ICO and Ofcom release joint statement on age assurance

The Information Commissioner's Office (ICO) and Ofcom have published a joint statement via the Digital Regulation Cooperation Forum (DRCF) outlining the interaction between UK data protection laws and the Online Safety Act 2023 (OSA) regarding age assurance. The statement aims to help organisations navigate their dual obligations while protecting minors from online harm. 

This includes explaining how the ICO and Ofcom operate a flexible, technology-neutral approach, requiring service providers to select the most appropriate methods to mitigate risks. Where age assurance duties apply, processes must be highly effective at identifying child users. Relying solely on self-declaration is not enough to determine age or to prevent underage access.

While acknowledging that all age-assurance approaches involve processing personal data, the regulators clarify that such methods must be necessary, proportionate, and compliant with the UK General Data Protection Regulation (GDPR). Furthermore, systems must address circumvention risks to ensure accuracy and robustness. 

Training Announcement: The IAPP Certified Information Privacy Technologist (CIPT) is a privacy-focused professional IT certificate from the IAPP that addresses data protection requirements and controls within complex technological environments. It explores the data lifecycle, privacy risk models and frameworks, the principles of Privacy by Design, and the role of privacy-enhancing technologies within the organisation. Find out more.