Skip to main content

Spain advances privacy-preserving solution for age verification

The Spanish Ministry of Digital Transformation on 1 July launched “technical specifications for age verification”, with an app allowing users to obtain tokens proving they are over 18 that can be used to access pornography sites.

A young girl with black hair pleated in braids and wearing a teal long-sleeve shirt is showing something on her phone to her friend, a boy seemingly younger than her wearing a striped long-sleeve shirt. The boy is standing while she is sitting down.

“We welcome the commitment of the Spanish regulator to address this issue which is a critical component to ensure age-appropriate experiences for children online,” said 5Rights Executive Director Leanda Barrington-Leach. “It is positive that more stakeholders are working on practical solutions that are effective and rights-respecting. We hope this will contribute to the development of a robust regulatory framework for age assurance systems based on best practice as set out in the industry standard IEEE 2089-1.”

When age-assurance systems are in place, they should meet the following minimum standards:

  1. Adhere to data minimisation in order to be privacy-preserving, only collecting data that is necessary to identify the age, and age only, of a user
  2. Protect the privacy of users in line with GDPR and other data protection rules and obligations
  3. Be proportionate to the risk of harm arising from the service, or a feature of the service, and the purpose of the age assurance solution used
  4. Be easy for children to understand and consider their evolving capacities
  5. Be secure and prevent unauthorised disclosure or safety breaches
  6. Provide routes to challenge and redress if the age of a user is wrongly identified
  7. Be accessible and inclusive to all users, particularly those with protected characteristics
  8. Do not restrict children from services or information that they have a right to access
  9. Provide sufficient and meaningful information for a user to understand how the age assurance system works, in a format and language they can easily understand – including children
  10. Be effective in assuring the actual age, or age range, of a user
  11. Anticipate that users may not tell the truth, and do not rely solely on this information.

Effective age verification is a necessity for access to products and services that are legally restricted by age, such as pornography or gambling. Age assurance more broadly, including age estimation techniques, is an important starting point to provide age-appropriate experiences; it should not be used to shut children out, or instead of age-appropriate design of service. In many cases, making services safe for the youngest users is a preferable option that precludes the need for knowing age.

European Commission President recommits to putting children’s online safety above profits

European Commission President recommits to putting children’s online safety above profits

Von der Leyen’s State of the Union delivers what 5Rights and partners demanded for children’s rights online in yesterday’s coalition letter

Classroom AI apps expose children to porn site trackers and give UK students wrong US helplines, new report reveals

Classroom AI apps expose children to porn site trackers and give UK students wrong US helplines, new report reveals

Children using well-known AI-powered apps in classrooms, such as Grammarly, Character.AI and others, are being tracked by adult website advertisers, given dangerous misinformation about self-harm and taught false facts, according to new research carried out by LSE and 5Rights Foundation’s Digital Futures for Children centre.

UK’s Age Appropriate Design Code: four years of global impact before key review

UK’s Age Appropriate Design Code: four years of global impact before key review

As the UK’s pioneering children’s data protection code inspires global change, the upcoming review of the Code presents an opportunity to build on this success and tackle the risks children face and want to be addressed.

Group of young people using and looking at mobile phone while sitting together

Final DSA guidelines deliver historic win for children’s rights online after years of 5Rights advocacy

The European Commission’s final guidelines on Article 28.1 of the Digital Services Act incorporate key recommendations from 5Rights’ baseline and coalition advocacy that shaped the framework from inception to adoption.