Age Assurance Duties under the Online Safety Act

The Online Safety Act was passed into law on 26 October 2023. While most of the Act’s provisions entered into force on 10 January 2024, much of the detail surrounding its implementation will come in the form of Codes of Practice, which will be issued by Ofcom. Ofcom estimates that over 100,000 online services could be subject to the Act’s new rules, including user-to-user services; search services; and internet services that publish or display pornographic content.

Ofcom issued the first of its draft Codes of Practice for consultation, focusing on illegal harms duties, on 9 November 2023. We took a closer look at this consultation back in our November newsletter. The consultation is open until 5pm on 23 February 2024 and can be accessed here (external link).

Age Assurance Duties Consultation

On 5 December 2023, Ofcom launched the second consultation relating to the Online Safety Act, this time focusing on age assurance and “other Part 5 duties”. Full details of the consultation are available here (external link) and it is open until 5pm on 5 March 2024.

Age assurance duties under the Online Safety Act apply to online services which host pornographic content. The duties will also apply to any user-to-user services which are likely to be accessed by children. Such services will be required to implement age assurance to prevent children from accessing harmful content, for example, that which promotes suicide or eating disorders.

Services hosting pornographic content must do the following:

• Implement age verification or age estimation (or both) measures to ensure that users under the age of 18 cannot normally encounter in-scope pornographic content; and
• Ensure that the age verification or estimation measures are “highly effective”.

Ofcom’s Guidance on Age Assurance

As age assurance technology is still very much a developing area, Ofcom does not recommend any specific tools or technology in the draft guidance. Instead, it adopts a principles-based approach, outlining four criteria which an in-scope service provider should consider:

• Technical accuracy;
• Robustness;
• Reliability; and
• Fairness.

In addition, service providers should consider accessibility and interoperability to ensure that their chosen age assurance method is easy to use.

While Ofcom avoids specifics, however, it does provide examples of age assurance methods that could be highly effective:

• Open banking;
• Photo ID matching;
• Facial age estimation;
• Mobile network operator age checks;
• Credit card checks; and
• Digital identity wallets.

Similarly, the consultation sets out some forms of age assurance that will not be considered effective:

• Self-declaration of age;
• Age verification through online payment methods which do not require a user to be over 18; and
• General contractual restrictions (e.g., in a website’s terms and conditions) on the use of the regulated service by children.

Finally, the guidance addresses record-keeping responsibilities. In-scope service providers will be subject to the following record-keeping duties. Service providers must:

• Keep written records of the type(s) of age assurance in use, and how it/they are used;
• Keep written records of how they have considered privacy and data protection legislation when deciding how they will use age assurance measures;
• Produce a summary of the parts of such written records that relate to how they have complied with their duties under the Online Safety Act (including details of the type(s) of age assurance used and how it/they are used); and
• Make the summary available to the general public.

It is clear that the Online Safety Act and Ofcom give in-scope service providers a certain amount of room to manoeuvre where age verification is concerned, not least due to the developing nature of the technology. Privacy and data protection will be of vital importance in this area, particularly given the nature of the online content involved.

What’s Next?

Once this consultation has closed, Ofcom will review the responses and its proposals. It is currently expected that Ofcom’s codes of practice will be finalised and in effect by the end of this year.