17.2 Age verification and age assurance

Status reviewed 22 September 2026. Providers publishing their own pornography have had to use highly effective age assurance before access since January 2025, while wider child-safety duties for user-to-user services took effect from July 2025. Further age checks have been announced for the planned under-16 social-media restrictions, but those future regulations are not yet in force.

What changed in 2025

For most of the internet's history, UK age checks meant self-declaration: a button asking if you were over 18 that took your word for it.

The practical compliance deadline for the wider user-to-user child-safety duties was 25 July 2025. The duties now look like this:

• Services publishing their own pornography must prevent children encountering it through highly effective age assurance.
• User-to-user services likely to be accessed by children must use highly effective age assurance to prevent children encountering pornography and the strongest categories of content harmful to children, where that content is present.
• Self-declaration alone is not highly effective.

Not every service must identify every visitor the same way. The legal duty and the proportionate method depend on the service and the risk.

The shift was abrupt and widely felt. Major adult sites, social platforms with adult content and a range of other services rolled out age gates within days of each other.

For many people it was the first time online regulation made a concrete, personal demand. To keep doing something they had done freely the week before, they had to upload a passport, scan their face, or route their identity through a verification company they had never heard of.

Protecting children from pornography commands wide support; the method of implementation is where the privacy problems begin.

How age checks actually work

"Age assurance" covers several techniques with very different privacy characteristics. Knowing which is which is the first step to limiting your exposure, because some reveal far more than others and you sometimes get a choice.

Document verification

The most identifying method. You photograph an identity document such as a passport or driving licence, sometimes with a liveness check.

The document holds far more than the service needs just to know you are over a threshold.

• Well designed: a specialist provider checks the document, discards unnecessary fields, and returns only an age-over-threshold token. The content service never receives the document or your name.
• Poorly designed: it may retain document images, identifiers, account links or transaction logs.

Questions worth asking:

• What does the relying site receive?
• What does the verifier retain, and for how long?
• Can the two parties link repeat checks?

Facial age estimation

Less identifying. A camera captures your face and software estimates your age from your appearance, returning "likely over 18" or "likely under 18" rather than who you are.

In principle this is more privacy-preserving, because it need not keep a name or a document. In practice, much depends on:

• whether the image is genuinely processed and discarded on the spot, or sent to and stored by a third party;
• how accurate the estimate is near the threshold;
• whether the provider quietly keeps data for "model improvement".

Estimation is also imperfect, so providers tend to set the bar a few years above 18 to avoid letting children through. Result: many adults are wrongly rejected and pushed towards document checks instead.

Other methods

Other approaches, each with its own trade-offs:

• Credit-card checks and checks against banking or credit-reference data: these tie your viewing to your financial identity.
• Mobile-network age confirmation.
• Reusable digital identity wallets that you verify once and present repeatedly: fewer document uploads, but a single persistent identity presented again and again, potentially building a profile of every gated service you visit.

None of these methods is free of privacy cost. The only question is which costs you would rather bear.

The privacy problem

The central concern is not the principle of keeping children away from pornography. It is the data trail a chosen method may create.

• A badly designed check can link identity evidence to sensitive online activity.
• A privacy-preserving design separates the verifier from the content service and returns only a yes-or-no age attribute, but you still have to trust the separation, deletion, security and logging claims.

A breach of a verifier or relying site could be particularly harmful, because identity evidence, biometrics and intimate browsing interests are difficult or impossible to change.

Then there is aggregation, the theme running through 1.3 and the whole of Chapter 1. One age check is one record. As more services adopt age assurance and reusable wallets spread, the same identity is presented across many contexts.

The danger is not any single disclosure. It is the slow construction of a comprehensive, identity-linked record of private behaviour, held across a patchwork of companies with varying competence and varying willingness to resist disclosure.

Finally, the chilling effect. People behave differently when they believe their private reading and viewing can be tied to their name. Lawful curiosity about sensitive subjects (sexuality, health, addiction, politics, religion) is exactly what people will avoid if it means identifying themselves.

That self-censorship is a real cost, borne disproportionately by the vulnerable, and rarely counted when these systems are assessed.

What Ofcom has said so far. Its statutory report, updated 27 July 2026, assessed the first six months of use rather than creating a new duty. It found:

• no single method eliminates circumvention;
• services must strengthen weak implementations and comply with privacy law;
• age inference is not suitable for a rule that must prevent access before a child has used the service.

Ofcom is due to give Parliament a separate rapid assessment of checks for an over-16 threshold by the end of October 2026. That future assessment and later guidance should not be mistaken for rules already in force.

An Ofcom compliance update on 28 August reported that seven services dedicated to particularly harmful content had blocked UK access after regulatory engagement, while others introduced age checks. A provider choosing to geo-block is not a new age-assurance method or a general statutory blocking order; it is one practical response to the existing duties.

Scope creep: from adult sites to everything

Watch where age assurance is going, not just where it started. The infrastructure is general-purpose and can gate many services or functions.

In June and July 2026 the government announced an under-16 social-media restriction, stronger checks to identify under-16s, and default restrictions for older teenagers, subject to regulations that have not yet been made. That moves age assurance beyond pornography into mainstream participation.

The exact services, methods, safeguards and exemptions remain policy and regulatory questions, as explained in 17.6.

The pattern to recognise across this whole chapter:

• a measure is introduced for a narrow, sympathetic purpose;
• the infrastructure is built and normalised (the hard part);
• the scope then expands, because that hard part is already done.

Spotting this is not cynicism; it is paying attention to how such systems have historically evolved. The reasonable response: support narrow, genuinely protective measures while resisting the open-ended attachment of identity to ordinary online activity.

Reducing what you expose

Where an age check applies, minimise what you reveal:

• Prefer a method that returns only an age attribute and does not hand the content service an identity document.
• Facial estimation may collect less identity data than document verification, but it still processes an image and can be inaccurate or biased near a threshold.
• Read the verifier's notice for retention, reuse, human review, appeals and deletion.
• Do not assume a certification logo proves no logs exist.
• Avoid linking the check to your main email or an identified account unless the service genuinely requires it.

VPNs: using one is not generally prohibited in the UK, and a non-UK exit may mean a location-triggered UK age gate is not shown. That does not make every use lawful or contractually permitted:

• the underlying content and conduct still matter;
• a service may prohibit location circumvention in its terms;
• adults must not help children defeat protections.

This site does not give case-specific legal advice. The policy debate about restricting children's VPN access is in 17.4, and VPN capabilities and limits in 5.2.

You keep your data-protection rights. An age-assurance provider must have a lawful basis, process data fairly and transparently, minimise collection, limit reuse, secure the data, and respect applicable rights.

The ICO says that in many cases viewing an official document may be excessive where a less revealing method can do the job. Complaint and access routes are in 17.8.

Primary sources: Ofcom's implementation dates, July 2026 use-of-age-assurance report and 28 August compliance update, ICO age-assurance and data-minimisation guidance, and the March 2026 ICO/Ofcom joint statement.