The British Standards Institution (BSI) has published a new international standards framework it says is intended to address privacy and protection issues in age assurance systems, as age checks become a more common requirement across online services.
In a press release, BSI described ISO/IEC 27566-1 as part of an international standards series focused on age assurance systems, with an emphasis on how organizations can design and operate age checks while addressing information management, security and privacy risks.
Age assurance has become a recurring policy and product requirement in contexts ranging from social platforms and gaming to app stores and adult content, and many approaches rely on digital identity or identity verification workflows. Even where systems avoid full identity proofing, they can still involve biometric age estimation, document checks or attribute-based credentials that create new data handling and governance challenges.
A key design question is how systems prove an age threshold without collecting more data than needed. Some approaches rely on “yes/no” assertions or reusable attributes, while others rely on age estimation methods that may avoid persistent identifiers but raise questions about accuracy, bias, and how images or templates are handled. A standards framework that explicitly centers privacy can influence how vendors document these choices and how buyers evaluate them.
In the UK market, digital identity mechanisms are already being positioned for age checks. Google Wallet began accepting UK passport digital IDs for age verification, while vendors have sought interoperability models such as a digital ID age verification network built around attribute sharing and trust signals.
Platform requirements are also tightening. Roblox, for example, has said it plans to introduce mandatory age verification for certain chat features. At the same time, legal debates continue over how age checks should be implemented and who bears responsibility for enforcing them — including disputes over proposed app store mandates, such as when a U.S. judge blocked a Texas age verification law.
Standards frameworks like ISO/IEC 27566-1 can provide common terminology and process expectations for vendors and deployers, but their impact will depend on whether regulators, procurement teams and industry groups translate them into operational requirements — and on whether systems can deliver age assurance without turning age checks into broad identity tracking.
–
By Cass Kennedy
