IMPORTANT UPDATE Age Verification from BBFC
 

BBFC Accreditation Scheme for Age Verification Providers - Important

The Application Period is now open.

We received the final documents and terms for the BBFC certification scheme for AV providers last Friday. This has had significant input from various Government bodies including DCMS (Dept for Culture, Media & Sport), NCC Group plc (expert security and audit firm), GCHQ (UK Intelligence & Security Agency) ICO (Information Commissioner’s Office) and of course the BBFC (the regulator).

The scheme appears to have VERY strict rules.

It is a multi- disciplined scheme which includes penetration testing, full and detailed audits, operational procedures over and above GDPR and the DPA 2018 (Data Protection Act). There are onerous reporting obligations with inspection rights attached. It is also a very costly scheme when compared to other “quality standard” schemes, again perhaps designed to deter the faint of heart, or shallow of pocket.

It seems it will be heavily promoted to consumers to provide them with comfort that any AV provider who attains accreditation has met stringent standards regarding data handling and privacy.

Consumers will likely be advised against using any systems or methods where the prominent green AV accreditation “kite mark” symbol is not displayed.

The guidance is focused on ensuring the purity of age verification and I draw to your attention to the following important clauses:

• Only the MINIMUM amount of personal data required to verify a user’s age shall be collected. A user’s IDENTITY SHALL NOT be verified as part of the process.
• Information about the requesting website that the user has visited SHALL NOT BE COLLECTED AGAINST THE USER’S ACTIVITY.
• Age-verification providers shall ONLY SHARE the result of an age-verification check (PASS OR FAIL) with the requesting website.
• Personal data relating to the PHYSICAL LOCATION OF A USER SHALL NOT BE COLLECTED as part of the age-verification process.
• Personal data used for fraud prevention and detection and to verify a user’s age for access to commercial online pornographic material SHALL NOT BE USED FOR ANY OTHER PURPOSES, SUCH AS MARKETING OR THE CREATION OF DIGITAL WALLETS. AGE-VERIFICATION PROVIDERS SHALL NOT MARKET OTHER SERVICES TO THESE USERS DURING OR AFTER THE AGE- VERIFICATION PROCESS.
• A user shall be given the OPTION TO VERIFY THEIR AGE WITHOUT BEING REQUIRED TO SET UP AN ACCOUNT with the age-verification provider.

The intent seems clear. AV providers should not aim to do anything with a user other than to age verify them. Methods or systems that attempt otherwise will likely not attain accreditation from the BBFC.
AVSecure was built from conception along these lines. We retain zero consumer data like email (which we don’t even collect) or IP address and never market to users.

Our FREE verification system can solve any issues you may have relating to being able to offer a trusted, accredited product.

The Age Verification Guidance does not preclude your business from carrying out separate and distinct data capture, or membership processes, but this should be done AFTER and SEPARATE from the age verification process itself.

Our recommendation is, and has always been that, for those merchants looking to use this opportunity to “sign-up” new members etc, the best way to do it is immediately AFTER a quick, smooth, successful, certified, simple, non-intrusive AV check has been made and do it as a separate, optional, flow on process.

Thereby, if any customer abandons the merchant sign up process no traffic is lost.
It appears that some solutions or methods may have intended to try to effectively disguise a sign-up scheme by collecting billing details proffered by the user as part of the AV method, or to force consumers into a localized platform or marketing product.

These approaches seem to have been firmly stamped out by the details of the certification rules.

If you have any questions, we are always happy to help.

Ok so how are you going to run the scheme for free now ?

Unicorn tears don’t pay the bills - and the above suggests data won’t either ?

Doesn’t change anything for us. We have always been free and our value is ultimately through the blockchain and many other industry sectors where we will charge. Adult is our well publicised land grab and we have never looked to use consumer data.

Do you put advertising if any sort on any of your verification pages?

Do the regulations prohibit you from putting advertising on any of your verification pages?

No advertising. This is directly from a clause in the scheme.
“Age-verification
providers shall not market other services to these users during or after the age-
verification process.”
It obviously doesn’t stop anyone advertising AFTER the AV has taken place and we have been advocating that all the time.

Is there a demo that site owners can install/test AVSecure yet?

We have been in test with several clients and will open up the developer section to all as soon as an entry into force date is issued. You can find out more on our website and I’m always happy to take a call.

Are you ready to implement it or is it still waiting for dates/specifics?

Good stuff :pimp . . .

WHEN WILL BE THIS MAGIC DAY??? before or after brexit?

We want to be your test partner as well

Think you need to read what you wrote.

You contradict yourself.

where have these agencies published what you say, in the last 4 weeks

DCMS (Dept for Culture, Media & Sport), NCC Group plc (expert security and audit firm), GCHQ (UK Intelligence & Security Agency) ICO (Information Commissioner’s Office) and of course the BBFC (the regulator)

this agency is fantastic GCHQ (UK Intelligence & Security Agency), they have never told of anything they do?

this one sounds great doesn't it, BBFC (the regulator)

beer bollocks football club (the regulator) on the head john

It's a bullshit scam leaching of the traffic of honest webmasters.

"bla bla bla... GDPR bla bla bla... EU bla bla bla... Blockchain bla bla bla... Free..."

Seen it all before, and it always ends up with webmasters loosing money - one way or the other.

I hadn't thought about it that way before

Blocking england and redirecting it to a proxy service will probably be the best option

I have an old AVS for sale.

Did you say penetration testing?

How it works? How we implemented your solution? is it .js on our sites?

Nobody works for free.. Or is this a goodwill? :1orglaugh

.js is an option as is worpress, php and .net. Please register on our website and we can provide you as much details as you need.

Yes, it may of sounded confusing. We do not charge the adult industry anything and make revenues elsewhere.

Is there something that can be dropped into an .htaccess file ??? We've got thousands of galleries, landing pages, iframe tools etc that affiliates link to directly. It would be a lot easier to implement via htaccess

Can the webmaster/site owner send only UK people to this solution themselves? For example, the webmaster uses JS to detect UK users and then only subjects those users to the code provided by the ID verification site?

I doubt anyone wants a third party to do the geo filtering since that could give them access to all of the site user data?