Age verification UK rules under the Online Safety Act: who must comply, what counts as highly effective age assurance, every Ofcom fine to date, and methods.
Table of contents
- The UK Online Safety Act requires services that allow pornography, and user-to-user services that allow the most harmful content for children, to use highly effective age assurance. Ofcom has enforced the duty since 25 July 2025.
- Self-declaration and payment methods that do not require the user to be 18 do not count. Ofcom judges a method on four criteria: technically accurate, robust, reliable and fair.
- Ofcom has issued final age-assurance fines against eight providers, from £80,000 to £1.35 million, and in the summer of 2026 opened investigations into TikTok's age inference and Aylo's reliance on Apple's age signals.
- Compliance is slipping at the long tail: 64 of the top 100 pornography services had age assurance in June 2026, down from 77 in January.
- The maximum penalty is £18 million or 10% of qualifying worldwide revenue, whichever is greater.
Age verification in the UK is a legal duty under the Online Safety Act 2023: services that allow pornography, or other content the Act treats as most harmful to children, must use highly effective age assurance to stop under-18s reaching it. Ofcom has enforced the duty since 25 July 2025 and has already fined non-compliant services.
TL;DR
The Online Safety Act turned age checks from a self-declared formality into a duty with fines attached. Since 25 July 2025, in-scope services must use highly effective age assurance, and a tick-box "I am over 18" no longer satisfies the law. Ofcom lists methods capable of meeting the bar, from facial age estimation to open banking, and has fined eight providers so far. The open problem is privacy: collecting identity documents to prove age creates a breach target, so the strongest compliance posture confirms the age result without keeping the document.
This article is general information on UK law as of 28 September 2026, not legal advice.
What does the UK Online Safety Act require for age verification?
The Online Safety Act 2023 places duties on online services to protect children, and a central one is keeping under-18s away from content that is harmful to them. The age-assurance duties arrived in two steps:
- 17 January 2025. Services that publish their own pornographic content became subject to the Part 5 duty (section 81) to ensure children are not normally able to encounter it.
- 25 July 2025. The Part 3 duty took effect: services that allow pornography, and user-to-user services that allow "primary priority content" (pornography and content encouraging suicide, self-harm or eating disorders), must use highly effective age assurance to prevent children from encountering it.
The decisive shift is the standard. Many sites previously relied on a button asking the user to confirm they were over 18, which any child can click. The Act requires age assurance that is highly effective, a materially higher bar that self-declaration does not meet.
The penalty ceiling is set in Schedule 13: £18 million or 10% of qualifying worldwide revenue, whichever is greater. In serious cases Ofcom can also apply to court for business disruption measures requiring payment providers, advertisers or internet service providers to withdraw services from, or block access to, a non-compliant service.
Who must comply with the age-check duties?
The duties reach further than dedicated adult sites. Three groups are in scope:
- Services that publish their own pornographic content (Part 5), which have been in scope since January 2025.
- User-to-user and search services that allow pornography, including social platforms where users can post it.
- User-to-user services that allow other primary priority content, such as content encouraging suicide, self-harm or eating disorders.
A service does not need age assurance for this purpose if its terms prohibit that content for all users and it enforces the ban. The practical consequence is that social media, forums, some gaming and dating services and any UK-facing platform with adult surfaces must either keep the content out entirely or put a highly effective age check in front of it. The cost of assuming you are out of scope is now an Ofcom investigation, as the enforcement record below shows.
What counts as highly effective age assurance?
Highly effective age assurance is Ofcom's standard for age checks under the Act. Ofcom's guidance on age checks requires a method to be technically accurate, robust, reliable and fair:
- Technically accurate: it correctly distinguishes adults from children.
- Robust: it resists being fooled or bypassed, including by spoofing and deepfakes.
- Reliable: it works consistently across the user base.
- Fair: it does not produce skewed outcomes for particular groups.
Ofcom is explicit about what fails the test: self-declaration of age, and online payments that do not require the person to be 18. Its July 2026 report added age inference, estimating age from behaviour, to the list of approaches that are not highly effective on their own. The standard is outcome-focused, so an operator must be able to show that its method meets the four criteria for its audience, not merely that it deployed something labelled age assurance. Robustness in particular connects to liveness detection and deepfake detection.
What are the approved age-assurance methods?
Ofcom publishes a non-exhaustive list of methods it considers capable of being highly effective:
- Facial age estimation: software estimates age from a live selfie without establishing who the person is.
- Photo-ID matching: a government identity document is matched to a live face capture.
- Open banking: the user's bank confirms they are over 18 without sharing account details.
- Mobile network operator checks: the mobile provider confirms the account holder's age status.
- Credit card checks: UK credit card issuers require holders to be 18.
- Email-based age estimation: age is inferred from the services an email address has been used with.
- Digital identity services, including reusable digital identity wallets.
The list does not certify any particular implementation. The method must achieve highly effective age assurance in practice, and many services offer a choice so users can pick the route they are comfortable with. For a vendor-by-vendor view of who delivers these methods, see our comparison of the best age verification software.
How do the age verification methods compare?
Choosing a method is a trade-off between assurance strength, user friction and privacy exposure. Most UK services deploy one of three families.
| Facial age estimation | ID document plus selfie | Email, telco, bank or card signals | |
|---|---|---|---|
| How it works | Estimates age from a live selfie; no identity established | Verifies a government ID, then matches it to a live face | Infers or confirms age from an existing account |
| Assurance | High for clear adults; needs a buffer age near 18 | Highest; proves age and identity | Depends on the signal and its source |
| User friction | Low: a selfie, no documents | Moderate: document capture plus selfie | Lowest: often no camera at all |
| Privacy exposure | Low if the image is processed and deleted | Highest, unless the platform never holds the document | Medium; ties the check to an identifiable account |
| Main fraud risk | Spoofing and deepfakes | Forged documents, injection attacks, deepfakes | Borrowed accounts and cards |
| Best fit | Content gating where identity is irrelevant | Regulated onboarding and fall-back for borderline results | Low-friction first pass |
Many compliant services run a waterfall: facial age estimation first, with a document check as the fall-back for users the estimate cannot confidently clear. That keeps friction low for most adults while preserving a highly effective route for edge cases. Our age verification and digital identity guide goes deeper on how each method works.
What enforcement has Ofcom taken?
Ofcom has moved from guidance to penalties. Its enforcement programme on age assurance has produced these final decisions with fines for age-assurance failings:
| Decision date | Provider | Age-assurance fine | Other penalties |
|---|---|---|---|
| 3 December 2025 | AVS Group Ltd | £1,000,000 | £50,000 for not answering an information request; daily penalties |
| 11 February 2026 | Kick Online Entertainment SA | £800,000 | £30,000 for not answering an information request |
| 20 February 2026 | 8579 LLC | £1,350,000 | £50,000 for not answering an information request; daily penalties |
| 19 March 2026 | 4chan Community Support LLC | £450,000 | £70,000 for risk assessment and terms of service failings; daily penalties |
| 26 May 2026 | Youngtek Solutions Ltd | £500,000 | £100,000 for not answering an information request |
| 18 June 2026 | First Time Videos LLC | £80,000 (Part 5) | |
| 8 July 2026 | Provider of fapello.com | £600,000 | £30,000 for not answering an information request |
| 3 September 2026 | Provider of Xgroovy.com | £700,000 | £30,000 for not answering an information request; daily penalties |
Sources: Ofcom's enforcement programme page (updated 23 September 2026) and its 4chan investigation page.
Three patterns stand out.
- Information requests are a separate breach. Almost every decision carries an extra fine for failing to answer Ofcom, so ignoring the regulator's letters costs money on its own.
- Daily penalties make delay expensive. Several decisions add a daily amount that runs until age assurance is live or a cap is reached.
- The net is widening beyond adult sites. In July 2026 Ofcom opened an investigation into TikTok over whether its age-inference models miss a significant proportion of children. In September 2026 it opened one into Aylo, Pornhub's owner, over a process that relies on Apple's age-check signals and the due diligence behind it.
Ofcom also has provisional decisions outstanding against further providers, so the list above will grow.
Is age assurance working a year in?
Ofcom's statutory report on the use of age assurance, published in July 2026, gives the first hard numbers:
- Volume: over 69 million age checks were completed across a sample of 32 services in the second half of 2025, a 23-fold increase on the 3 million of the previous six months.
- Reach: exposure to age assurance methods other than self-declaration rose from 25% of children in July 2025 to 43% in January 2026.
- Method: facial age estimation was the method children most commonly recalled encountering.
- Coverage is slipping: 64 of the top 100 pornography services had age assurance in June 2026, with a further 10 blocking UK users, down steadily from 77 in January.
Ofcom's own verdict is that "the job is not done". It has committed to deliver to Parliament, by the end of October 2026, a rapid assessment of how highly effective age checks could determine whether someone is over 16, and a separate statutory report on app stores by January 2027. Both point the same way: the duty is set to widen, not settle.
Do you have to store users' identity documents?
No, and you should design specifically to avoid it. Strong age verification requires checking something real about the user, but it does not require the platform to keep a database of passports and face images. On adult services in particular, such a database is a serious privacy liability and a breach target, and UK data protection law already pushes toward collecting and retaining only what is necessary.
The backlash to the July 2025 deadline showed how users see the trade. VPN apps became the most downloaded on Apple's UK App Store within days, and Proton reported an 1,800% spike in UK daily sign-ups, according to the BBC. When Discord expanded age checks the protest made mainstream news, which we covered in the Discord age verification backlash. The objection is rarely to age-gating as such. It is to the data trail, and our KYC and IDV breach tracker logs how often that trail leaks.
There are two structural answers, and a compliant platform should use both:
- Verify without identifying. Facial age estimation can confirm "over 18" from a selfie that is processed and deleted, with no name or document attached.
- Verify without holding the document. When an ID check is needed, the platform should receive the age result, not the passport. A reusable, user-held credential such as a KYC Passport lets a returning adult prove their age again without re-uploading anything, and Zyphe age verification runs the check without the platform storing the ID.
The worst outcome is to comply with the Online Safety Act by creating a data protection liability, which is why we argue your KYC vendor can be your biggest breach risk.
Are the US and EU moving the same way?
Yes, and fast. In the United States, the Supreme Court upheld Texas's age-verification law for pornography sites in Free Speech Coalition v. Paxton on 27 June 2025, applying intermediate rather than strict scrutiny. The Free Speech Coalition's own tracker lists 27 states with adult-content age-verification laws as of 28 September 2026, and we cover new ones as they land, such as Missouri's.
The next front is app stores. Texas's App Store Accountability Act was blocked by a federal judge in December 2025, and on 6 July 2026 the Supreme Court declined to halt its enforcement, as we explain in Texas app store age verification at the Supreme Court. Louisiana's law took effect on 1 July 2026, California's Digital Age Assurance Act applies from 1 January 2027, and Utah has moved its main app store duties to 6 May 2027.
In the EU, age verification is being built into the digital identity framework, including a trusted list of providers, covered in our report on the EU age verification trusted list. The direction is consistent across all three: age checks are becoming a baseline legal requirement, and the open question is how to run them without creating new privacy harms.
How do you implement compliant age verification?
Six steps take a UK-facing platform from exposure to a defensible position.
- Confirm scope. Establish whether you publish pornography, allow it, or allow other primary priority content, and whether your terms and moderation could keep it out entirely instead.
- Choose methods from Ofcom's list and document why your implementation is accurate, robust, reliable and fair for your audience.
- Run a low-friction waterfall. Estimation first, document verification as the fall-back, to protect conversion while keeping a highly effective route.
- Minimise data. Prefer methods that return an age result rather than an identity file, and avoid holding documents or face images.
- Keep audit evidence and answer Ofcom. Be ready to show age-check performance data on request; the enforcement record shows that silence is fined separately.
- Watch the under-16 assessment. Ofcom's report to Parliament, due by the end of October 2026, is the likeliest trigger for the next widening of the duty.
For adult platforms, our page on age and identity verification for adult platforms covers the operational detail. Book an age-assurance review to map your approach.
The bottom line
Age verification in the UK is now a control with teeth. In-scope services must use highly effective age assurance, self-declaration is finished, and Ofcom has fined eight providers and opened investigations into TikTok and Aylo. The trap is solving the age problem by creating a privacy problem. Choose methods that confirm the age result without keeping identity documents, document why your approach is highly effective, answer Ofcom when it writes, and plan for the under-16 duty that is coming next.
Book an age-assurance review, or see how it works.
Related resources
- Zyphe age verification: how the check runs without storing the ID
- Best age verification software in 2026
- Age verification and digital identity guide
- Age and identity verification for adult platforms
- What is a KYC Passport?
- Meta age assurance settlement
- Deepfake detection in KYC
- KYC and IDV breach tracker
Cited sources
- UK Parliament, Online Safety Act 2023: https://www.legislation.gov.uk/ukpga/2023/50/contents
- Online Safety Act 2023, Schedule 13 (penalties): https://www.legislation.gov.uk/ukpga/2023/50/schedule/13
- The Online Safety Act 2023 (Commencement No. 4) Regulations 2024: https://www.legislation.gov.uk/uksi/2024/1333/made
- Ofcom, Age checks to protect children online: https://www.ofcom.org.uk/online-safety/protecting-children/age-checks-to-protect-children-online
- Ofcom, Report on the use of age assurance, July 2026: https://www.ofcom.org.uk/online-safety/protecting-children/use-of-age-assurance-report-2026
- Ofcom, Enforcement programme on age assurance: https://www.ofcom.org.uk/online-safety/protecting-children/enforcement-programme-to-protect-children-from-encountering-pornographic-content-through-the-use-of-age-assurance
- Ofcom, Investigation into 4chan: https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/investigation-into-4chan-and-its-compliance-with-duties-to-protect-its-users-from-illegal-content
- Ofcom, Investigation into TikTok: https://www.ofcom.org.uk/online-safety/protecting-children/investigation-into-tiktoks-compliance-with-duties-to-protect-children-from-encountering-harmful-content-under-section-12
- BBC News, VPN downloads after UK age checks, 28 July 2025: https://www.bbc.co.uk/news/articles/cn72ydj70g5o
- Supreme Court of the United States, Free Speech Coalition v. Paxton, 27 June 2025: https://www.supremecourt.gov/opinions/24pdf/23-1122_3e04.pdf
- Free Speech Coalition, state age verification laws tracker (accessed 28 September 2026): https://action.freespeechcoalition.com/age-verification-resources/state-avs-laws/
Michelangelo Frigo (Co-Founder at Zyphe) Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.