ISO and IEC have published ISO/IEC 27566-1:2025, a new international standard establishing a framework for age assurance systems. The standard is titled “Information security, cybersecurity and privacy protection – Age assurance systems – Part 1: Framework”, and is listed as Edition 1 with a publication date in December 2025.
According to ISO’s catalog, the standard spans 29 pages and was developed under ISO/IEC JTC 1/SC 27, the joint technical committee responsible for information security, cybersecurity, and privacy protection standards.
The abstract indicates that the standard defines a framework for age assurance systems used to support age-related eligibility decisions. It outlines core system characteristics and places explicit emphasis on privacy and security considerations. Rather than prescribing a single technical implementation, the framework is intended to provide a structured reference for designing, assessing, and comparing age assurance solutions.
Age assurance has become an increasingly prominent requirement across consumer platforms and regulated digital services, particularly in contexts involving access to age-restricted content, online safety regulations, and youth protection laws. In this environment, ISO/IEC 27566-1:2025 provides a common vocabulary and baseline for discussing how age assurance systems should manage identity data, risk, and user privacy.
The publication of an international framework creates a new reference point for internal assurance reviews and vendor evaluation. Claims around privacy-preserving age checks, security controls, and system integrity can now be assessed against a recognized ISO/IEC standard rather than solely against proprietary criteria.
While the standard does not mandate specific technologies, its placement within the SC 27 portfolio signals an expectation that age assurance be treated as an information security and privacy issue, not only a functional requirement. As regulatory scrutiny of age verification grows, ISO/IEC 27566-1:2025 is likely to influence procurement requirements and conformity assessments in multiple jurisdictions.
—
By Ji-seo Kim
