National foreword

This British Standard is the UK implementation of ISO/IEC 27566‑1:2025.

The UK participation in its preparation was entrusted to Technical Committee IST/33/5/5, Age Assurance Standards.

A list of organizations represented on this committee can be obtained on request to its committee manager.

Contractual and legal considerations

This publication has been prepared in good faith, however no representation, warranty, assurance or undertaking (express or implied) is or will be made, and no responsibility or liability is or will be accepted by BSI in relation to the adequacy, accuracy, completeness or reasonableness of this publication. All and any such responsibility and liability is expressly disclaimed to the full extent permitted by the law.

This publication is provided as is, and is to be used at the recipient’s own risk.

The recipient is advised to consider seeking professional guidance with respect to its use of this publication.

This publication is not intended to constitute a contract. Users are responsible for its correct application.

Compliance with a British Standard cannot confer immunity from legal obligations.

This British Standard was published under the authority of the Standards Policy and Strategy Committee on 31 December 2025.

Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).

ISO and IEC draw attention to the possibility that the implementation of this document may involve the use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not received notice of (a) patent(s) which may be required to implement this document. However, implementers are cautioned that this may not represent the latest information, which may be obtained from the patent database available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held responsible for identifying any or all such patent rights.

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html. In the IEC, see www.iec.ch/understanding-standards.

This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 27, Information security, cybersecurity and privacy protection, in collaboration with ITU-T (as ITU-T X.1901).

A list of all parts in the ISO/IEC 27566 series can be found on the ISO and IEC websites.

Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at www.iso.org/members.html and www.iec.ch/national-committees.

Introduction

This document sets out a framework and core characteristics for age assurance systems deployed for the purpose of enabling age-related eligibility decisions. These decisions can be made by anyone for any reason in any location through any type of relationship between an individual and the provider of any goods, content, services (such as the supply of alcohol, tobacco, weapons or online content), venues or spaces that have policy requirements for acquiring assurance about the age or age range of persons.

Age-related eligibility decisions are required when a person must either be a certain age, older or younger than a given age or be within an age range, where ages are counted in years and where these criteria are dependent upon the type of goods, content, services, venues or spaces provided.

This document aims to address issues associated with inadequately defined age assurance processes and associated lack of trust in terms of functionality, performance, privacy, security and acceptability. This document describes characteristics of an age assurance system to help policy makers, implementers and individuals understand and address the issues associated with deployment of age assurance systems.

Although an individual’s age is an attribute of their identity, it is not necessarily the case that establishing the full identity of an individual in a global context is needed to gain age assurance. As such, the process of age assurance can in some instances be connected to identity verification but can also be performed in ways other than via identity verification.

The aim of this document is to enable policy makers (such as governments, regulators or providers of age restricted goods, content, services, venues or spaces) to specify applicable types of age assurance systems and associated indicators of effectiveness in their policy requirements.

As an example, a policy maker may determine that, to authorize the sale of alcohol or tobacco or some other age restricted product, a relying party acting as a decision maker should use a particular type of age assurance system supporting specified characteristics to verify that an individual is an adult.

This document does not:

determine which type of age assurance system nor which type of age assurance method is appropriate for each type of age-related eligibility decision – that is a matter for policy makers;
establish or recommend age thresholds for different goods, content, services, venues or spaces – these are matters for policy makers;
deal with financial or commercial models for age assurance systems – these are matters for economic operators in the age assurance process;
address the requirements for data protection for age assurance systems – these are matters for data controllers;
consider age-related eligibility decisions based on parental controls or parental consent;
consider age-related eligibility decisions based on testimonies from a trusted third party or established through a consent mechanism (such as a parent or legal guardian), since the documents that are required to be presented vary widely among different countries or even between different regions within a country.

1 Scope

This document establishes a framework for age assurance systems and describes their core characteristics, including privacy and security, for enabling age-related eligibility decisions.

2 Normative references

3 Terms and definitions

3.1 Terms relating to age assurance

3.2 Terms relating to actors and parties

3.3 Terms relating to data and processes

4 Overview of age assurance

4.1 Age

4.2 Characteristics of age assurance systems

4.3 Age assurance methods

4.4 Stakeholders

5 Functional characteristics

5.1 Age assurance systems

5.2 Data acquisition for age assurance components

5.3 Binding of age assurance result to the correct individual

5.4 Age assurance data processing

5.5 Configuration management

5.6 Context in use

5.7 Delivery of age assurance result

6 Performance characteristics

6.1 Performance effectiveness

6.2 Indicators of effectiveness

6.3 Performance metrics

6.4 Resource utilization

6.5 Testability

7 Privacy characteristics

7.1 General

7.2 Privacy by design and default

7.3 Data minimization

7.4 Avoidance of adding to digital footprint

7.5 User awareness

7.6 Audit logs

8 Security characteristics

8.1 Security by design and default

8.2 Replay, forwarding or reuse of age assurance result

8.3 Resistance to attack

8.4 Contra indicators

8.5 Fail safe

9 Acceptability characteristics

9.1 General

9.2 Inclusivity

9.3 User engagement and assistance

9.4 Complaint handling

10 Practice statements

10.1 General

10.2 Practice statements by age assurance providers

10.3 Practice statements by relying parties

10.4 Practice statements by intermediaries

Bibliography

BS ISO/IEC 27566-1:2025

Information security, cybersecurity and privacy protection — Age assurance systems - Framework

Current

Published:

31 Dec 2025