ISO 27566-3 Revision Checker
ISO/IEC DIS 27566-3stage 40.20ballot closes 4 December 2026planning date 14 September 2027

Home · Rules by market

What else applies, in four markets

The draft is not law anywhere. The frameworks below are the held rules a buyer in each market actually answers to when age assurance is in play. They are chosen by scanning the held record for the buyer's activity and data, in market order: United States, European Union, United Kingdom, Australia.

Naming a framework is not a claim that it applies to you. Applicability depends on your service, your users and your regulator. The free check does not decide it either; it places your task and names the evidence.

United States

The US sources below are the ones a platform, retailer or biometric vendor most often has to answer to when it checks age. None of them adopts the draft, and the draft creates no US obligation. They matter because they set the purpose, the data rules and the safe harbour that a comparison result may feed.

COPPA

The federal children's privacy rule. It makes verifiable parental consent the question for services directed at children, and the assurance method has to fit the consent route. A comparison that ignores the consent model tests the wrong decision.

Illinois Biometric Information Privacy Act

The state biometric law. Where age estimation uses a face or voice sample, the notice, consent and retention rules apply to the capture, and a comparison has to test them beside the accuracy.

ESRB Privacy Certified

A COPPA safe harbour programme used by games and child-directed services. Its assessment asks for the data flow and the vendor oversight that a comparison can reuse as evidence.

European Union

The EU instruments below are the ones a platform or an age assurance provider works with. The draft is not part of EU law. The Digital Services Act sets the minors' protection duty, the AI Act touches biometric systems, and the Better Internet for Kids strategy frames the policy expectation.

Digital Services Act

The platform regulation. Its minors' protection provisions make age assurance a design question for very large platforms, and the risk assessment is the place where a comparison result can be used.

EU AI Act

The artificial intelligence regulation. Where a biometric age estimation system falls inside its scope, the risk management, data governance and human oversight duties shape the evidence a comparison should collect.

EU Better Internet for Kids strategy

The policy frame for children's online protection. It explains why age assurance appears in platform design, and it is the context a regulator or a board paper will use.

United Kingdom

The UK sources below are the ones an online service or an age assurance provider answers to. The draft is not part of UK law, and no UK regulator has adopted it. The Acts and the code set the duties that a comparison result may support.

Online Safety Act 2023

The online safety regime. Its duties on services likely to be accessed by children make age assurance a compliance question, and the regulator's codes set the expectations a comparison can be tested against.

Age Appropriate Design Code

The children's code. Its data protection by design and age-appropriate application provisions decide how an age check may collect and retain data, which is part of the comparison.

UK GDPR

The data protection regime. It supplies the lawfulness, minimisation and automated decision rules that a comparison of an age estimation system has to respect.

Australia

The Australian sources below are the ones a platform, a retailer or an age assurance provider works with. The draft is not part of Australian law. The Online Safety Act and the eSafety expectations set the duty, and the Privacy Act sets the data rules.

Online Safety Act 2021

The Commonwealth online safety regime, administered by the eSafety Commissioner. Its age assurance expectations are the clearest Australian statement that a service must take reasonable steps, which is the decision a comparison supports.

Privacy Act 1988

The Commonwealth privacy regime and the Australian Privacy Principles. They govern the collection, use and disclosure of the personal information an age check touches.

Where a market's regime is not held

This site names only the frameworks it can read in the held record. Where a market has a rule that is not held, the page does not state it. The four sections above are the chosen held set for this build, not a complete list of every age assurance obligation in those markets.