Online Safety Act 2023

Content of codes of practice: age assuranceU.K.

12(1)This paragraph is about the inclusion of age assurance in a code of practice as a measure recommended for the purpose of compliance with any of the duties set out in section 12(2) or (3) or 29(2) or (3), and sub-paragraph (2) sets out some further principles, in addition to those in paragraphs 1 and 2 (general principles) and 10(2) (freedom of expression and privacy), which are particularly relevant.

(2)In deciding whether to recommend the use of age assurance, or which kinds of age assurance to recommend, OFCOM must have regard to the following—

(a)the principle that age assurance should be effective at correctly identifying the age or age-range of users;

(b)relevant standards set out in the latest version of the code of practice under section 123 of the Data Protection Act 2018 (age-appropriate design code);

(c)the need to strike the right balance between—

(i)the levels of risk and the nature, and severity, of potential harm to children which the age assurance is designed to guard against, and

(ii)protecting the right of users and (in the case of search services or the search engine of combined services) interested persons to freedom of expression within the law;

(d)the principle that more effective kinds of age assurance should be used to deal with higher levels of risk of harm to children;

(e)the principle that age assurance should be easy to use, including by children of different ages and with different needs;

(f)the principle that age assurance should work effectively for all users regardless of their characteristics or whether they are members of a certain group;

(g)the principle of interoperability between different kinds of age assurance.

(3)In a code of practice that describes measures for the purpose of compliance with the duty set out in section 12(3)(a), OFCOM must recommend (among other things) age verification or age estimation which is such of a kind, and which is to be used in such a way, that it is highly effective at correctly determining whether or not a particular user is a child (see section 12(6)).

(4)In deciding which kinds and uses of age verification or age estimation to recommend for the purpose of compliance with the duty set out in section 12(3)(a), OFCOM must have regard to their guidance under section 82 that gives examples of kinds and uses of age verification and age estimation that are, or are not, highly effective at correctly determining whether or not a particular user is a child.

(5)Nothing in sub-paragraph (2) is to be read as allowing OFCOM to recommend, for the purpose of compliance with the duty set out in section 12(3)(a) by providers subject to the requirement in section 12(4), a kind or use of age verification or age estimation which does not meet the requirement to be highly effective as mentioned in section 12(6).

(6)A code of practice that recommends the use of age assurance for the purpose of compliance with the duties set out in section 12(2) or (3) must also describe measures recommended for the purpose of compliance with the duties set out in—

(a)section 12(9), (11) and (13) (inclusion of clear information in terms of service), and

(b)section 21(2) and (3) (see, in particular, section 21(5)(e) (complaints about age assurance)).

(7)A code of practice that recommends the use of age assurance for the purpose of compliance with the duties set out in section 29(2) or (3) must also describe measures recommended for the purpose of compliance with the duties set out in—

(a)section 29(5) and (8) (inclusion of clear information in publicly available statement), and

(b)section 32(2) and (3) (see, in particular, section 32(5)(d) (complaints about age assurance)).

(8)A code of practice may—

(a)refer to industry or technical standards for age assurance (where they exist);

(b)elaborate on the principles mentioned in paragraphs (a) and (c) to (g) of sub-paragraph (2).

(9)In this paragraph “age assurance” means age verification or age estimation, and see in particular section 230(4) (self-declaration of age not to be regarded as age verification or age estimation).