PAS 1296

PAS 1296:2018 is a Code of Practice for Online Age Verification service providers developed by the British Standards Institute and the Digital Policy Alliance.

The PAS – a Publicly Available Specification – is intended to assist providers of age restricted products and services online with a means to adopt and demonstrate best practice and compliance when it comes to age checking. It helps businesses comply with regulation, and safeguard their reputation, by providing recommendations that help prove an online user’s age. The standard fully addresses issues relating to privacy, security, safety, usability, accessibility and data protection online.

How do we check conformity against PAS 1296:2018?

Claims of conformity against PAS 1296:2018 should be verified by an independent third party. We assess on a narrative basis, which means we will evaluate systems based on what business’ claim as the verification processes. For example, if the company claims that they can use facial recognition or database checks to verify the age, we will check that they are capable and have the means to execute that function.

The age verification suppliers are assessed against ACCS 4:2020 Technical Requirements for Age Check Systems (which implement PAS 1296:2018) by our team qualified auditors to ensure that they operate to the highest standards. A certificate of conformity issued by us can be used to demonstrate compliance with regulators, such as the Gambling Commission, British Board of Film Classification or local trading standards officials.

Our audit process for PAS 1296:2018 is split into three parts:

Policy Evaluation - Our auditors will conduct an evaluation of your age check policies by building a detailed understanding of your approach to age checks, your practice statements, your approach to data privacy, protection and security, your approach to age validation, your commercial model(s) and your management of age attributes. Our policy evaluation will explore the approach you take to the provision of age check services and the decisions that you have made on the application of your age check policies and procedures.
Quality Evaluation - Our auditors will conduct an evaluation of how you manage and control your business. This means that we will check your approach to quality assurance, control of records, policies and documents, how you handle internal audit, control of non-conformity, customer/user complaints and stakeholder feedback. We will assess the ‘top management’ commitment to quality control, review and implementation of preventative measures.
Technical Evaluation - Our auditors will conduct a technical evaluation of your systems to ensure that their programming and performance are in accordance with your policies. The technical evaluation is undertaken by a technical specialist and is subsequent to the policy and quality evaluation.

What organisations are PAS 1296:2018 applicable to?

The PAS is applicable to Age Check Providers and organisations that need to take Age Check decisions about whether or not a citizen can access age restricted goods, content or services (sometimes called a ‘relying party’).

Age Check Providers will provide at least one of the following services:

Age determination – an indication established that a citizen has a particular age stated to a specified level of confidence and by reference to information related to that citizen
Age categorisation – an indication established that a citizen is of an age that is within a category of ages, over a certain age or under a certain age to a specified level of confidence and by reference to information or factors related to that citizen
Age estimation – an indication by estimation that a citizen is likely to fall within a category of ages, over a certain age or under a certain age to a specified level of confidence by reference to inherent features or behaviours related to that citizen

Relying Parties are usually organisations that need to make age eligibility decisions about citizens that want to access age restricted goods, content or services. We can test that relying parties are adequately gathering sufficient and appropriate information about the age of citizens to be able to make an informed and compliant decision.

Why is compliance important?

Compliance with PAS 1296:2018 provides assurance for 3^rd party solution providers, or businesses providing online age verification services, that they can deliver their services having fully complied with the specific regulatory compliance requirements of the sector, as well as protecting customers from viewing age sensitive material.

The PAS 1296:2018 is a voluntary standard but recognised in Assured Advice provided by local law enforcement officers and regulators.

How do I get our system PAS 1296:2018 certified?

The first stage of gaining PAS 1296:2018 certification for your system is for us to undertake an Application Review in accordance with the requirements of ISO/IEC 17065:2012. There is no fee for the completion of an application review.

During the application review: