England’s upcoming ban on selling high‑caffeine energy drinks to under‑16s is about to reshape everyday retail operations. With legislation being revived to prohibit sales of drinks containing more than 150mg of caffeine per litre, retailers will soon need to treat energy drinks the same way they treat alcohol and other age‑restricted products.

For many stores, this means new training, new signage, and critically, a reliable way to verify age at checkout.

This is where digital proof‑of‑age becomes a game‑changer.

Digital age assurance allows customers to prove they’re over 16 using secure, privacy‑preserving digital credentials. No need for physical ID, no slowing down queues, and no awkward interactions for staff. Retailers get a consistent, auditable compliance pathway whether in‑store, at self‑checkout, or online.

With larger supermarkets already operating voluntary bans and mandatory rules now on the horizon, adopting digital proof‑of‑age helps retailers:

* Reduce friction at checkout

* Strengthen compliance and reduce risk

* Support staff with clear, automated age‑verification signals

* Prepare for future digital‑first regulation across other product categories

Critical detail retailers must be aware of:

To legally accept digital proof‑of‑age, retailers must have a contract with a certified Digital Verification Service Provider (DVSP). This ensures the digital credential is validated against a trusted, audited service, giving retailers confidence that the age signal they receive is compliant, reliable and defensible.

With mandatory rules on the horizon, partnering with a DVS provider not only enables retailers to meet energy‑drink age‑restriction requirements but also:

* The Generational Smoking Ban for tobacco from January 2027 (UK wide)

* Digital Proof of Age during alcohol purchases from October 2026 (England and Wales)

Want to know more?

If you’re exploring how digital proof‑of‑age and DVS integration can support your compliance strategy, Contact us and we’d be delighted to help.

Get in touch

The post Ban on Energy drinks to under 16’s in England from April 27 appeared first on Luciditi.

The rules around checking who you employ and, increasingly, who you house are about to change significantly. From 1 October 2026, a package of reforms takes effect that widens the net of who must carry out Right to Work checks, raises the stakes for getting them wrong, and tightens the standards that digital identity checks must meet for both Right to Work and Right to Rent.

If your organisation employs staff, engages contractors, runs an online platform that connects workers with customers, or lets property, October’s changes will touch you. Here’s what’s coming, and how to prepare.

Why the rules are changing

The changes flow principally from the Border Security, Asylum and Immigration Act 2025, which amends the long-standing illegal working regime established under the Immigration, Asylum and Nationality Act 2006. Alongside the legislation, the Home Office is issuing a revised Code of Practice on preventing illegal working, which sets out how checks must be performed and what evidence organisations need to retain.

At the same time, the UK’s digital identity ecosystem has been put on a statutory footing. The Office for Digital Identities and Attributes (OfDIA) now maintains a public register of Digital Verification Service (DVS) providers, and from October, digital Right to Work and Right to Rent checks must be carried out through a provider on that register. The days of informal or unaccredited “ID checking” tools being good enough are over.

The illegal working net gets much wider

Until now, the duty to carry out Right to Work checks and the civil penalty risk for failing to do so has sat squarely with direct employers of employees. From 1 October 2026, the definition of who counts as an “employer” for these purposes expands dramatically to include:

– Businesses engaging workers, not just employees on employment contracts;

– Those engaging individual sub-contractors, including in multi-tier contracting chains where one party contracts with another to deliver services onward;

– Online matching services, digital platforms that hold a pool of service providers, pair them with customers online, and earn a fee on each successful pairing.

This is aimed directly at the gig economy and at labour supply chains where, historically, no one in the chain was clearly responsible for verifying a worker’s status. That ambiguity disappears in October.

There’s also a new focus on substitution. Where a business permits an individual to send a substitute to perform work, the business itself must ensure prescribed Right to Work checks are carried out on that substitute. Responsibility cannot simply be delegated to the person doing the work.

One important carve-out: someone buying a service simply as the final consumer, with no obligation to pass that work on to anyone else, stays outside the extended regime.

Higher penalties, harder questions

Civil penalties for illegal working now run to up to £60,000 per worker. Where a contractual chain is involved, the Home Office will weigh up how the contracting arrangements were structured and what each party actually did before deciding who pays. That means every link in the chain needs to be able to show its own compliance.

In practice, the revised Code of Practice expects affected organisations to:

– Put written agreements in place requiring other parties in the chain to carry out prescribed Right to Work checks
– Restrict subcontracting without consent, and retain audit rights over compliance
– Keep records showing what was done, and be ready to hand them over if asked
– Cooperate with Home Office investigations, including disclosing the make-up of the contractual chain and the details of each employer or service provider within it.

The message is clear: it will no longer be enough to have done the check. You’ll need to be able to prove it, quickly, across your whole labour supply chain

Digital checks must come from a registered provider

Digital identity verification has been an accepted route for Right to Work and Right to Rent checks for several years, letting British and Irish citizens prove their status remotely using a valid passport rather than presenting original documents in person. What changes on 1 October 2026 is the bar the technology provider must clear: providers must be registered with OfDIA on the DVS register, having been certified against the UK Digital Identity and Attributes Trust Framework (v0.4 or v1.0).

The revised Code also sets expectations for ongoing identity assurance in remote and platform-based work, recognising methods such as biometric and facial recognition technology, workplace access credentials, and periodic identity re-verification. For platforms and labour providers, verifying someone once at onboarding may not be the end of the story; being able to re-confirm that the person doing the work today is the person you checked is becoming part of the compliance picture.

Landlords and letting agents should take note too. Right to Rent checks follow the same trajectory: digital checks must be delivered through a registered DVS provider, and with civil penalties for renting to someone without status reaching up to £20,000 per occupier for repeat breaches, informal checking processes carry real financial risk.

Part of a bigger shift to digital verification

October’s changes don’t sit in isolation. On 30 June 2026, the government’s digital identity unit announced legislation enabling digital age verification for alcohol sales in England and Wales, removing the requirement for proof of age to carry a physical security feature like a hologram, and allowing pubs, clubs, restaurants and shops to accept digital verification from registered DVS providers instead. Crucially, those checks must operate at a defined level of confidence under the trust framework and be validated through secure technological means, not just a glance at a screen.

The direction of travel is unmistakable: across employment, housing, retail and hospitality, the UK is standardising on registered, certified digital verification as the trusted way to prove who you are and what you’re entitled to do. Organisations that build their processes around a registered DVS provider now will find each successive regulatory change an update, not an upheaval.

What to do before 1 October

1. Identify your workforce. Identify every category of labour you use and establish who is responsible for checking each.
3. Check your provider. If you already use digital Right to Work or Right to Rent checks, confirm your provider is certified under the trust framework and registered with OfDIA as a RTW DVSP or RTR DVSP.
4. Address substitution. If substitutes or not, ensure that there is a process in place to check them directly.
5. Keep an audit-ready record. Every check, agreement and audit should be logged and instantly retrievable if the Home Office comes knocking.

Ministerial Statement

Read the responsible minister, Alex Norris MP’s statement here

How Luciditi helps

These changes are exactly the problem Luciditi was built to solve. Luciditi has long been certified under the UK Digital Identity and Attributes Trust Framework across multiple provider roles (identity, holder, attribute and orchestrator) including the specific “supplementary codes” for right to work and right to rent.

Luciditi provides a secure single administration portal called Luciditi Central to run and manage checks across your entire organisation. The Luciditi Trust API enables direct integration from 3rd party systems, bypassing the management portal altogether.

Luciditi adds more than a typical checking service

Most providers verify an identity at the moment of the check and stop there. Luciditi is different: as a certified holder service under the trust framework, we can (with the individual’s consent) securely hold verified identity data beyond the original check, ready to be used again.

That capability turns one of October’s hardest requirements into a solved problem. Substitution rules demand ongoing certainty that the person actually doing the work is the person you checked. Because Luciditi retains the verified identity, a quick biometric facial match against the original check confirms in seconds that the individual in front of you, on site or on screen, is not someone else standing in unchecked. No repeat document checks, no gaps in your audit trail, and no way for a substitute to slip through on someone else’s credentials.

With Luciditi you can:

– Carry out compliant digital identity checks through a certified, registered provider — satisfying the new October requirements out of the box
– Manage checks across employees, contractors and tenants from one place, however your labour or lettings operation is structured
– Solve the difficult substitution problem
– Maintain a complete, timestamped audit trail for every check — a compliance file that’s ready the moment the Home Office asks
– Configure and scale your subscription as your needs grow, adding age assurance and other verification services from the same platform.

Whether you’re an employer untangling a contracting chain, a platform facing Right to Work obligations for the first time, or a letting agent moving to digital Right to Rent checks, Luciditi turns October’s compliance burden into a straightforward, managed process.

Want to know more?

The changes land on 1 October 2026 but the preparation starts now. Get in touch to see how Luciditi can get you ready. Contact us for a chat today.

Get in touch

The post Right to Work and Right to Rent: What Changes on 1 October 2026 and How to Get Ready appeared first on Luciditi.

As the UK prepares to update its Mandatory Licensing Conditions (MLC) later this year, those in retail, hospitality, pubs and bars face a clear challenge on how to benefit from changes to in-store age checks, using digital proof for alcohol sales.

Manual ID checks are a known source of friction, frustrating customers, placing staff in difficult situations, and increasing the risk of underage sales. With the unlocking of Digital ID by the UK’s Data (use and access) Act, the necessary update to Mandatory Licensing Conditions (MLC) will – finally – recognise digital proof of age for alcohol purchases.

This shift presents alcohol selling brick-and-mortar outlets with a clear choice: navigate the transition or lead it. For some it’s a chance to enhance customer experience and position their brand at the forefront of responsible innovation.

In response to these changes, Luciditi developed the “AgeProof SDK” – a proof of age issuing ‘component’ – the first of its kind in the UK market. It enables anyone with an existing customer app to add in-person digital proof of age capability with minimal effort.

Philip Young, CTO and Co-founder of Luciditi, said:

“For those who this appeals to, there’s no need to become digital identity experts or rebuild tech to offer mobile proof of age. By adding the AgeProof SDK they can immediately enhance their apps’ utility and see the benefit at the checkout as soon as the guidance allows”.

“This first-of-its-kind solution will be categorised as a ‘Component Service’ role on the DIATF register. Luciditi acts as the ‘underpinning service’ so there’s no initial or ongoing compliance overhead – we take care of that. End-customers will benefit from an easy way to prove their age using a familiar app they already trust.”

While the legal framework hasn’t changed since 2014, the Home Office guidance update is prompting early adopters to prepare for launch in time for the most significant operational shift in alcohol licensing in over a decade.

Want to know more?

Luciditi technology can help organisations implement Digital Identity and Age Proofing Technology for online and in person use cases. If you would like to know how, Contact us for a chat today.

Get in touch

The post Built-in: Proof of Age tech for Retail and Hospitality Apps appeared first on Luciditi.

Before the Internet, access to adult content was governed by a simple physical rule: children couldn’t reach what they couldn’t see. Adult video tapes were sold inside adult-only stores that had covered windows; and magazines containing adult content weren’t banned or hidden completely but placed out of reach on the top shelf of newsagents. It was a pragmatic solution, not entirely foolproof, but widely accepted.

With the introduction of the UK Online Safety Act, and the debate surrounding age assurance, we are essentially returning to this principle, updated for the digital age. Yet critics argue that age verification technology is inherently flawed or ripe for abuse. If we step back from the binary rhetoric of privacy versus protection, it becomes clear that the proposed digital safeguards mirror measures we’ve already deemed necessary in the physical world.

A Brief History of the Top Shelf

The idea of placing adult magazines on the top shelf of shops emerged from growing public concern in the 1970s and 1980s about children’s exposure to sexually explicit content. Though there was no specific legislation mandating the practice, it was reinforced by voluntary codes of conduct and the influence of the Indecent Displays (Control) Act 1981. This Act prohibited the public display of indecent material that could be seen by children or non-consenting adults, and retailers adopted the “top shelf” as a practical compromise.

Newsagents, supermarkets, and convenience stores agreed to keep pornographic magazines above children’s eye level, often with covers partly obscured by modesty boards. This system relied not on surveillance or identity checks but on design and societal consensus. We accepted the idea that adult content was legal but should be restricted to adults. It worked – perhaps imperfectly – but well enough to be accepted in society for decades.

The Challenge of the Digital Shelf

Fast forward to 2025. Children now navigate digital environments far more freely than physical ones. The internet has no shelf height. Age gates – simple pop-ups asking users to confirm they’re over 18 – are effectively useless, as any child can click “Yes”. And unlike a newsagent, the web doesn’t come with a shopkeeper who can intervene.

The Online Safety Act 2023, overseen by Ofcom, is the UK’s legislative attempt to replicate these social norms online. At its core, the Act mandates platforms that host user-generated or pornographic content to implement Highly Effective Age Assurance technologies. According to Ofcom’s detailed guidance released in 2024 and in early 2025, this doesn’t simply mean checking a tick-box. It means deploying proven, privacy-preserving technologies that can reliably estimate or verify a user’s age.

What is ‘Highly Effective Age Assurance’?

According to Ofcom’s official guidance (Part 3 of its age assurance statement), a “highly effective” system is one that:

• Minimises the risk of children accessing harmful content.
• Is accurate and resistant to circumvention.
• Protects user privacy and data security.
• Does not unduly restrict adult users from accessing legal content.

These systems can range from age estimation using facial analysis (without retaining biometric data), to checks against government-issued ID or Open Banking and the use of one-tap digital identity solutions such as provided by the Luciditi App. Presented to relying parties and end users as GDPR-compliant privacy-preserving multi-option solutions, leveraging zero-knowledge proofs or equivalent methods to confirm age without disclosing personal identity or traceable information.

Furthermore, “orchestration service providers” like Luciditi can provide solutions that provide end-users with multiple ways to prove their age – all of which

This is not surveillance – it’s selective access control and disclosure. Just as we did not demand names or addresses at the newsagent’s counter, the goal here isn’t to build dossiers on citizens, but to keep adult content where it belongs: accessible to adults, not children and ensuring that the content cannot be accidentally or inadvertently stumbled upon while casually surfing the web. In 2023, The Children’s Commissioner reported that a quarter of young people had encountered pornography by the age of just 11.

Critics and Concerns

Critics of age assurance suggest that these measures are a Trojan Horse for censorship and state control. They warn that mandatory verification could drive users to unregulated or offshore sites or expose them to data breaches.

These concerns are not entirely unfounded – early age verification systems in the UK (such as the 2019 Digital Economy Act’s attempted implementation) failed due to poor planning and data protection issues. Technology has moved on as has our understanding and implementation of solutions built upon the principle of privacy by design. We now have biometric estimation tools that don’t store images, encrypted ID checkers, and robust oversight and enforcement from Ofcom to ensure transparency.

Moreover, the comparison to censorship falls short. Censorship is about restricting content for everyone. Age assurance is about restricting content for children. The distinction is fundamental.

Conclusion: From Paper to Pixels

The principle underpinning Ofcom’s guidance on highly effective age assurance is not new – it’s simply a modern reapplication of the values that have governed adult content for decades. The physical world used shelf height and obscured covers; the digital world uses encrypted ID checks and biometric age estimation.

In both cases, society accepts that legal adult content should be restricted to adults. The Online Safety Act makes that principle enforceable online, where shelf height is no longer a barrier.

Far from being a scam or surveillance plot, age assurance done well is a necessary evolution of longstanding norms. And just as few today question the logic of putting adult magazines out of children’s reach, so too should we come to see highly effective digital age assurance as common sense in the online era.

Want to know more?

Luciditi technology can help organisations implement Digital Identity and Age Proofing Technology for online and in person use cases. If you would like to know how, Contact us for a chat today.

Get in touch

The post Top Shelf 2.0 – Keeping Adult Content Out of Children’s Reach appeared first on Luciditi.

In a legal milestone, DUA gives statutory recognition to digital identities, enabling trusted digital ID providers to transform the way that business is done in the UK. From buying alcohol or a lottery ticket in person to surfing age-restricted content, DUA will make everyday life look very different. Royal Assent which converts the bill to an Act of parliament will occur tomorrow (19th June).

Digital Wallets

Consumers can download an app from digital ID providers, like Luciditi, allowing them to store their personal identity data in a digital wallet. Protected by bank-grade security, each Luciditi wallet is unique to the consumer.

When someone buys something online or signs up to age-restricted services, their digital wallet doesn’t release any personal data. It simply assures the business that the consumer’s identity and/or age have been verified.

By trusting a third-party government-certified service like Luciditi, consumers know their data remains private. Meanwhile, online businesses know that required identity/age checks have been sufficiently carried out without the need to manage or store people’s private details.

Privacy Technology

Under DUA, registered digital ID providers must operate to a minimum standard. But only a few will offer maximum protection.

While cheaper options are potentially open to misuse by advertisers, governments, or hackers, built-in privacy technology such as Luciditi’s is impossible in practice to exploit. Only this level of privacy gives consumers all-round peace of mind, through features such as:

• Ensuring data can never be sold – not even Luciditi can see the personal data in a digital wallet, and since the data can’t be accessed it therefore can’t be sold.

• Private shopping that can’t be tracked – use of the Luciditi wallet can’t be tracked by anyone. This means that your weekly bottles of wine from the supermarket can’t be noted by anyone trying to profile you, for example regarding health insurance.

• Consensual transactions – your digital wallet only communicates with an online business with your permission. Luciditi requires users to specifically consent to the sharing of anything, irrespective of the type of identity request or the data being shared.

• Selective disclosure – if an online business needs you to prove your age, you don’t need to consent to releasing anything else such as your photo, name, or address.

• Time limited – whenever you share data within the Luciditi eco-system, you can choose to limit the time it’s available to whoever’s asking for it. You can ensure your data is available for a day, a week, a month or a year – or even revoke it immediately. It’s your data and you can rely on the fact that it will disappear when you want it to. Whoever needs the data can always ask for it again if they need to. They can make the checks they need without holding a copy of the data forever, which stops your data proliferating externally.

• Age proofing is entirely anonymous – online age checks can usually be completed through Luciditi’s AI estimation. Anyone aged 25 or under will be able to rely on their digital wallet to verify that they are over 18. No personal data is released, the requesting website is simply assured that the consumer is aged 18 or over.

Increased use of digital identities will be overseen by the Office for Digital Identities and Attributes (OfDIA), part of the Department for Science, Innovation and Technology. OfDIA will operate under the authority of the department’s Secretary of State who will maintain a national register of ID providers, removing those who fail to maintain minimum standards of privacy.

Managing ‘Smart Data’

Since 2021, digital ID providers have been verified only on a voluntary basis. Some, like Luciditi, chose to sign up to the UK’s digital identity trust framework, a set of rules defining a good digital ID service.

By giving the framework statutory recognition, DUA regulates data use and access, giving new reassurance to sectors and businesses that are perhaps trying out third-party ID providers for the first time.

After last minute copyright amendments to the bill were finally ironed out, DUA completed its long and winding road through parliament in June 2025. The new law will introduce four key elements:

1. UK digital identity and attributes trust framework
The trust framework will be expanded and rebranded as the Digital Verification Service.

2. Register of digital identity services
A publicly available register of digital ID providers will list organisations that have been independently assessed and certified against the trust framework.

3. Trust mark
Registered providers will be able to display a designated ‘trust mark’, demonstrating credibility.

4. Information sharing
A new information gateway will allow public authority data to be shared with registered services, enabling speedier identity and eligibility checks.

At the heart of DUA, is the concept of ‘smart data’, where standard identity data is managed in a smart way, allowing faster links and closer ties between consumers, businesses, and public authorities. The government has said it wants to “harness the power of data for economic growth, to support a modern digital government, and to improve people’s lives.”

Hundreds of thousands of people are already using digital identity products for things like opening bank accounts, securing jobs or renting a flat. But the four steps outlined above will encourage the wider use of data, allowing public services to support faster identity checks and develop closer ties with business.

GOV.UK Wallet

The government has announced plans to introduce its own digital wallet – the GOV.UK Wallet. The Wallet will hold the Armed Forces Veteran Card from summer 2025, followed by the full driving licence later in 2025.

While only government issued-documents can be saved in the GOV.UK Wallet, the government has published new guidance explaining that registered organisations will be able to access and use the information. This extends the ways that a service like Luciditi will be able to help consumers securely confirm their identity.

Registered ID providers will be able to use GOV.UK Wallet in two ways:

• they will be able to use the information in GOV.UK Wallet to offer a range of identity and attribute services, for example helping someone prove something about themselves digitally. If they are also certified as a holder service, they will be able to use information from GOV.UK Wallet to create a new reusable digital identity document (a ‘derived credential’).

• businesses like Luciditi that are certified as ‘orchestration service providers’ will be able to provide information from GOV.UK Wallet to other businesses who need to prove information about an individual (for example, they could connect GOV.UK Wallet with an online shop so it can share a user’s age).

Identity fraud costs the UK an estimated £1.8 billion every year. By introducing measures that protect both businesses and consumers, DUA injects much needed reassurance into the rapidly expanding digital economy. With UK GDPR and the Data Protection Act 2018 due to remain in place, DUA adds to the legislative framework, allowing businesses to stay compliant and enabling consumers to retain control of their essential though vulnerable data.

Want to know more?

Luciditi technology can help organisations implement Digital Identity and Age Proofing Technology for online and in person use cases. If you would like to know how, Contact us for a chat today.

Get in touch

The post Long awaited approval for essential digital ID regulation appeared first on Luciditi.

Luciditi is excited to announce a significant update to its state-of-the-art Luciditi Smart Wallet app, making digital identities more accessible for consumers both online and in person.

Having pioneered the role of the first Digital Proof of Age (PASS) issuer in 2023 with support for the PASS 5.0 standard, Luciditi now integrates PASS 5.1—the groundbreaking ‘universal access standard’.

This development enables seamless in-person digital verification of age-related digital PASS credentials across diverse scenarios, including supermarkets, convenience stores, pubs, and clubs. From streamlining self-checkout experiences to simplifying age verification at venues, digital PASS offers faster, more convenient solutions for users of all ages.

PASS’s technical provider developed the necessary ‘acceptor verification’ software to provide EPOS systems throughout the UK with digital proof of age compatibility. Additionally, a standalone verifier app will be available for establishments where till integration isn’t feasible, catering to the nightlife sector, event spaces, and smaller retail outlets. The final solution is on target for early summer testing and certification.

These transformative advancements are being driven by legislative changes, including the Data (Use and Access) Bill and updates to secondary legislation in the Mandatory Licensing Conditions for the sale of alcohol. Both are expected to become law this year, making the widespread use of digital IDs to purchase alcohol in the UK—aptly termed “Pint-mas 2025” by Tech Secretary Peter Kyle MP—a reality for consumers.

Luciditi co-founder and CTO Philip Young commented, “With this latest update, Luciditi cements its position as a trailblazer in interoperable digital identity solutions, driving innovation and simplifying life for consumers worldwide.”

Beyond in-person age verification

Further afield, Luciditi is playing its part in the groundbreaking Australian Age Assurance Trial, the first initiative of its kind globally. Using a mock social media app, trial participants will experience the immediacy of verifying their age with a single tap in the Luciditi app as an alternative to facial age estimation or document verification.

Next week, Luciditi is sponsoring the Global Age Assurance Standards Summit, taking place in Amsterdam (April 8th-10th) and will demonstrate its cutting-edge age assurance technology designed to help stakeholders comply with global regulations such as the UK’s Online Safety Act.

Want to know more?

Luciditi technology can help organisations implement In-person Digital Proof of Age. If you would like to know how, Contact us for a chat today.

Get in touch

The post Luciditi smart wallet app update integrates latest proof of age standard appeared first on Luciditi.

Online platforms that show adult content to UK users must introduce age checks by July 2025, under tough new guidelines from Ofcom. The measures explain in practice how websites and apps will have to comply with the Online Safety Act (2023) to stop children finding online pornography.

Children are exposed to adult content from an early age. Research suggests that, among those who have seen it, the average age they first encounter it is 13 – although more than a quarter have seen it by age 11 (27%), and one in 10 as young as nine (10%).

Creating a safer online environment

According to Ofcom, the vast majority of adults (80%) are broadly supportive of age assurance measures to stop children seeing pornography. Age checks will be enforced under the Online Safety Act (OSA), which aims to make the internet a safer environment for UK users, particularly children.

Providers of adult content who publish or produce pornography are covered under Part 5 of the OSA. Under Ofcom’s new guidelines, they need to be implementing highly effective age assurance and restricting access to their site as soon as possible and by July at the latest.

Services covered by the Part 5 guidelines will principally include platforms that publish pornographic content under their own control, such as studios and pay sites, (as opposed to user-generated content). Part 3 of the OSA, covering social media platforms, user-to-user sites and search engines, must comply with a separate set of guidelines from Ofcom, as explained here.

Identifying relevant providers

The guidelines for Part 5 services apply to providers who meet three conditions:

1. pornographic content is published or displayed on their service.
2. the service is not exempt from the OSA.
3. the service has links to the UK.

Condition 1: Under the OSA, a provider of adult content means the entity or individual who controls what is seen on an internet service. Content is pornographic if it is “reasonable to assume that it was produced solely or principally for the purpose of sexual arousal.” This can include still and moving images, audio and audio-visual content, and artificial images whether animated or created by AI.

Condition 2: Pornographic content is not covered by Part 5 if it:

• is user-generated, (in which case it is subject to Part 3).
• consists only of text, or text accompanied by a GIF or emoji (which are not pornographic).
• is an on-demand programme service, for example a pornographic subscription channel.
• is an internal business service (ie intranet services) that meets specific requirements.

Condition 3: Part 5 only applies if a provider “has links with the United Kingdom.” A link with the UK exists if either:

• the service has a significant number of UK users.
or
• UK users form one of the target markets for the service, or the only target market.

The Act does not define what is meant by a “significant number” of UK users. But Ofcom is likely to reject exemption claims made on the basis that a provider only has a relatively small user base. Under the guidelines, Ofcom suggests providers should “err on the side of caution” when assessing whether they have a significant number of UK users.

While “target market” is not defined by the Act, the guidelines confirm that a service would be seen to be targeting the UK if any of the following apply:

• it is marketed toward UK users.
• generates revenue from UK users.
• includes content that is tailored for UK users.
• has a UK domain or provides a UK contact address and/or phone contact number.

An online service may include adult material that falls under Part 3 (eg user-generated content) along with other material (perhaps shot in a studio) that is covered by Part 5. The separate guidelines covering Part 3 services require platforms to carry out a children’s access assessment by 16 April 2025 to establish whether their service is likely to be accessed by children.

Ofcom has confirmed that “services such as tube, cam and fan sites will be covered by both Part 3 and Part 5 guidance. These services must carry out children’s access assessments by 16 April.” Providers unsure whether Part 5 of the OSA applies to them can use Ofcom’s online tool.

Enforcement programme

Part 5 providers must use age assurance (verification, estimation, or both) to ensure that children are not able to see pornographic content. Age assurance tech must be “highly effective” at determining whether a user is a child, and it must ensure that children are prevented from seeing adult content.

All Part 5 services must have highly effective age assurance processes in place by July 2025. The same deadline also applies to Part 3 providers that allow user-generated adult content.

For Part 5 services, specifically, the requirement to adopt age assurance came into effect on 17 January 2025. Ofcom immediately opened an “enforcement programme”, examining progress towards age assurance across the adult content sector. It is also writing to all Part 5 providers, asking for an update on the age assurance measures they’re considering.

Ofcom said, “We will contact a wide range of adult services – large and small – to advise them of their new obligations and monitor their compliance. We will not hesitate to launch investigations and take enforcement action against services that do not comply.”

Determining highly effective age assurance

Providers can either develop their own in-house age assurance or they can buy third party tech. Partnering with an age assurance specialist, such as Luciditi, would allow them to easily embed AI-powered age assurance into their website. Providers must ensure that no pornographic content can be seen before users verify their age.

An age assurance method is highly effective only if it meets each of four criteria:

• It is technically accurate – evaluated against appropriate metrics.
• It is robust – can correctly determine the age of a user in a range of real-world settings.
• It is reliable – is shown to be consistent, particularly when involving AI or machine learning.
• It is fair – minimises bias and discriminatory outcomes.

Providers will need to adopt an age assurance method that Ofcom considers to be reliable, such as:

• Open banking
• Photo-identification matching
• Facial age estimation
• Mobile-network operator age checks
• Credit card checks
• Email-based age estimation
• Digital identity services

These options are explained in more detail in our accompanying article on the Part 3 guidelines, along with methods that Ofcom regards as unreliable. Whichever method is adopted, Ofcom says it should be easy to use without unduly preventing adult users from accessing legal content.

Keeping accurate records

Any reliable age assurance process will likely include both estimation and verification, and as such will be subject to the UK’s data protection laws. For this reason, Part 5 providers must keep accurate records, detailing:

• the kinds of age verification or estimation used, and how they are used.
• how UK users will be protected from a breach of privacy (for example relating to personal data).

Providers must summarise their records in a publicly available statement, which must explain their chosen method of age assurance. Ofcom’s guidelines on privacy are further explained in our article on Part 3 providers.

Ofcom aims to ensure that the internet in the UK will soon be safer for children. This means that providers need to be thinking about the changes that are required by law. The new guidelines can be seen as fleshing out the OSA under which Ofcom has the power to fine repeat offenders up to £18 million, or 10% of qualifying worldwide revenues (whichever is greater).

Melanie Dawes, Ofcom’s Chief Executive, said: “For too long, many online services which allow porn and other harmful material have ignored the fact that children are accessing their services. Either they don’t ask or, when they do, the checks are minimal and easy to avoid. That means companies have effectively been treating all users as if they’re adults, leaving children potentially exposed to porn and other types of harmful content. Today, this starts to change.”

Want to know more?

Luciditi technology can help meet some of the challenges presented by the OSA. If you would like to know more, Contact us for a chat today.

Get in touch

The post Adult content sites given summer deadline on age checks appeared first on Luciditi.

Digital ID to be accepted as proof of age in alcohol sales. Apps like Luciditi offer safer alternative to physical ID documents.

It will soon be possible to buy alcohol using a digital identity to confirm your age, the government has announced. The decision means that consumers will be able to use trusted ID apps like Luciditi rather than take their passport or driving licence to pubs, clubs, and supermarkets.

The move comes in response to a consultation that ran from January to March, 2024. This asked stakeholders whether young people should be allowed to use a digital identity service to prove they’re old enough to buy alcohol.

A clear majority of respondents (72%) said that existing legislation should be updated to allow consumers to use digital ID in retail settings such as supermarkets, off-licences, restaurants, pubs, and clubs. Digital identity apps like Luciditi can facilitate a quick and easy process at the point of sale, similar to contactless payments or scanning a QR code.

Luciditi relies on evidence scanned from personal identity documents uploaded by the user. These are stored in a digital wallet and are securely protected by high-grade security. Typically they’re not shown to a third party, the app simply assures a retailer that the user has been verified as 18 or over.

Digital identity trust framework

Age assurance depends on trust. A digital identity service will only be accepted in the sale of alcohol if it has been certified against government standards.

At the moment, trusted digital ID providers, including Luciditi, are voluntarily certified against the UK’s digital identity trust framework, a set of rules defining a good digital ID service.

The framework will soon be put on a statutory footing by the Data (Use and Access) Bill, (DUA), currently passing through Parliament. After the DUA Bill receives royal assent, expected sometime later this year, the framework will underpin a new Digital Verification Service. This will oversee a public register of certified digital ID providers.

The government has also said that DUA will be amended once it comes into law, expanding the scope of digital identities so they can be used as proof of age in alcohol sales.

Verification, rather than estimation

The consultation process, initiated by the previous government, focused on whether the Licensing Act 2003 should be updated to allow the use of digital ID. A total of 251 complete responses were received from licensing authorities, the alcohol and hospitality industries, policing, trading standards, technology companies, delivery partners, civil society organisations, and members of the public.

Most respondents thought the proposed changes would have a positive impact, though some raised concerns about data protection and the potential for digital identities to be hacked or faked.

Similar concerns raised in the past prompted the decision to create the Digital Verification Service, putting the trust framework on a more formal footing. Only verification will be acceptable in the sale of alcohol. Other technologies, such as age estimation, currently fall outside the framework and won’t be accepted.

Next steps

The government is currently looking at the minimum level of service required from a digital ID provider. At the moment, anyone checking an ID document when selling alcohol needs to confirm three things:

1. Does it show that the person is over 18?
2. Does it belong to the person presenting it?
3. Is it a genuine document?

In practice, this means that a retailer must look at the date of birth to work out the person’s age, compare a photo to the person standing in front of them, and look for security features like holograms or ultraviolet marks to make sure the documents are real.

Digital identity tech needs to do the same, quickly, reliably, and securely. The Department for Science, Innovation and Technology (DSIT) is working with the Home Office on three main requirements.

Firstly, to be certified and included on the new register, a provider must be able to securely use ID data to verify that someone is 18 or over. Secondly, the tech must confirm that the digital identity belongs to the person presenting it. On this, the Office for Digital Identities and Attributes (part of DSIT) said that:

“Digitally, this can be done using biometric authentication. For example, a user can scan their face with their smartphone to access their digital identity. The scan of their face is bound to the photo on the original document. This allows them to securely prove that the identity belongs to them. By logging into the app in this way, the person can prove that the identity belongs to them.”

Thirdly, the identity must be verified as genuine. This means that a digital ID has to be scanned by a device rather than simply assessed by a person, similar to an e-ticket being scanned at a venue. Age assurance may involve scanning a QR code or using NFC technology similar to contactless payments.

Remote sales of alcohol

The Licensing Act was passed in 2003, since then however the way that people buy alcohol has changed. The consultation also looked at using digital IDs in remote sales, when alcohol is bought in a setting that’s not face-to-face.

Drink can be bought online, or in other ways that don’t involve face-to-face contact, for example at supermarket self-checkout tills or in a restaurant that accepts orders via an app. Age checks are currently required at the point of sale, but not at the point of delivery.

The consultation asked whether age checks at the point of delivery should be introduced. This is complicated by the fact that it’s an offence to sell alcohol to a person who’s drunk, and so the consultation also asked whether there should be mandatory checks at the point of delivery to determine whether someone is already intoxicated.

These questions raise practical difficulties, for example in the ability to leave goods in a safe place for the customer to collect. While a majority of respondents (58%) agreed that the Licensing Act should be updated to make it an offence to deliver to someone who’s drunk, there were concerns about how this would work in practice.

On these complicated issues, the government said “this is an area that requires further consideration. We will undertake further work in this area in due course.”

Safer checks for young people

A key priority is to safeguard the aims of the Licensing Act 2003 including the need to protect children from harm. This led to a requirement for age checks, which in practice means that young people have to carry valuable personal documents into pubs, clubs, and restaurants.

When they hand over their document to be checked by whoever’s at the door, people are potentially exposing their name, sex, current address and date of birth. Digital ID promises to maintain the integrity of the Licensing Act while allowing faster, safer and more secure verification.

James Hawkins, from the British Beer and Pub Association, said “this welcome change brings the Licensing Act in line with current technology and will make a visit to the pub easier for both customers and staff.”

Digital ID services generated £2.05 billion in 2023/2024, and employed over 10,000 people – half of them outside London. ID tech, from trusted providers, helps to boost the economy, protect young people, and perhaps even cut queues at the bar.

The post Digital ID to be accepted as proof of age for alcohol sales in the UK appeared first on Luciditi.

Potential boost to UK economy by £10 billion over 10 years

Digital identity providers are to be regulated in a sweeping overhaul of the law. The Data (Use and Access) Bill will introduce oversight of digital ID, replacing the current voluntary system with a government register that could bring a £10 billion boost to the economy over 10 years.

Digital identities are an increasingly common way of accessing age-restricted online services or products. Providers like Luciditi offer security at the level demanded by banks, allowing individuals to securely verify their identity and/or age and helping to minimise the risk of identity fraud.

Trust is a key feature of an industry that serves as a ‘middle man’ between online consumers and suppliers. At the moment, digital ID providers – including Luciditi – may be voluntarily certified against the UK’s digital identity trust framework, a set of rules defining a good digital ID service.

However, in some cases where identity needs to be verified, for example employers looking to check someone’s criminal record or right to work, trust is needed at a deeper level. Similarly public agencies would be able to operate far more efficiently if identity verification were better regulated.

Setting standards, regulating providers

The Data (Use and Access) Bill – abbreviated to DUA – will transform certification, putting it on a more formal footing. DUA proposes wide-ranging reforms that will expand trust in four main areas:

1. UK digital identity and attributes trust framework
DUA will bring legal standing to the trust framework, expanding it and transforming it into the Digital Verification Service, giving it a broader and more structured regulatory foundation.

2. Register of digital identity services
DUA will establish a publicly available register of digital ID providers, listing organisations that have been independently assessed and certified against the trust framework. Under DUA, ministers will assess applications to join the register and potentially refuse applications or de-list providers.

3. Trust mark
Under DUA, registered providers will be able to display a designated ‘trust mark’ to distinguish their services in the market.

4. Information sharing
DUA will lay the foundations of a new information gateway, which in time will allow public authority data to be shared with registered services to enable identity and eligibility to be checked.  

Reusable ‘smart data’

Key parts of DUA are inherited from a Bill that began life under the previous government but failed to get through parliament before the general election. In the King’s Speech in July, the new Labour government introduced the Digital Information and Smart Data Bill, (DISD).

DISD was updated over the summer, and the Bill was renamed as DUA to reflect its broader scope. Nevertheless, ‘smart data’ remains at its heart – a reference to standard identity data managed in a smart way.

For example, Luciditi’s app allows individuals to upload their personal data to a digital identity wallet. After they’ve done this once, they can then reuse the data as many times as they want whenever they sign up for online services or products that require identity or age checks.

While online suppliers may ask for identity verification or proof of age, Luciditi’s app typically does not release personal data to a third party. It simply gives them basic assurance that the individual is who they say they are and the age they claim to be. The app gives users a choice. If they choose to, they can release the data to a third party that needs to see it, for example when opening a bank account. The key point here is that Luciditi allows users to choose whether to share information, every time.

Standardised reliance on digital identity throughout a particular industry is known as a smart data scheme, though at the moment only online banking comes close to this.

Outside banking, suppliers need to believe that assurance is reliable. For them, digital identity providers who are voluntarily certified against the trust framework can be expected to securely support online access to restricted services and products. Regulation of this system into broader areas of the economy will speed up processes such as renting a home or starting a new job.

Embedding ID tech into public agencies

Under DUA, identity assurance will only be available to an authorised third-party supplier upon an individual’s request. But it paves the way for something more.

The government has said it wants to “harness the power of data for economic growth, to support a modern digital government, and to improve people’s lives.”

Government agencies, managing the data of millions of individuals, are currently bogged down in paperwork. By embedding smart data and identity assurance in public services, DUA will make it easier and quicker to manage people’s personal data, cutting down on laborious bureaucratic procedures.

The government believes that DUA “will free up 1.5 million hours of police time and 140,000 NHS staff hours every year speeding up care and improving patients’ health outcomes.” The Bill would allow for healthcare information – like a patient’s pre-existing conditions, appointments and tests – to be easily accessed in real time across all NHS trusts, GP surgeries and ambulance services, no matter which IT system they were using.

The new Bill will also allow births and deaths to be recorded online instead of via the current paper-based system. Registrations could also be carried out over the phone, not just in person.

For some people, making it easier to release their personal health data will be a cause for concern. In Luciditi’s case, the developers’ previous product already safeguards health data for millions of people across the UK. The Luciditi app benefits from this same level of trusted security.

The government has confirmed that the Bill does not include a mandatory national digital ID card, or any requirement to possess a digital identity. By simply creating a legislative structure of standards, governance and oversight for providers, DUA will demand that all registered digital ID providers meet a similar standard.

Managing oversight of DUA

OfDIA staff created the trust framework, in collaboration with industry, academia, and civil society groups, and intend to review and refresh it every year. OfDIA believe that, under the framework, hundreds of thousands of digital identity checks are already taking place each month.

Beyond digital ID, the new Bill also supports a national chart of the UK’s underground infrastructure. The National Underground Asset Register is a new digital map that will shape the way pipes and cables are installed, operated and repaired. It will give planners and excavators standardised, secure, instant access to the information they need, reducing excavation accidents that can quickly disrupt business.

Next steps

The new legislation won’t force anyone to use a digital identity. But a legally-protected structure of standards will give consumers and online suppliers new confidence in the broader use of smart data schemes.

Data is critical for UK business: 77% of UK companies handle some form of digital data, increasing to 99% for businesses employing more than 10 people. DUA has the potential to unlock much needed national growth and ensure that, in the push towards digitally-based business, Britain isn’t left behind.

The post New Data Bill set to radically expand use of digital ID in the UK appeared first on Luciditi.