GoFuckYourself.com - Adult Webmaster Forum - View Single Post - IMPORTANT UPDATE Age Verification from BBFC

AVSecure · 04-16-2019, 07:21 AM

BBFC Accreditation Scheme for Age Verification Providers - Important

The Application Period is now open.

We received the final documents and terms for the BBFC certification scheme for AV providers last Friday. This has had significant input from various Government bodies including DCMS (Dept for Culture, Media & Sport), NCC Group plc (expert security and audit firm), GCHQ (UK Intelligence & Security Agency) ICO (Information Commissioner’s Office) and of course the BBFC (the regulator).

The scheme appears to have VERY strict rules.

It is a multi- disciplined scheme which includes penetration testing, full and detailed audits, operational procedures over and above GDPR and the DPA 2018 (Data Protection Act). There are onerous reporting obligations with inspection rights attached. It is also a very costly scheme when compared to other “quality standard” schemes, again perhaps designed to deter the faint of heart, or shallow of pocket.

It seems it will be heavily promoted to consumers to provide them with comfort that any AV provider who attains accreditation has met stringent standards regarding data handling and privacy.

Consumers will likely be advised against using any systems or methods where the prominent green AV accreditation “kite mark” symbol is not displayed.

The guidance is focused on ensuring the purity of age verification and I draw to your attention to the following important clauses:

• Only the MINIMUM amount of personal data required to verify a user’s age shall be collected. A user’s IDENTITY SHALL NOT be verified as part of the process.
• Information about the requesting website that the user has visited SHALL NOT BE COLLECTED AGAINST THE USER’S ACTIVITY.
• Age-verification providers shall ONLY SHARE the result of an age-verification check (PASS OR FAIL) with the requesting website.
• Personal data relating to the PHYSICAL LOCATION OF A USER SHALL NOT BE COLLECTED as part of the age-verification process.
• Personal data used for fraud prevention and detection and to verify a user’s age for access to commercial online pornographic material SHALL NOT BE USED FOR ANY OTHER PURPOSES, SUCH AS MARKETING OR THE CREATION OF DIGITAL WALLETS. AGE-VERIFICATION PROVIDERS SHALL NOT MARKET OTHER SERVICES TO THESE USERS DURING OR AFTER THE AGE- VERIFICATION PROCESS.
• A user shall be given the OPTION TO VERIFY THEIR AGE WITHOUT BEING REQUIRED TO SET UP AN ACCOUNT with the age-verification provider.

The intent seems clear. AV providers should not aim to do anything with a user other than to age verify them. Methods or systems that attempt otherwise will likely not attain accreditation from the BBFC.
AVSecure was built from conception along these lines. We retain zero consumer data like email (which we don’t even collect) or IP address and never market to users.

Our FREE verification system can solve any issues you may have relating to being able to offer a trusted, accredited product.

The Age Verification Guidance does not preclude your business from carrying out separate and distinct data capture, or membership processes, but this should be done AFTER and SEPARATE from the age verification process itself.

Our recommendation is, and has always been that, for those merchants looking to use this opportunity to “sign-up” new members etc, the best way to do it is immediately AFTER a quick, smooth, successful, certified, simple, non-intrusive AV check has been made and do it as a separate, optional, flow on process.

Thereby, if any customer abandons the merchant sign up process no traffic is lost.
It appears that some solutions or methods may have intended to try to effectively disguise a sign-up scheme by collecting billing details proffered by the user as part of the AV method, or to force consumers into a localized platform or marketing product.

These approaches seem to have been firmly stamped out by the details of the certification rules.

If you have any questions, we are always happy to help.

04-16-2019, 07:21 AM
AVSecure Confirmed User Join Date: Dec 2017 Posts: 130	IMPORTANT UPDATE Age Verification from BBFC BBFC Accreditation Scheme for Age Verification Providers - Important The Application Period is now open. We received the final documents and terms for the BBFC certification scheme for AV providers last Friday. This has had significant input from various Government bodies including DCMS (Dept for Culture, Media & Sport), NCC Group plc (expert security and audit firm), GCHQ (UK Intelligence & Security Agency) ICO (Information Commissioner’s Office) and of course the BBFC (the regulator). The scheme appears to have VERY strict rules. It is a multi- disciplined scheme which includes penetration testing, full and detailed audits, operational procedures over and above GDPR and the DPA 2018 (Data Protection Act). There are onerous reporting obligations with inspection rights attached. It is also a very costly scheme when compared to other “quality standard” schemes, again perhaps designed to deter the faint of heart, or shallow of pocket. It seems it will be heavily promoted to consumers to provide them with comfort that any AV provider who attains accreditation has met stringent standards regarding data handling and privacy. Consumers will likely be advised against using any systems or methods where the prominent green AV accreditation “kite mark” symbol is not displayed. The guidance is focused on ensuring the purity of age verification and I draw to your attention to the following important clauses: • Only the MINIMUM amount of personal data required to verify a user’s age shall be collected. A user’s IDENTITY SHALL NOT be verified as part of the process. • Information about the requesting website that the user has visited SHALL NOT BE COLLECTED AGAINST THE USER’S ACTIVITY. • Age-verification providers shall ONLY SHARE the result of an age-verification check (PASS OR FAIL) with the requesting website. • Personal data relating to the PHYSICAL LOCATION OF A USER SHALL NOT BE COLLECTED as part of the age-verification process. • Personal data used for fraud prevention and detection and to verify a user’s age for access to commercial online pornographic material SHALL NOT BE USED FOR ANY OTHER PURPOSES, SUCH AS MARKETING OR THE CREATION OF DIGITAL WALLETS. AGE-VERIFICATION PROVIDERS SHALL NOT MARKET OTHER SERVICES TO THESE USERS DURING OR AFTER THE AGE- VERIFICATION PROCESS. • A user shall be given the OPTION TO VERIFY THEIR AGE WITHOUT BEING REQUIRED TO SET UP AN ACCOUNT with the age-verification provider. The intent seems clear. AV providers should not aim to do anything with a user other than to age verify them. Methods or systems that attempt otherwise will likely not attain accreditation from the BBFC. AVSecure was built from conception along these lines. We retain zero consumer data like email (which we don’t even collect) or IP address and never market to users. Our FREE verification system can solve any issues you may have relating to being able to offer a trusted, accredited product. The Age Verification Guidance does not preclude your business from carrying out separate and distinct data capture, or membership processes, but this should be done AFTER and SEPARATE from the age verification process itself. Our recommendation is, and has always been that, for those merchants looking to use this opportunity to “sign-up” new members etc, the best way to do it is immediately AFTER a quick, smooth, successful, certified, simple, non-intrusive AV check has been made and do it as a separate, optional, flow on process. Thereby, if any customer abandons the merchant sign up process no traffic is lost. It appears that some solutions or methods may have intended to try to effectively disguise a sign-up scheme by collecting billing details proffered by the user as part of the AV method, or to force consumers into a localized platform or marketing product. These approaches seem to have been firmly stamped out by the details of the certification rules. If you have any questions, we are always happy to help.