Age verification standards

ISO/IEC 27566-1:2025 "Information security, cybersecurity and privacy protection — Age assurance systems — Part 1: Framework" has been published.

This is the start of a multi-part standard concerning the tricky process of verifying someone's age to an appropriate level of assurance, without unnecessarily invading or compromising their privacy rights. As usual for a 'part 1', it provides a general introduction and conceptual basis for the framework that the remaining parts will build upon.

A person's age or age range may be important to:

• Treat them and interact appropriately with them as grown adults, teens or pre-teens;

• Apply various laws and regulations that specify ages;

• Allow or disallow supposedly 'adults-only' activities such as sex, driving, voting, standing for office, smoking, drinking, night-clubbing, various sports categories or social media*;

• Determine whether they qualify for age-specific benefits such as free dental care, pensions, discounts for seniors, loans/credit, and respect;

• Invite or require the presence of 'a responsible adult' in formal situations such as police interviews and potentially life-changing medical decisions;

• Send them to juvenile detention centres, adult prisons or 'home, now!';

• Distinguish individuals sharing the same names (a weak form of authentication) or spot some data entry errors (an integrity control);

• Celebrate their birthday.

* An age-related Australian law came into effect this month: the government has banned under-16s from having personal accounts on some social media services (ten so far), holding the specified social media companies (not the kids or their parents) accountable for the 'reasonable steps' necessary to enforce the ban ... so the companies are obliged to adopt effective age-controls, plus user identification and authentication controls sufficient to stop kids simply faking their details or sharing adult accounts. This is presumably a stop-gap approach or trial prior to the introduction of government-issued IDs ... which stirs up a storm cloud of privacy, security and social concerns.