Create a Practice Statement

For guidance in how to complete this practice statement, please refer to the Draft International Standard for ISO 27566-1 which is currently available for public consultation on the BSI website here. You may also wish to refer to the Age Assurance Terms page on this site for relevant definitions.

Step 1 of 4

Primary Contact Details

Company Name(Required)

Solution Name(Required)

Company Logo

Recommended image size 350px wide

Accepted file types: png, gif, jpg, jpeg, gif, Max. file size: 2 MB.

Lead Contact(Required)

First Last

Lead Contact Email(Required)

Lead Contact Phone (with country code)(Required)

Please describe how your system and practice statement are kept under continuous and regular review, including by your top management(Required)

Are you(Required)

Age Assurance Provider (an entity responsible for providing age assurance results to a relying party)

Relying Party (entity that relies on an age assurance result to make an age-related eligibility decision)

Intermediary (entity that facilitates the interaction between individuals, age assurance providers, relying parties, and other parties to fulfil functions in an age assurance system)

Practice Statement by Age Assurance Provider

Age eligibility requirements(Required)

The required outcome for the age-related eligibility decision identified (e.g. an under, over or between stated age eligibility requirement), including identifying any policy maker(s) that has established age-related eligibility requirements and the content of those requirements and acknowledgement of any intermediaries involved in the process.

Age assurance components(Required)

A description of age assurance components utilized by the age assurance system, including: identifying the sources (including whether they are an authoritative source), identifying whether they rely on primary or secondary credentials, if used, identifying the age verification methods being deployed to establish an age assurance result, if used, identifying the age estimation methods being deployed to establish an age assurance result, if used, identifying the age inference methods being deployed to establish an age assurance result.

Indicators of confidence(Required)

A description of the indicators of confidence achieved by the age assurance system.

Binding process(Required)

A description of how the system undertakes binding of the age assurance result to the correct individual.

Privacy and data protection(Required)

A description of how the age assurance provider approaches protecting the privacy of users, including the data protection laws and obligations, which should include: how the age assurance system meets the privacy characteristics set out in this document and which privacy characteristics it supports, how only the minimal amount of personally identifiable information is processed for the purpose of meeting legal obligations and gaining the required indicators of confidence for age assurance to be established, how personally identifiable information gathered for the purpose of age assurance is limited to that purpose and stored (this does not prevent data gathered for other purposes being used for those purposes, provided this is transparent and accountable), how the age assurance provider will address the rights of individuals that are personally identifiable, including access to that data, challenging decisions made based on inaccurate or incomplete data, solely automated decisions and addressing breaches in the security of that data.

Ease of use(Required)

A description of how the age assurance methods adopted by the age assurance provider offer functionality appropriate to the capacity and age of a child or adult who may use the service.

Security(Required)

A description of how the age assurance system addresses the security characteristics set out in this document and of which security characteristics are supported.

Human rights protections(Required)

A description of how the age assurance provider secures that the use of the age assurance system is implemented in a manner that includes: approaches that are accessible and inclusive to users, approaches that do not unduly restrict access of children or adults to services to which they should reasonably have access, for example, news, health and education services, approaches that provide sufficient and meaningful information for a user to understand its operation, in a format and language that they can be reasonably expected to understand, including if they are a child or an adult.

Audit, certification and review(Required)

A description of how the system, practice statement and approaches to age assurance system is subject to audit, certification and review. In the case of an audit having taken place, there should be a description that includes: the date when the audit was performed, the name and qualifications of the auditor, the major result(s) of the audit report.

Practice Statement by Relying Party

Age eligibility requirements(Required)

The criteria for age-related eligibility decisions (e.g., whether the eligibility is for individuals under, over or within a specified age range).

Providers and intermediaries(Required)

A description of age assurance providers (if any) utilized in the age assurance system, with appropriate cross-referencing to their practice statements, as well as acknowledgment of any intermediaries involved in the process.

Source of age-related eligibility requirements(Required)

A description of where the age-related eligibility requirements came from; in particular, identifying both the policy makers and the associated regulations or recommendations.

Age assurance methods(Required)

A description of the methods used by or on behalf of the relying party to establish an age assurance result including: if used, identifying the age verification methods being deployed to establish an age assurance result, including the issuers relied upon, for example identity providers, digital credential issuers or both. if used, identifying the age estimation methods being deployed to establish an age assurance result, including the age assurance intermediaries relied upon, if used, identifying the age inference methods being deployed to establish an age assurance result, including the issuers relied upon, for example either identity providers or digital credential issuers or both., if a result of an age assurance method is indeterminate or unknown, indicating which fallback mechanism(s), method(s) or technique(s), if any, will be used and if applied, a description of configuration settings utilized and how they have impacted upon the requirements of this document.

Privacy and data protection(Required)

A description of how the relying party approaches protecting the privacy of users, including the data protection laws and obligations, which should include: how the relying party minimizes the amount of personally identifiable information it collects and stores about individuals during making age-related eligibility decisions, how personally identifiable information gathered for the purpose of age assurance is limited to that purpose and stored (this does not prevent data gathered for other purposes being used for those purposes, provided this is transparent and accountable), how the relying party will address the rights of individuals that are personally identifiable, including access to that data, challenging decisions made based on inaccurate or incomplete data, solely automated decisions and addressing breaches in the security of that data, how the personal data is secured, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical and organizational measures, how the relying party and any intermediaries it uses, if any, meet(s) the privacy characteristics from clause 8 of this document, how the relying party and any intermediaries it uses, if any, meet(s) the security characteristics from clause 9 of this document and how the relying party and the age assurance method(s) that it uses, if any, meet(s) the acceptability characteristics from clause 10 of this document.

Ease of use and human rights protections(Required)

A description of how the age assurance methods adopted by the relying party offer functionality appropriate to the capacity and age of a child or adult who might use the service. A description of how the relying party that secures the use of the age assurance system is implemented in a manner that includes: approaches that are accessible and inclusive to users with protected characteristics or additional needs, approaches that do not unduly restrict access of children or adults to services to which they should reasonably have access, for example, news, health and education services, approaches that provide sufficient and meaningful information for a user to understand its operation, in a format and language that they can be reasonably expected to understand, including if they are a child or an adult.

Redress(Required)

A description of how an individual can seek redress.

Audit, certification and review(Required)

A description of how the system, practice statement and approaches to age assurance is subject to audit, certification and review.

Primary Contact Details

Practice Statement by Age Assurance Provider

Practice Statement by Relying Party

Practice Statement by Intermediary