OfDIA guidance limits alcohol age checks to certified UK digital ID providers

Raise a glass to the UK’s Office for Digital Identities and Attributes (OfDIA), which has published documentation clarifying how they intend the new mandatory licensing conditions are intended to work when customers use digital ID to prove their age.

A blog post from OfDIA says “the Licensing Act 2003 (Mandatory Licensing Conditions) (Amendment) Order 2026, once it is approved by Parliament and has come into force, will enable retailers and hospitality venues in England and Wales to accept digital proofs of age when selling or supplying alcohol, provided the statutory conditions are met and subject to any local licensing conditions.”

Fair enough. But as has been pointed out by Tony Allen, who chairs the Expert Panel on Age Restrictions and runs the Age Check Certification Scheme (ACCS), it’s not quite so simple. Questions had been raised about the necessary conditions for accepting digital ID, allowable methods for age verification, and other issues. The Home Office has already offered its response to questions that the panel submitted.

Now it is OfDIA’s turn, and it aims for crystal clarity.

DVS providers only, no age estimation allowed

“Only registered DVS may be used to check age,” it says. That means only providers who have been certified against the government’s Digital Verification Services (DVS) trust framework are acceptable. “The DVS used by the licence holder to deliver the digital proof of age, or the customer to verify their age, must appear on the DVS register, or it does not meet the requirements of the draft order.”

OfDIA says services on the DVS register are regularly, independently audited and certified against the trust framework, and that the registration and certification process is “designed so that relying parties can trust services on the register without needing to conduct extensive assessments of the underlying technologies themselves.”

This is all in keeping with a projected significant expansion in the market for DVS providers of biometric age verification.

Moreover, verification means exactly that. “Some DVS providers offer other age assurance technologies, such as age estimation. These technologies cannot be certified against the UK digital verification services trust framework and cannot appear on the DVS register.”

The digital proof of age being presented must reach at least “a medium level of confidence” and there must be assurance “that it belongs to the person presenting it” – which can be achieved through biometric authentication and binding.

This is in keeping with a risk-based approach that requires stronger assurance for more tightly restricted products; an age range simply isn’t good enough when booze is on the counter.

Digital ID not mandatory, data minimization key

OfDIA confirms that “the use of DVS and the acceptance of digital proofs of age by licence holders is optional.”

“Businesses will not be required to adopt digital proof of age when the legislation comes into force. They may continue to rely on existing physical documents if they wish.”

Anyone can choose to use a digital ID for proof of age, but no one must. As well, “licence holders will decide whether and how they implement digital verification.” They are allowed to enable digital ID for age assurance at self-checkout kiosks. However, it is necessary to verify a digital ID using a programmatic check from a DVS provider; visual checks do not cut the mustard.

Finally, data minimization is the goal. “Licence holders and DVS providers must comply with data protection legislation, including the data minimization principle, and only process personal data that is necessary for verifying age.”

Consider legal clarification beyond blog: AVPA

In responding to the publications, the Age Verification Providers Association (AVPA) says it is grateful for the clarity, but would like to keep the discussion open on certain issues. Writing on LinkedIn, it says “the exclusion of age estimation is a decision we continue to disagree with,” and that “this may go beyond the SI as drafted, since we believe the text would at a minimum permit estimation as a triage tool to inform the trigger for a certified DVS age check, albeit not as a verification method in its own right.”

Furthermore, “the statutory guidance should specify the minimum authentication standard required for this use case to avoid what we call the ‘little brother problem’: sending a younger sibling to the supermarket with an adult’s phone and PIN to buy alcohol.”

AVPA insists “it is critical that the statutory guidance, due to be published once Parliament has considered the secondary legislation, explicitly confirms the key points on which we have now received the reassurance we sought, as it will be hard to rely on a blog to supersede secondary legislation if any conflict leads to legal arguments.”

Article Topics

AVPA  |  biometric age estimation  |  digital verification service (DVS)  |  DVS Trust Framework  |  OfDIA  |  retail biometrics  |  UK digital ID