What Counts as 'Highly Effective' Age Checking Under the OSA
The "I confirm I am over 18" checkbox is dead in UK law, at least for any service that has actually read section 81 of the Online Safety Act 2023.
The statutory text is short and, for once, refreshingly specific. A provider of regulated pornographic content must use age verification or age estimation "of such a kind, and used in such a way, that it is highly effective at correctly determining whether or not a particular user is a child."
No definition of "highly effective" follows in the Act itself. That was left to Ofcom, and the guidance it produced is more interesting than the average regulatory document. It has now been tested against real services, real fines, and a report full of numbers that undercut some of the industry's own marketing.
Four criteria, not a list of approved tools
Ofcom deliberately avoided writing a list of acceptable technologies into the guidance. Instead it set out four properties that any method, whatever it is, has to demonstrate:
- Technical accuracy: does the method actually measure what it claims to measure, under real conditions rather than lab conditions.
- Robustness: does it resist straightforward circumvention, a photo of a photo, a borrowed ID, a VPN that just changes the billing country.
- Reliability: does it perform consistently across the population it is checking, not just on the demographic the model was trained on.
- Fairness: does it work without materially worse outcomes for particular groups, and does it treat a wrongly-rejected adult reasonably.
The guidance adds that a method also has to be easy to use and interoperable enough not to lock users into one provider.
That is a genuinely sensible way to regulate, because it is tech-neutral. It does not freeze the standard around whatever happens to work in 2026, and it does not hand a state-mandated monopoly to whichever vendor got their lobbying in first.
It also means "highly effective" is not a certificate you get once. It is a standard a provider has to keep meeting as the population, and the attackers, change.
What's ruled out, and what can qualify
What it rules out is easier to state than what it allows. None of these measure anything:
- self-declaration
- a birthdate field with no verification behind it
- a checkbox
- anything relying purely on contractual terms ("by using this service you confirm you are 18")
Ofcom's list of methods it considers capable of being highly effective, when implemented properly:
- photo-ID matching
- facial age estimation
- open banking checks
- mobile network operator age checks
- reusable digital identity services
- email-based age estimation, on the basis of account signals rather than the email address itself, though it is generally treated as weaker evidence than the others
Part 5 and Part 3 are not the same duty
It's worth being precise about which duty applies where, because the Act does not impose one uniform age-check obligation.
- Part 5 (section 81) covers services that publish their own pornographic content. The duty is absolute: children must not normally be able to encounter it, and "highly effective" age assurance is the mechanism for achieving that.
- Part 3 covers user-to-user and search services likely to be accessed by children more generally: TikTok, Reddit, whatever comes next.
Under Part 3, age assurance sits inside a broader risk-based duty under Ofcom's Protection of Children Codes. A platform has to assess the risk its service poses to children and apply proportionate measures. That may or may not mean full "highly effective" age checks, depending on what the risk assessment finds.
So a children's social network and a general-purpose forum with an 18+ subforum are not held to identical technical bars, even though both might end up using similar tools.
Facial estimation is precise, except right at 18
Facial age estimation is the method getting the most real-world use, so its published accuracy figures are a useful sanity check on what "highly effective" costs in practice.
Yoti, one of the larger providers, reports a mean error of around 1.1 years when estimating the age of 13 to 17 year olds. It says it correctly identifies 99.3% of that age group as under 21.
That sounds precise, and for a binary "under 18 or not" gate it mostly is. Hang on, why? Because the useful signal is not the exact age guess. It's how confidently the model can place someone on the correct side of a threshold several years wide.
Where it gets harder is right at the boundary. Distinguishing a 17 year old from an 18 year old on facial features alone is a genuinely different, much noisier problem than distinguishing a 13 year old from a 25 year old.
Ofcom's own 2026 report on the use of age assurance says as much. It notes "serious doubts" about the effectiveness of some age inference models at exactly that margin, and warns that a meaningful number of children could still be getting through methods that look statistically strong in aggregate.
Only 43% of children tested hit a real check
The same report has the one number that matters most for judging whether any of this is working. The proportion of children who, when tested, actually encountered a highly effective age check rose from 25% in July 2025 to 43% by January 2026.
Progress, clearly. But also a plain admission that well over half of the children Ofcom sampled still were not being properly gated six months after the Part 5 deadline had passed.
Enforcement has started, and it is not symbolic
The clearest illustration of what "highly effective" means in practice is not the guidance document; it's Ofcom's enforcement record.
In 2026 it fined the pornography site Fapello.com £630,000:
- £600,000 for the underlying section 81 failure between July and November 2025
- £30,000 on top for not responding properly to a statutory information request
Fapello had geoblocked the UK by the time the fine landed, having tried and then abandoned age checks. That did not help. The fine covered the period the site was live and non-compliant, and leaving the market afterwards does nothing to un-happen the months it spent without any real age gate.
Ofcom has said explicitly that it is prioritising enforcement against porn sites gaining UK traffic precisely because they have not put checks in place.
That's the obvious adverse-selection problem with partial enforcement. Sites that comply lose the users who specifically wanted a service without age checks, and those users go to whichever site is still non-compliant.
UK GDPR still applies to every face and ID you check
Highly effective age assurance nearly always means processing something sensitive: a face, an ID document, an open banking record. That pulls UK GDPR into the picture alongside the Online Safety Act.
The ICO and Ofcom published a joint statement in March 2026 specifically to head off the argument that a Part 5 duty somehow excuses a provider from ordinary data protection principles. It does not.
Data minimisation, purpose limitation and storage limitation all still apply:
- A facial age estimation check should use the image to produce an age estimate and then discard it, not retain it as a biometric identifier for some other purpose.
- A document check should not become a de facto identity database.
None of the technologies Ofcom lists as capable of being highly effective are mandated outright. The joint statement carefully frames facial age estimation, digital ID and one-time photo matching as current viable examples rather than an approved shortlist. Providers have to justify their own choice against both regulators' tests at once.
In practice this is the part that trips services up. Standing up an age check that is technically accurate is one thing; running it in a way that would survive an ICO audit of what happens to the data afterwards is another.
The VPN problem, and why banning them was never the answer
Every discussion of UK age verification eventually arrives at VPNs. Changing your apparent country is the obvious way around a geographic compliance boundary, and search interest in VPN apps spiked visibly around each enforcement deadline.
The government considered and dropped the idea of restricting VPNs, correctly. A VPN is dual-use infrastructure with entirely legitimate privacy and security purposes for the overwhelming majority of its users.
Banning a category of software to catch a subset of its use is exactly the kind of blunt instrument that causes more collateral damage than it prevents.
Instead, the current approach puts the onus back on platforms. Providers are expected to take reasonable, robust steps to detect and prevent attempts by underage users to circumvent their age assurance.
In practice that means treating a sudden shift in a user's apparent location or network characteristics as a signal worth acting on, rather than treating VPN use itself as something to police.
That framing is the more defensible one. It keeps the compliance burden on the service that chose to publish age-restricted content and profit from UK access, rather than on a general-purpose privacy tool used for reasons that have nothing to do with the Act.
Whether it actually closes the gap is a separate question, and one Ofcom's own numbers suggest is still very much open.