International Standards for Age Verification

“Age verification” requires more than just checking a box or even typing in your date of birth to claim you are old enough to access an online service.

Where goods and services are age restricted; meaningful age verification should not be easily circumvented by a child e.g. just require a box to be ticked or a date of birth selected from a dropdown box.

The Age Verification sector currently works to BSI PAS 1296:2018, and two more international standards are under development with the IEEE and ISO – this page explains how these complement each other and create a robust foundaton for the AV industry.

Ticking A Box to reply to e.g. “Are you over 18?” is not sufficient to comply with most laws relating to age-restricted sales.

There is strong evidence that children regularly enter fake dates of birth to open social media accounts – and this compliance flaw is then compounded if other sites rely on that platform’s age records to manage the targeting of their advertising or even the approval process for their age-restricted sales.

Some sites even apply validation rules to the date of birth entry field that prevent it being entered if that makes the user too young to access the site – making trial and error attempts to pass this simple age check literally child’s play.

Proper age verification can be carried out in a wide variety of ways, each offering a different level of confidence in the result (or “level of assurance” as it is technically termed). These levels are affected by a combination of factors explained below – accuracy, authenticity, currency and reliability.

International standards set out the requirements for high quality, reliable age checks. They define these differing levels of assurance – the extent to which a check is accurate and well-sourced – so that websites and regulators can consider the appropriate level of check they conduct – usually decided in proportion to the risk of harm particular goods, services or content present to children.

Some online age verification checks rely on estimation techniques, provided these are proven to operate to a reasonable and defined level of accuracy e.g. a standard could require a particular method delivers age estimates that are within +/- 2 years of the real age at least 99.9% of the time. Other checks may look for a much stronger evidence base and confirmation that the evidence belongs to the person claiming to use it, proving age of that individual to the legal standard of ‘beyond reasonable doubt’.

Standards allow for these levels of assurance to be discussed, designed, delivered and required by regulators or laws, all using a common understanding and language so there is less confusion about what is intended.

The British Standards Institution, BSI, has published a standard, widely adopted by the age verification sector and a requirement for all our members serving the UK market. It is titled “Online age checking. Provision and use of online age check services. Code of Practice” and is also known as PAS 1296:2018. (The standard was sponsored by the Digital Policy Alliance which brought together a wide-range of stakeholders to achieve a consensus for the standard).

BSI PAS 1296:2018

The current de-facto global standard for age verification
Defines “levels of assurance” based on a “vectors of trust”
Can be conveniently referred to in regulations to guarantee that age verification is delivered to the required standard

You can obtain a copy from the BSI here.

ISO – Coming soon…

The International Standards Organisation has also accepted a proposal from the UK, supported by the Department of Digital, Culture, Media and Sport, to define an ISO standard for age verification.

PWI 7732 – Age Assurance Systems Standards is based on the presentation and recommendations arising from ISO SC27/WG5 meeting on 13 April 2021 to commence a ‘Preliminary Work Item’ over the next six months.

The AVPA is engaged with BSI on the development of this global standard, with a working draft expected to be published for consultation before the end of the year.

A working draft will be ready by the end of 2021

A three part international standard

Age Assurance Systems –Part 1: Framework, Levels of Assurance and Privacy Protection
Age Assurance Systems –Part 2: Conformity Assessment
Age Assurance Systems –Part 3: Interoperability

IEEE – Coming sooner…

The Institute of Electrical and Electronics Engineers is nearing completion of IEEE 2089.1, Best Practice for Age Verification.

This complements the existing IEEE 2089, developed in partnership with the 5Rights Foundation.

This standard is intended to be a step-by-step guide for Age Verification providers to follow when working with clients to implement age assurance.

The new standard is due to be finalised during 2022.

ASSESSING LEVELS OF ASSURANCE

Accuracy

Is the age determined by the verification process exact, or is it an estimation? If it is an estimate, how wide is the margin for error?

Authenticity

Does the proof of age belong to the person who is claiming it?

Currency

How recently was the age verified? You may think – “but people don’t get any younger” – but outdated checks may have been conducted when technology was less accurate.

Reliability

Different sources of evidence offer varying levels of reliability – a passport may be close to 100% reliable (if it has been authenticated) while a students union card may offer less confidence.