Ofcom has published guidance for organisations on how to conduct effective due diligence of third-party vendors providing age assurance.
As we have commented upon previously here, effective age assurance has been a particular focus for Ofcom and the Information Commissioner’s Office recently, as both have urged organisations to do more to improve their measures or risk facing regulatory action.
For organisations outsourcing age assurance to third-party vendors, Ofcom is clear that they remain responsible for ensuring that the measures employed are highly effective, and expects them to conduct regular due diligence on their providers.
To ensure that due diligence is effective, Ofcom has produced a resource containing a series of questions organisations should put to vendors, together with a template worksheet that can be completed as appropriate.
Such questions include:
- What metrics are collected and measured against to demonstrate that the solution meets each of Ofcom’s highly effective age assurance criteria?
- How is the system tested and how are any issues flagged?
- What methods of circumvention are available to children and what steps have you taken to address them?
- How are users able to appeal the results of an age check, and how are relevant metrics about appeals monitored?
- Does the method employed meet a particular standard or scheme?
- If age estimation is employed, does it include a challenge age approach?
To read more, click here.