Tag: age verification
If your product or community has age-limited features, you’ve probably looked at third-party age-verification (AV) tools. They can help with fast onboarding and higher assurance. They do not remove your responsibilities as a controller. A recent breach at a third-party provider handling age-check appeals is a reminder to tighten the basics.[i]
Below is a practical checklist you can apply this week.
1) Refresh your DPIA
Treat AV as a distinct processing activity. Update your Data Protection Impact Assessment (DPIA) with:
(a) categories of data the vendor collects, such as ID images and metadata,
(b) special-category or child considerations,
(c) risks if the vendor is compromised, and
(d) mitigations such as encryption, redaction, and retention controls. If you still identify high risks you cannot reduce, you must consult the ICO before you go live.[ii]
2) Get serious about processor due diligence
At a minimum, send potential vendors a security questionnaire covering access controls, key management, encryption at rest and in transit, and relevant certifications. Request a full list of sub-processors and evidence of breach management. Your contracts should mandate prompt breach notification, co-operation with investigations, approval of any sub-processor, transparency about data locations and robust audit rights. Many age-verification providers use third-party image-processing pipelines, so insist on visibility and the right to object to high-risk practices.
3) Data minimisation and retention
Only collect what you need to achieve the purpose. Prefer a pass or fail token and a coarse age band over storing full ID images. Where images are necessary, for example during appeals, set short retention periods and automatic deletion. Avoid internal copies of vendor-held data. Ask for privacy-preserving artefacts such as non-reversible tokens or signed assertions to prove checks occurred.
4) Build a clean incident playbook
Your playbook should name decision-makers in legal, PR, engineering, and security. Include steps to cut off the vendor, rotate keys, revoke scopes, switch to a fallback path, and notify affected users where required. Prepare clear comms templates and support routes. Rehearse the cut-over at least once a year.
5) Children and higher-risk contexts
If your service is likely to be accessed by children, align with the ICO’s Children’s Code. That means high privacy by default, clear and age-appropriate information, and DPIAs that reflect child-specific risks. In AV flows, design for dignity and accessibility. Offer alternatives for people who do not have passports or driving licences. Start with the ICO’s code and standards.[iii]
6) Understand DUAA timing and what changes
The Data (Use and Access) Act 2025 is being switched on in stages. Expect the main data-protection changes about six months after Royal Assent. The new duty to provide a data-protection complaints route is expected about twelve months after Royal Assent. Keep a simple internal timeline, assign owners, and log milestones such as policy updates, training, and website notices. See the government’s commencement plan[iv] and the ICO’s explainer.[v]
7) Recognised Legitimate Interests (RLI): plan, do not assume
RLI is a new lawful basis that will apply to specific public-interest purposes once commenced. Most commercial AV uses will still rely on consent, contract, or legitimate interests with a proper balancing test. Track the ICO’s draft guidance and plan a gap-analysis workshop when the final text lands.[vi]
8) Communicate clearly
Update your privacy notice with a dedicated AV section covering purpose, data types, vendor names, locations, retention, and user choices. Provide a one-screen summary in the AV flow with a link to full details. Make it obvious how people can raise a data-protection complaint with you now and how you will meet the new statutory process once it is in force.[vii]
9) Test your fallback
If the vendor goes down or trust is lost, what then? Offer a temporary pathway, for example age-band self-declaration with heightened moderation, or a pause with email support, while you switch vendors. Document the lawful basis for your fallback and the short-term risk trade-offs you accept.
Quick win checklist
- DPIA updated and signed off
- Processor due diligence complete and sub-processors logged
- Retention periods implemented and images set to auto-purge
- Incident playbook rehearsed and vendor cut-off tested
- Privacy notice section live and complaints route visible
- DUAA milestones tracked and training booked
[ii] ICO: when prior consultation is required; DPIA overview.
