ICO publishes updated Opinion on age assurance

The Children's code is a statutory code of practice that sets out how internet society services (ISS) likely to be accessed by children should protect children's rights online. In practice, this applies to most commercial online services where the relevant service is likely to be accessed by children.

Age assurance is defined as approaches used to: (i) provide assurance that children are unable to access adult, harmful or otherwise inappropriate content when using ISS; and (ii) estimate or establish the age of a user so the ISS can be tailored to their needs and protections put in place appropriate to their age.

The updated Opinion aims to reflect new technological and legislative developments and explain to organisations how to meet their data protection obligations, while also complying with the Online Safety Act 2023. It is aimed both at ISS and providers of age assurance services, to provide guidance on how to implement the technology in a risk-based and proportionate way, in compliance with data protection law. It covers:

• the ICO's expectations for age assurance, including on risk management, application of data protection principles and use of AI;
• different age assurance methods and how they should be implemented;
• details of the legislative framework and when organisations will be in scope of the Children's code and the Online Safety Act; and
• guidance on how to conduct risk assessments, including activities likely to result in a high risk to children.

The ICO's press release is available here and the updated Opinion is available here.