United KingdomOfcom Guidance on Highly Effective Age Assurance and Other Part 5 Duties
Statement: Age Assurance and Children's Access, Ofcom, published
Guidance, not a law: Ofcom's reading of Online Safety Act 2023, Part 5 (duties of providers of regulated provider pornographic content). It binds nobody by itself; the law it reads does.
Guidance on an adult content age verification (AV) rule, addressed to private bodies.
- Audit expectation
- on_request
What the regulator expects
- Applies to providers of regulated provider pornographic content under Part 5 of the Online Safety Act 2023; this is Ofcom's statutory guidance on what counts as highly effective age assurance.
- Choose an age assurance method Ofcom's guidance names as capable of being highly effective: photo ID matching, facial age estimation, credit card checks, open banking checks or mobile network operator checks.
- Do not rely on self declaration or a basic checkbox; the guidance states it is not sufficient.
Who enforces it
Enforcement body
Ofcom
Settledness
Ofcom issues this as its own guidance under section 82 of the Online Safety Act 2023, so the guidance is the instrument itself.
- As of
- Open questions
- Does a provider whose age verification or age estimation matches an example in Ofcom's guidance under section 82(2)(a) of the Online Safety Act 2023 thereby meet the requirement in section 81(3) that it be "highly effective at correctly determining whether or not a particular user is a child"?
What it reaches
Covered services
Providers of regulated provider pornographic content under Part 5 of the Online Safety Act 2023.
Instrument type
guidance published by a regulator
How the hook was established
express
What makes it apply
User location, Market targeting
Verification methods
Gov ID, Facial estimation, Transactional data, Third party service, Device signal
What it makes you log
Who may demand the log
Regulator
What the log must hold
System identity, Decision basis
Log retention
Paragraph 5.13 says providers should keep the written records for the length of their record retention policy or at least three years, whichever is longer; the Act itself states no period. Paragraph 5.12 says no personal data about users should be included in the record.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 3
- Prohibits retaining
- Personal data about users in the written record of age assurance
Logging duty
The duty is to make and keep a written record of the kinds of age verification or age estimation used and how they are used, and of how the provider had regard to privacy law in choosing them, and to summarize it in a publicly available statement. The guidance says providers are not required by the Act to keep a record of the result of any individual age check.
- Kind
- Explicit
- As of
- Provision
- Ofcom, Guidance on Highly Effective Age Assurance and Other Part 5 Duties, section 5 (paragraphs 5.1 and 5.2), on the record-keeping duties in section 81(4) of the Online Safety Act 2023
- Trigger
- age_assurance
Why the legislator wanted it
- As of
- Quote
- When considering compliance, Ofcom will consider whether service providers have kept a written record of how they have had regard to privacy and data protection requirements in making decisions around age assurance.
- Source link
- https://www.ofcom.org.uk/siteassets/resources/documents/consultations/category-1-10-weeks/statement-age-assurance-and-childrens-access/guidance-on-highly-effective-age-assurance-and-other-part-5-duties.pdf
- Source kind
- Regulator guidance
- Purpose
- regulator_supervision
- accountability_demonstration
What this law does
Ofcom's statutory guidance under section 82 of the Online Safety Act 2023 sets out what counts as highly effective age assurance for Part 5 pornography providers, naming photo ID matching, facial age estimation, credit card checks, open banking checks, and mobile network operator checks as capable methods, and stating that self declaration or a basic checkbox is not sufficient.
Back to the example · Lint your app
Page updated .