‘Policy intention is becoming much clearer’ on digital ID for UK alcohol sales

Is this it? Could it actually be happening? Is the UK government actually now preparing to sign the amendment to the Mandatory Licensing Conditions, allowing people to use digital ID to prove their age when buying alcohol?

The Age Check Certification Scheme’s Tony Allen says it looks possible.

“This is the fourth article I have written about the proposed amendment to the Mandatory Licensing Conditions that will allow digital proof of age to be used for alcohol sales in England and Wales,” Allen writes, introducing his latest round of insights on LinkedIn addressing the issue. “That probably tells us something.”

As is often the case, a basic idea (you can use your digital ID to prove you’re old enough to buy booze) has become increasingly complicated with every policy step. But Allen suggests the air may be clearing. “The Government has published not one, but three detailed explanatory articles addressing many of the practical questions that have been raised,” he says, pointing to three publications from the Office for Digital Identities and Attributes (OfDIA).

“These articles give us the clearest public explanation yet of what Government believes the new Mandatory Licensing Condition actually means,” Allen says – “and perhaps it is time, temporarily at least, to stop debating what Government intends and start thinking about what happens next.”

All ages can use digital ID when buying alcohol

Allen identifies a number of issues on which he feels the government has provided welcome clarification. The first is that digital proof of age isn’t just intended for customers who look young; anyone can use a digital ID for age assurance, and businesses must take it from customers of any legal age.

Indeed, he writes, “a retailer can apparently design a self-service journey in which customers of any age use DPOA rather than waiting for somebody to decide whether they look young enough to require a challenge. This new ‘voluntary approach’ is a feature not previously explored with the existing mandatory licensing condition.”

Self-service checkouts OK, data minimization in play

The second is confirmation that digital proof of age can be used at self-service checkouts, with a few caveats around matters such as proxy purchasing and intoxication. As Allen explains, “a human does not necessarily have to be in the age verification loop but there may nevertheless need to be human supervision of the wider alcohol-sale environment.”

The third is clarification on data minimization, and a leaning toward a privacy-preserving model that only requires a binary proof of age and does not disclose any personal information.

Fourth, Allen says, the government has clarified the issue of binding. “The digital proof cannot merely be genuine. There needs to be adequate assurance that it belongs to the person presenting it,” be it via biometric authentication or otherwise. “That is an important issue. A perfectly genuine over-18 credential is not much use as an age-control mechanism if it can simply be handed to a 16-year-old sibling along with the phone on which it resides.”

Finally, the certification regime will operate within the existing statutory DVS framework, rather than establishing a new regime specifically for alcohol. Per Allen, “the identity underpinning the proof must have been verified to at least medium confidence by an appropriately registered DVS provider, and the digital proof presented to the licence holder must be delivered by a registered DVS provider.” That is as clear as it gets.

Policy must not conflate identity with age

Allen notes that OfDIA has started work on an age verification supplementary code to apply across different use cases. The harmonization is a positive: “a coherent age verification ecosystem should not require a completely different technical architecture every time Parliament decides that something should have an age threshold,” he says.

But it comes with a warning that, while increasingly familiar to followers of age assurance regulation, still needs drilling for policymakers. “Age assurance IS NOT identity assurance,” Allen says. “An age verification supplementary code must not inadvertently turn age assurance into a subset of identity assurance.”

Which is to say, while the DVS Trust Framework may provide the architecture for digital proof of age for UK alcohol sales, in its design and intent it is not equivalent to age assurance, which Allen argues is “a much broader concept,” which also includes approaches like facial age estimation and age inference.

Allen says that because these can “establish age-related eligibility without first establishing an identity from which an age attribute is derived,” they align with “a fundamental principle (reflected throughout ISO/IEC 27566-1 and increasingly in age-assurance policy internationally),” dictating that an individual should not need to establish identity in demonstrating that they satisfy an age-based eligibility requirement.

For Allen, who co-authored the ISO-IEC 27566-1 standard on age assurance systems, it is important that these technologies are not dismissed just because they “do not fit naturally within an identity-anchored DVS model” – especially in that they represent some of the most privacy-preserving approaches available.

As such, “as the supplementary code develops, it will therefore be important that OfDIA does not simply try to ‘shoehorn’ age assurance into an identity framework.”

Now it is up to lawyers and Trading Standards Officers

Allen’s article discusses questions that still remain to be solved, and notes that it still has to be approved by Parliament; no one who has followed the file is counting a chicken that has yet to hatch. Nonetheless, Allen’s simple answer to the question of what happens next is that supermarket groups, pub companies, hospitality operators and other large licence holders will talk to their lawyers.

Licensing barristers and solicitors will be tasked with statutory interpretation of how the Licensing Act, the Order and the licence conditions work together. They will need answers to all of the pertinent questions. And the answers they land on “will shape how some of the largest retailers and hospitality businesses in the country actually deploy digital proof of age. That makes the views of the specialist licensing Bar particularly important,” Allen writes.

Additionally, Trading Standards Officers will need to understand Primary Authority Advice under the Regulatory Enforcement and Sanctions Act, in order to advise businesses on implementation. “Large retailers and hospitality businesses operating hundreds or thousands of premises need regulatory consistency.”

Also bearing significant weight is statutory guidance issued by government to translate policy architecture into “something that retailers, hospitality businesses, DVSPs, licensing authorities and enforcement officers can apply consistently.”

The long and the short of it is, the government has delivered a “reasonably coherent policy architecture.” As such, “the next important question is what happens when the people who actually have to advise businesses and enforce the condition read it.”

That puts the spotlight on barristers and Trading Standards Officers.

“Once Parliament has finished with this Order, the most important people in the room may no longer be Ministers, Parliamentary Counsel or digital identity policymakers,” Allen says. “They may be the barrister writing an opinion for a supermarket and the Trading Standards Officer writing the Primary Authority Advice on which that supermarket proposes to rely.”

EU nations move on digital ID for age assurance

A report in CroatiaWeek says Croatia is introducing a new digital age verification system for online alcohol purchases, with buyers required to confirm they are over 18 through the state’s m-Građani application, which then generates a QR code for proof of age. The move is part of a package, passed in May, that also includes tighter protections against alcohol sales to minors, and allows local authorities to regulate hours for alcohol sales.

Croatia follows a host of EU nations that have introduced similar laws. Greece now applies the EU’s age certification system to verify the age of customers buying tobacco and alcohol. Denmark requires digital age verification for online sales of alcohol, tobacco and nicotine products. Germany, Switzerland and Austria all require digital age verification for online alcohol sales. And Poland recently adopted a package of laws including recommendations that adult content sites use the electronic age verification service available within the European Digital Identity (EUDI) Wallet for age assurance, suggesting a similar path ahead for booze sales online.

Article Topics

Age Check Certification Scheme (ACCS)  |  age verification  |  digital ID  |  EU age verification  |  regulation  |  retail biometrics  |  reusable digital ID  |  UK age verification