaa-guidance-part3#chunk-15
Kinds of age assurance that are capable of being highly · 1 provisions
Kinds of age assurance that are capable of being highly uk:ofcom/heaa-guidance-part3#kinds-of-age-assurance-that-are-capable-of-being-highly
effective · 4 provisions
effective uk:ofcom/heaa-guidance-part3#chunk-17
effective uk:ofcom/heaa-guidance-part3#chunk-22
effective uk:ofcom/heaa-guidance-part3#chunk-23
effective uk:ofcom/heaa-guidance-part3#chunk-24
Kinds of age assurance that are not capable of being · 1 provisions
Kinds of age assurance that are not capable of being uk:ofcom/heaa-guidance-part3#kinds-of-age-assurance-that-are-not-capable-of-being
highly effective · 1 provisions
highly effective uk:ofcom/heaa-guidance-part3#chunk-19
4. Criteria to ensure an age · 1 provisions
4. Criteria to ensure an age uk:ofcom/heaa-guidance-part3#4-criteria-to-ensure-an-age
assurance process is highly · 1 provisions
assurance process is highly uk:ofcom/heaa-guidance-part3#assurance-process-is-highly
The technical accuracy criterion · 5 provisions
The technical accuracy criterion What is technical accuracy? uk:ofcom/heaa-guidance-part3#what-is-technical-accuracy
The technical accuracy criterion Why is technical accuracy important? uk:ofcom/heaa-guidance-part3#why-is-technical-accuracy-important
The technical accuracy criterion How can service providers have regard to the technical uk:ofcom/heaa-guidance-part3#how-can-service-providers-have-regard-to-the-technical
The technical accuracy criterion accuracy criterion? uk:ofcom/heaa-guidance-part3#accuracy-criterion
The technical accuracy criterion accuracy criterion? uk:ofcom/heaa-guidance-part3#accuracy-criterion-2
The robustness criterion · 5 provisions
The robustness criterion What is robustness? uk:ofcom/heaa-guidance-part3#what-is-robustness
The robustness criterion Why is robustness important? uk:ofcom/heaa-guidance-part3#why-is-robustness-important
The robustness criterion How can service providers have regard to robustness when uk:ofcom/heaa-guidance-part3#how-can-service-providers-have-regard-to-robustness-when
The robustness criterion implementing age assurance? uk:ofcom/heaa-guidance-part3#implementing-age-assurance
The robustness criterion implementing age assurance? uk:ofcom/heaa-guidance-part3#implementing-age-assurance-2
The reliability criterion · 4 provisions
The reliability criterion What is reliability? uk:ofcom/heaa-guidance-part3#what-is-reliability
The reliability criterion Why is reliability important? uk:ofcom/heaa-guidance-part3#why-is-reliability-important
The reliability criterion How can service providers have regard to reliability when uk:ofcom/heaa-guidance-part3#how-can-service-providers-have-regard-to-reliability-when
The reliability criterion implementing age assurance? uk:ofcom/heaa-guidance-part3#implementing-age-assurance-3
The fairness criterion · 4 provisions
The fairness criterion What is fairness? uk:ofcom/heaa-guidance-part3#what-is-fairness
The fairness criterion Why is fairness important? uk:ofcom/heaa-guidance-part3#why-is-fairness-important
The fairness criterion How can service providers have regard to fairness when uk:ofcom/heaa-guidance-part3#how-can-service-providers-have-regard-to-fairness-when
The fairness criterion implementing age assurance? uk:ofcom/heaa-guidance-part3#implementing-age-assurance-4
Additional principles for providers to consider · 3 provisions
Additional principles for providers to consider uk:ofcom/heaa-guidance-part3#chunk-43
Additional principles for providers to consider Accessibility principle uk:ofcom/heaa-guidance-part3#accessibility-principle
Additional principles for providers to consider Interoperability uk:ofcom/heaa-guidance-part3#interoperability
5. Privacy and data protection · 1 provisions
5. Privacy and data protection uk:ofcom/heaa-guidance-part3#chunk-46
The Data Protection Regime · 1 provisions
The Data Protection Regime uk:ofcom/heaa-guidance-part3#chunk-47
ICO guidance on data protection and age assurance · 1 provisions
ICO guidance on data protection and age assurance uk:ofcom/heaa-guidance-part3#chunk-48
Having regard to privacy under the Act · 1 provisions
Having regard to privacy under the Act uk:ofcom/heaa-guidance-part3#chunk-49
6. Technical glossary · 3 provisions
6. Technical glossary Metrics used to measure the accuracy of age assurance uk:ofcom/heaa-guidance-part3#metrics-used-to-measure-the-accuracy-of-age-assurance
6. Technical glossary Metrics used to measure the accuracy of age assurance uk:ofcom/heaa-guidance-part3#metrics-used-to-measure-the-accuracy-of-age-assurance-2
6. Technical glossary Additional terms used in this guidance uk:ofcom/heaa-guidance-part3#additional-terms-used-in-this-guidance

Impact profile

Transportation
0
Banking finance
1
Public sector health
0
Energy, utilities & telco
1
Insurance pensions
0
Services
1
Media entertainment
3
Manufacturing construction
0
Commerce
2

Dimensions

Mechanism strength
3
Signicat obligation
2
Urgency
Pending

Penalties

not supplied

Definitions

No captured definitions.

References

uk:ofcom/heaa-guidance-part3