UK and EU age assurance laws mean a single compliance strategy may not work across Europe

Online services face different age assurance requirements across the United Kingdom and European Union, despite a shared focus on child safety. Differences in age limits, verification standards and the services covered mean that a single European compliance strategy is unlikely to satisfy every requirement.

Shared principles

UK and EU age assurance frameworks, however, share certain principles: two of the most important are that online services should account for the different risks faced by children of different ages, and the assurance method used should be proportionate to the relevant risk and legal obligation. These principles underpin two areas of overlap: age-based risk duties and recognition of different forms of age assurance.

Age-based risk duties

The fact that risks can vary by age group means there is a need to provide an age-appropriate experience for child users. Ofcom’s guidance under the Online Safety Act requires risk assessments to consider how risks will manifest for children of different ages. 

The European Commission’s guideline under article 28 of the Digital Services Act (DSA) take a similar approach. They require platforms accessible to minors to put in place appropriate and proportionate, risk-based and privacy-preserving measures that take into account children’s age and evolving capacities.

Many forms of age assurance

Legal frameworks in both the UK and EU recognise that there are different forms of age assurance, each with different levels of accuracy and robustness. Self-declaration, or a minimum age stated only in terms and conditions, are generally judged as insufficient to meet core child-safety obligations.

Points of difference

The similarities, however, do not amount to a single compliance standard, and the UK and EU approaches will continue to have points of difference. New or emerging laws also increase the complexity that platforms must navigate. The main differences concern age thresholds, methods of age assurance and the services within scope.

Different age thresholds

There remains a lack of harmonisation in the age limits that age assurance is intended to uphold. Proposed UK social media restrictions will focus on under-16s, with separate protections for 16- and 17-year-olds. The proposed EU KIDS ACT takes a different approach: restrictions for some social media and video-sharing services below the age of 15, guardian-controlled accounts from 13, and safety-by-design protections for all under-18s.

Methods of age assurance

There is also divergence between legal frameworks in the form that age assurance must take, with standards also differing within single territories. In the UK, the Online Safety Act sets a high bar with "highly effective age assurance"; while the Information Commissioner’s Office takes a more flexible, risk-based approach permitted under its Age Appropriate Design Code.

The individual proposed laws also provide for different methods. The EU KIDS ACT would require the use of an EU-approved age-verification solution to prevent under-13s accessing certain social media and video-sharing services. The same type of solution would be required to prevent 13- to 14-year-olds creating autonomous accounts rather than via a guardian. However, other age assurance methods would be possible when applying safety-by-design default settings to under-18s.

Services within scope

The type of platform and its functions will be a central consideration when determining whether and how to implement age assurance obligations. A service may find itself heavily regulated in one jurisdiction and outside  the scope of the rules in another. 

The OSA applies to user-to-user and search services, while the DSA regulates a potentially broader category of online platforms. The EU KIDS ACT and UK social media restriction proposals would overlay service-specific obligations for different and often more granular categories of service, such as online games, artificial intelligence companions and chatbots.

The regulatory burden will therefore vary between platforms depending on service type, functionality and risk of harm. Social media, gaming and artificial intelligence chatbot providers may need to reconcile current broad OSA, DSA or General Data Protection Regulation (GDPR) obligations with specific proposed EU and UK requirements. The key question is which rules apply to the whole service and which apply only to particular functions.

Continued fragmentation

The EU KIDS ACT is intended to reduce fragmentation in rules governing minors' access to higher-risk services, but its implementation will not be immediate. France, Austria, Germany, Greece and Spain are among the countries considering interim national measures. Other member states may wait for the EU KIDS ACT to come into force.

The Commission’s response to a French proposal earlier this year illustrates the legal complexity. It indicated that the DSA does not prevent national law from setting a minimum age for access to certain products or services on an online platform, provided the measure complies with EU law, including the DSA and e-Commerce Directive. The Commission also suggested that national legislation could provide a transitional solution if it contains a mechanism allowing the measure to be suspended or repealed once EU rules are adopted.

Member states do not have unrestricted power to impose any obligations in this area. France’s recent experience shows that a national proposal can be struck down where it is too broad or conflicts with the existing position under the DSA. Proposals from member states therefore remain subject to scrutiny not only in comparison with the emerging KIDS ACT model, but also against EU rules already in force.

Osborne Clarke comment

Uncertainty remains over which member states will legislate, what their interim measures will contain and whether they will withstand scrutiny under existing EU law. The EU KIDS ACT and UK social media proposals may also change during the legislative process. Adoption will not guarantee uniformity: experience under the GDPR and DSA suggests that interpretation and enforcement may still differ between countries. 

This is the first Insight in Osborne Clarke's series on age assurance for digital platforms in the UK and EU, mapping where the principal legal frameworks overlap and diverge. Our next Insight in the series will examine practical approaches for platforms as they look to implement age assurance across Europe.