Description of PAS 1296:2018 2018

This PAS gives recommendations for a framework for the provision and use of online age check services. This includes, for example. checking the age of those:

1. buying age-restricted merchandise online [e.g. e-liquids (nicotine), adult materials, dangerous goods];

2. accessing online content (e.g. streaming media, adult content);

3. using online services (e.g. dating services, gaming or gambling websites); and

4. enabling access to online age-gated material and services (e.g. education for minors and health for seniors).

NOTE 1 This PAS is applicable to the use of both in- house and third party age check services.

This PAS is written to assist those businesses that are mandated to comply with legal requirements to conduct age checks. It provides recommendations on the due diligence businesses can exercise to ensure that age check services deliver the kind of solution that will meet a business’s specific regulatory compliance needs.

The PAS does not recommend any specific age checking tools for implementation.

This PAS gives recommendations for processes that can be applied when providing and using age check services in order to protect consumers and the online merchant or assist an organization that wishes to enable enhanced e-safeguarding.

NOTE 2 See Annex A and Annex E for information about standards relevant to cryptography and the use of biometrics and other out-of-band methods.

The audience for the PAS is:

1. any organization that wishes to use age check services to conduct age checking, including online merchants and service providers who deal with age-sensitive products; and

2. any organization providing age check services.

NOTE 3 Regulators, professional bodies, trade associations, consumer protection groups, local authorities, and others can use this PAS as a resource. These organizations might have a legal, regulatory, supervisory, advisory, or enforcement role with respect the deployment of age check services by businesses, in one or more sectors. It is important to note that in regulated markets the regulator might establish key criteria as a minimum set of requirements to be met by age checking. The relying party can then decide whether they will go further than that, perhaps to differentiate themselves from others in the market.

In markets with no regulatory age check requirements established, relying parties can use this PAS to determine for themselves the criteria and requirements their business would meet in order to undertake appropriate age checking.

NOTE 4 Although consumers are not a primary audience for this PAS, the privacy, security and consumer protection mechanisms that ought to put in place by both age check services and the businesses they serve, are referred to throughout this PAS.

This PAS does not cover recommendations for the checking of specific ages (e.g. 18+ years, 21+ years, <13 years, 65+ years), though the tools implemented might incorporate this.

This PAS is technology agnostic (i.e. it is unbiased towards the use of different technology tools to solve the age checking issue).

About BSI

BSI Group, also known as the British Standards Institution is the national standards body of the United Kingdom. BSI produces technical standards on a wide range of products and services and also supplies certification and standards-related services to businesses.