The UK Government and its regulators increasingly refer to a novel concept of “Age Assurance”. This has caused some confusion, so we set out below our understanding of this term and how it is distinguished from “Age Verification”.
Age Assurance is the broader term for methods to differentiate the age or age-range of an online user to varying levels of confidence.
Age Verification is an aspect of Age Assurance, providing a higher level of confidence the age or age-range of a user than is typically possible with other forms of Age Assurance.
A UK government official describes Age Verification as “the gold standard of Age Assurance.”
Typically, Age Verification is confirming age or age-range to a sufficient standard to comply with laws and regulations that specify a particular exact age e.g. 18+
Age Assurance methods which do not meet the standards required for Age Verification will typically only indicate a likely age range and do so with a lower level of statistical certainty than Age Verification.
Examples of lower level age assurance techniques given by the UK Government so far typical include the use of artificial intelligence. The Secretary of State cited analysis of the typing style and speed of the user as one method which could be developed (known as Keystroke Dynamics).
Age Verification is still possible using artificial intelligence. For example, age estimation by facial analysis can provide a very high level of confidence that a user is over 18, if the software tests for an age above that e.g. with a 3 to 5 year buffer – of 21 – 23 years. Systems can be audited to demonstrate they would correctly confirm a user was over 18 years old 99.99% of the time, with an agreed buffer at over 23 years. This is a far higher standard of accuracy than a human estimating the age of a customer in person, which is on average within about 8 years of accuracy, so satisfies regulators in most situations.
Age Assurance does not include very simple methods such as ticking a box to confirm age or entering a date of birth are considered to return an Age Assurance of Zero. These data points could, however, be used in conjunction with other methods that would provide additional evidence to confirm age to a required level of confidence to be considered as Age Assurance.
The British Standards Institution has defined a Publicly Available Specification, BSI PAS 1296:2018 for “Online age checking. Provision and use of online age check services. Code of Practice.” This sets out the basis for describing the levels of assurance offered by different methods of age checking.
This standard will be updated during 2021, with UK Government sponsorship, to include explicit reference to Age Assurance.
PAS 1296 ‘takes the approach of decoupling identity verification and age checking, and describing a vectors of trust scale for age assurance purposes, which do not conflict with the existing levels of authentication (LoA) scale for identity assurance as described in BS ISO/IEC 29115 Where a higher degree of assurance is required by the user, this PAS refers to the relevant standards’.