UK tech secretary asks Ofcom to clarify what ‘highly effective age assurance’ looks like

There are plenty of answers to the question – and yet it has dogged the UK age assurance ecosystem since UK regulator Ofcom’s rules first referenced it in 2024.

Now, despite political turmoil at the top, the government is asking Ofcom to get more specific. A letter from Technology Secretary Liz Kendall, addressed to Ofcom Chair Sir Ian Cheshire and Chief Executive Dame Melanie Dawes, says that the public consultation on age limits for social media has shown overwhelming support for age assurance requirements – but that the regulator must work to refine its definitions.

“We know that use of highly effective age assurance will be critical to the successful implementation of age restrictions for social media services,” Kendalls writes. “I would therefore like Ofcom to launch a rapid assessment of what highly effective age assurance looks like for determining whether someone is over 16. Please also consider what new methods are emerging that could support this in the future.”

Metrics-based approach could satisfy long-standing request from industry

A possible outcome of Ofcom’s assessment is a statistical baseline for accuracy in biometric matching algorithms. While user choice remains a paramount concern for the age assurance industry and relying parties alike, major providers have long called for a concrete rubric against which age assurance products can be assessed.

The Age Verification Providers Association (AVPA) has offered an example: “highly effective age assurance systems must demonstrate that their certified expected outcomes are such that more than 95 percent of children under 18 are prevented from accessing primary priority content, and more than 99 percent of children under 16 are prevented.”

However, Kendall’s letter suggests a commitment to chipping away at the language, and risking yet more uncertainty. In saying that “Ofcom should consider how age assurance can meet the standard of being highly effective, while making all endeavours to avoid excluding users who are old enough to use certain platforms or features but lack the means to verify their age through passports or driving licences,” Kendall makes no mention of benchmarks or certifications.

Instead, she emphasizes the importance of data privacy and security. “I know that Ofcom has worked closely with the Information Commissioner’s Office to ensure there is synergy between the online safety regime and data protection legislation, and I ask that this continues.”

Inclusivity, accessibility and data privacy are all critical issues in age assurance. But if they are the principles informing the Department of Science, Information and Technology (DSIT)’s notion of what it means to be effective, they still fail to address the core question: how accurate must a system be to be considered “highly effective”? The closest Kendall gets to something tangible is to ask that, “when developing your assessment of highly effective age assurance, I ask that Ofcom considers the principle that age assurance should work effectively for all users.”

Effective age assurance, then, should work effectively – not much of a guideline to go on.

Confusion, opportunism color online debate

Tony Allen, executive director of the Age Check Certification Scheme (ACCS) and a co-author of the ISO/IEC 27566-1 standard on age assurance, has posted on LinkedIn, offering to help Ofcom with its assigned task. Certainly, the standard and the findings collected over three years of Global Age Assurance Standards Summits (which Allen runs) could provide Ofcom with useful insights.

The responses to Allen’s post, however, are the more revealing bit. The AVPA notes how, “given both Ofcom and the ICO announced (during your Global age assurance standards summit) they now believe highly effective age assurance is possible at 13, it would be contradictory to suggest 16 is not feasible.”

This garners a reply from Siobhán MacDermott, CEO of TeenAegis – a company that, per its LinkedIn page, “applies the behavioral detection architecture of global finance to the protection of children online.”

“Why do you think it’s ok to create a database of minors and their photos?” MacDermott asks.  “Especially when the technology is provided by Palantir?”

Palantir is not an age assurance provider in any way, shape or form. Here, MacDermott – who works in the age assurance space – is using specious connections between a theoretical age assurance provider and an unrelated company to cast doubt on online age assurance in general. This does not help the industry at large, in that it ultimately undermines trust in the idea that age assurance can be highly effective at all.

Leveraging rumors about the evils of Big Tech and surveillance to make one’s company look better is also a highly questionable strategy when the CEO is a former chair of Bank of America, and the person in charge of risk is a retired CIA senior intelligence officer.

A clear benchmark, with reference to established testing regimes and certifications, could help alleviate all of this confusion. Standards covering physical objects – tires, chairs – include information on sizes, dimensions and load ratings. There is no reason not to apply the same numerical rigor in defining “highly effective age assurance.”

Swing the hammer with force, or let it go: Kendall

The technology secretary is also aware that laws don’t mean much if they’re very easy to ignore without consequence. Ofcom has been plagued by whispers that it doesn’t have the operational heft to wield the regulatory hammer, and Kendall’s correspondence relating to the social media restriction has had a hint of administrative threat to it. This letter continues in that vein.

“Services must continue taking effective steps to prevent children from encountering illegal and harmful content online, and face consequences where they fall short,” she writes. “I would welcome Ofcom’s support in reassuring the public that robust enforcement action is not only ongoing but delivering tangible outcomes.”

“I am clear that this ban must be rigorously enforced from the outset. Visible, credible enforcement will be essential to building confidence that these protections are real and effective in practice and you continue to have my full support to use the full range of enforcement powers at your disposal.”

Kendall says she looks forward to hearing “what changes may be needed to Ofcom’s structures and ways of working” to deliver the desired outcomes. “Transparency is crucial to public trust and confidence in Ofcom’s enforcement. I am therefore asking Ofcom to submit to Parliament and make publicly available an update on enforcement strategy and outcomes and to make this part of its regular accountability to Parliament.”

The implication is clear. “If further steps are needed to improve the speed and decisiveness with which Ofcom can act, I will not hesitate to take them,” Kendall says. While the stated goal in interrogating the regulator may be to strengthen it, it could easily be taken as a promise to revoke its authority if it doesn’t meet DSIT’s demands.

Ofcom has already signalled that it will need funds to support an uptick in its activity. Kendall writes that “the government will ensure Ofcom has the funding it needs as it prepares to implement and enforce its new duties.” But, once again, what’s missing is the numbers.

Article Topics

accuracy  |  age assurance standard  |  Age Check Certification Scheme (ACCS)  |  age verification  |  AVPA  |  biometric testing  |  Ofcom  |  regulation  |  UK age verification