BBFC launch public consultation on draft Guidance on Age Verification Arrangements and draft Guidance on Ancillary Service Providers.

The BBFC was designated by the Secretary of State for Digital Culture Media and Sport as the age-verification regulator under the Digital Economy Act 2017 on 21 February 2018.  Today  the BBFC is launching a consultation on the draft Guidance on Age Verification Arrangements and draft Guidance on Ancillary Service Providers (ASPs) in accordance with the Secretary of State’s Guidance to the Regulator.

Under section 14(1) of the Digital Economy Act 2017, all providers of online commercial pornographic material accessible from the UK will be required to carry age-verification controls to ensure that their content is not normally accessible to children and does not contain extreme pornography, as defined in the Criminal Justice and Immigration Act 2008.  When the law comes into force later this year, adults will be required to demonstrate that they are 18 or over before accessing online pornography. This legislation is an important step in making the internet a safer place for children.

The draft Guidance on Age Verification Arrangements sets out the criteria by which the BBFC will assess that commercial pornographic services meet the requirements of section 14(1) of the Act – to ensure that online commercial pornographic material is not normally accessible to children. The draft guidance outlines good practice, such as offering a choice of age-verification solutions to consumers. It also includes information about the requirements that online pornography providers must adhere to under data protection legislation, which is enforced by the Information Commissioner's Office (ICO).

Under section 25 of the Digital Economy Act 2017, the BBFC is required to publish: "guidance for the purposes of section 21(1) and (5) about the circumstances in which it will treat services provided in the course of a business as enabling or facilitating the making available of pornographic material or extreme pornographic material". The draft Guidance on Ancillary Service Providers includes a non-exhaustive list of classes of ancillary service provider that the BBFC will consider notifying under section 21 of the Act, such as social media and search engines.

The BBFC will consider and publish responses to the consultation before submitting final versions of the Guidance to the Secretary of State for approval. The Secretary of State is then required to lay the Guidance on Age-verification Arrangements and Guidance on Ancillary Service Providers in Parliament for formal approval. The BBFC supports the Government's decision to allow a period of up to three months after the Guidance is formally approved before the law comes into force, in order to give industry sufficient time to comply with the legislation.  This decision means that the legislation should come into force before the end of 2018.

David Austin, Chief Executive of the BBFC says:  "The BBFC's new role as age-verification regulator aligns with our existing work in helping to protect children from potentially harmful material. There are a range of methods for verifying whether someone is 18 or over and we expect to see a number of solutions offered by providers to give people different ways to verify their age. The new law is not about stopping adults from watching pornography that is legal, it is about making the internet a safer place for children.

The draft Guidance we are consulting on today sets out the technical requirements of the Digital Economy Act and the criteria by which we will assess the effectiveness of age verification on commercial pornographic services to ensure that children cannot access the content.   The BBFC expects the adult industry to respond responsibly to the new age-verification requirement, which is an important child protection measure”.

Editors Notes

Chapter 3 of the Guidance on Age-verification Arrangements sets out the following criteria against which the BBFC will assess that an age-verification arrangement meets the requirement under section 14(1) to secure that pornographic material is not normally accessible by those under 18:

1. an effective control mechanism at the point of registration or access by the end-user which verifies that the user is aged 18 or over at the point of registration or access
2. use of age-verification data that cannot be reasonably known by another person, without theft of data or identification documents or readily predicted by another person
3. a requirement that either a user age-verify each visit or access is restricted by controls, manual or electronic, such as, but not limited to, password or personal identification numbers
4. the inclusion of measures that are effective at preventing use by non-human operators including algorithms

The following are features which the BBFC do not consider, in isolation, comply with the section 14(1) requirement:

1. relying solely on the user to confirm their age with no cross-checking of information, for example by using a 'tick box' system or requiring the user to only input their date of birth
2. using a general disclaimer such as 'anyone using this website will be deemed to be over 18'
3. accepting age-verification through the use of online payment methods which may not require a user to be over 18. (For example, the BBFC will not regard confirmation of ownership of a Debit, Solo or Electron card or any other card where the card holder is not required to be 18 or over to be verification that a user of a service is aged 18 or over.)
4. checking against publicly available or otherwise easily known information such as name, address and date of birth

Although not a requirement under section 14(1) the BBFC recommends that age-verification providers adopt good practice in the design and implementation of their solutions. These include solutions that: 

• collect the minimum data required to establish that the user is aged 18 or above
• include measures to reduce the potential for improper use, in particular by children, of a verified account
• provide ease of use for end-users
• include clear information for end-users on data protection

The BBFC will issue preliminary notifications to a non-compliant pornographic service before taking any enforcement action against them. The BBFC has a number of enforcement powers including:

• Notifying Ancillary Service Providers (eg. social media, search engines) and Payment-Service Providers of non-compliant services and requesting that they withdraw their services.
• Instructing Internet Service Providers to block non-compliant sites.

The BBFC will decide the most effective course of enforcement action on a case-by-case basis.

We will consider and publish responses before submitting final versions of the Guidance to the Secretary of State for approval.

Any comments regarding Chapter 4 of the Guidance on Age-verification Arrangements will be referred to the Information Commissioner's Office for further consideration.