UK and EU platforms face the challenge of balancing age assurance checks with privacy

Digital platforms in the UK and EU face age assurance and data protection obligations in parallel. These requirements are not inherently incompatible: effective age checks can also protect users' privacy. 

The UK's Information Commissioner's Office has made clear that age assurance may be necessary to avoid unlawful processing of children's data. Checks must meet the applicable online safety and data protection requirements and be proportionate to the risks to children, without collecting or using more personal data than necessary. The choice of method can affect regulatory exposure, product performance and users' willingness to complete the process.

Minimising personal data

Age assurance methods include self-declaration, age inferencing through profiling, age estimation and age verification using photo identification or government-issued ID. The right method depends on the service, its features and the risks to children; a carefully designed combination may be appropriate. 

Self-declaration involves relatively little data processing but will generally not satisfy age assurance requirements on its own. It is likely to be appropriate only for platforms that  do not pose a risk to children, or when used alongside other methods and technical safeguards. Combining age estimation with age inferencing may improve effectiveness compared with self-declaration but involves more data processing.

Third-party age assurance solutions are not all built the same and differ in how they process personal data. Relevant considerations include the data used, the purposes of processing, retention periods and how any underlying AI models have been trained and tested for accuracy and bias.

The European Commission’s age verification solution is designed to be fully interoperable with future EU Digital Identity wallets. It allows users to prove their age to platforms without sharing any other personal data, similar to digital ID solutions already on the market today. Trials are under way in several member states, with wider use intended from early 2027. Uptake may take time, while platforms' existing age assurance obligations continue to apply.

Data protection principles

Age assurance measures must comply with all applicable data protection principles in the UK and EU, not only data minimisation. Fairness involves considering discrimination and bias, alongside a means for users to challenge age assurance decisions. Transparency requires clear explanations of how personal data is used for age checks. Accuracy does not mean that a solution must be 100% statistically accurate, but its likely inaccuracies must be understood and the associated risks mitigated.

Cross-border implementation

Differences in national laws and regulatory guidance can complicate the use of a single age assurance solution across the UK and EU. The definition of biometric data, and the circumstances in which it qualifies as special category data, illustrate the potential for different interpretations.

Osborne Clarke comment

For privacy, product and governance teams, the decision involves more than selecting a technically effective age check. Whether a method is necessary and proportionate depends on the service, its current obligations, their likely direction and the implications for users, technology and governance. Its suitability across jurisdictions may also change as laws, regulatory expectations and service features develop.

Documenting these choices and the reasons behind them supports a defensible approach, while leaving scope for age assurance arrangements to evolve.

This is the third Insight in Osborne Clarke’s series on age assurance for digital platforms in the UK and EU, examining where the principal legal frameworks overlap and diverge. The first Insight in the series examines differences between UK and EU age assurance laws and the second looks at practical steps to make age assurance compliance work across Europe?