Untraceability

What the clause says

The system should not let an observer trace a person's movements or activity through the age assurance service beyond what the service needs.

What it supplies to a comparison

Traceability shows up in logs, tokens and network metadata. The comparison should ask what is retained and for how long.

Evidence to keep

• The retention schedule for logs and tokens.
• The trace test across two services or two sessions.

What the evidence looks like

For 7.1.4, the first artefact is The retention schedule for logs and tokens.. The second is The trace test across two services or two sessions.. If 7.1.4 has no first artefact, the practice is unproven at 7.1.4, and the report should record the absence rather than infer the practice from a policy.

Questions for the provider

1. What is retained that could reconstruct a person's activity?
2. Is the retention period justified by a stated need?

How it connects to the draft

Untraceability belongs to 7 privacy objectives, and it gives the analysis one fixed point: Traceability shows up in logs, tokens and network metadata. The comparison should ask what is retained and for how long. A comparison that cannot place a result against 7.1.4 is measuring something the framework has not defined, and the report should say so.

In the register, 7.1.4 is read beside the unit that tests it, and where it sets an objective rather than a number, that unit turns the objective into a question and an evidence artefact.