One platform, many rules: what steps can make age assurance compliance work across Europe?

Divergent age assurance requirements across Europe, including within individual territories, require digital platforms to develop a proportionate, manageable approach to compliance that accommodates different legal thresholds without creating unnecessary complexity.

These different approaches to child access to digital services in the UK and EU, and between territories and legal frameworks within them, mean that a single compliance strategy may not work across Europe.  Age assurance is, therefore, becoming a test of how effectively international platforms translate fast-moving regulations into workable compliance solutions – and there are practical steps that platforms can take to achieve this goal.

Mapping legal requirements

Mapping legal requirements, regulatory expectations and age thresholds in each jurisdiction against a service's specific functionalities establishes a vital starting point for implementation. For instance, recommender systems, friend recommendations or live streaming might trigger more extensive age assurance obligations than a service without those functionalities.

Identifying risks to children

Providers will then need to identify the potential for harm to children arising from each major functionality, as well as the service as a whole. Relevant factors may include the type of content permitted or prevalent on the service and how minors in different age groups use the service or particular functionalities.

Express risk assessment obligations already exist under certain legal frameworks, such as the UK Online Safety Act (OSA) and the EU Digital Services Act (for very large online platforms or VLOPs). The proposed EU KIDS ACT will likely also require online social networking services and video-sharing platform services to assess whether the service poses a risk to the privacy, safety or security of under 15s. 

Even where these laws do not apply, or the risk assessment obligations they impose do not require a functionality-by-functionality assessment of risk of harm, identifying which parts of the service could drive risks to minors may inform which method of age assurance is appropriate and proportionate, and where it is deployed.

Once the position is clear, platforms face two related decisions: whether to apply a common baseline across markets or vary access controls by territory; and whether to apply that choice service-wide or to particular functionalities.

Highest bar or country specific?

Some platforms may adopt the highest applicable standard across all territories. For instance, if access to a service or specific features is restricted for users below a certain age in one territory, a service may decide to apply that restriction throughout Europe, even where local rules do not require such a high bar. This may allow the service to claim that it is exceeding local requirements to keep users safe. However, taking this approach has inevitable commercial implications.

Providers may instead opt to operate modified versions of the service, with bespoke age assurance methods and implementations, in different jurisdictions or groups of jurisdictions.

There is no single correct answer: the preferred approach will depend on regulatory exposure, effects on revenue, technical feasibility, implementation costs and the strategic importance of each market.

Service wide or functionality specific?

Some platforms may simply decide to introduce an age gate at account creation. This approach may be required in some circumstances, such as a UK-facing user content service that doesn't expressly prohibit all types of "primary priority" or "priority" content that is harmful to children under the OSA. Even where this approach is not legally mandated, it can offer a simpler user experience, with the potential to offer distinct adult and child versions of the service from the outset. This option, however, may risk being overly binary and inflexible.

Alternatively, a functionality-by-functionality model reserves robust age assurance for higher-risk parts of a service, to the extent applicable legal frameworks permit this. For instance, a platform may allow users to access lower risk features without, or with less precise, age assurance checks. Higher risk functionalities, such as live streaming, friend suggestions or certain recommender systems, might only be accessed by users who pass more robust checks. 

Depending on the specific legal frameworks at play, this may be a proportionate approach. Nevertheless, it would require careful design, taking into account when an age check is triggered, whether the feature is disabled or simply modified for users below a certain age, and whether the age assurance deployed in one area can be relied on for access to other age-specific functionalities.

Age assurance methods

Again, different legal frameworks set different age assurance standards for digital platforms in the UK and EU. Which means of age assurance to deploy is therefore a vital aspect of the deployment strategy.

The choice of age assurance method brings operational questions into focus early. These include what evidence will be accepted and whether the method meets requirements for technical accuracy, robustness, reliability and fairness. Further questions concern how the method will be reviewed as regulatory requirements evolve and how related obligations, such as allowing user challenges, will be approached. Resolving these points before implementation helps legal, product and technical teams reach a shared position that they can implement effectively and explain clearly to senior decision makers.

Osborne Clarke comment

Whatever model and approach are chosen, platform providers will need to document the assessment process, the decisions made and the reasons for them. This helps demonstrate to regulators and internal stakeholders that age assurance is an ongoing governance process, not a one-off technical fix. The approach should also be reviewed as the law, regulatory expectations, technical standards and the service itself continue to develop.

This is the second Insight in Osborne Clarke’s series on age assurance for digital platforms in the UK and EU, examining where the principal legal frameworks overlap and diverge. The first Insight examines differences between UK and EU age assurance laws. The next Insight in the series will look at the challenge of balancing age assurance checks with privacy.

View Osborne Clarke's age assurance for digital platforms in the UK and EU chart for a comparison of the legal frameworks.