Age Verification Under the UK Online Safety Act: An Operator Playbook

Michelangelo Frigo (Co-Founder at Zyphe) Published August 11, 2026 Updated August 11, 2026

Violet shield with a checkmark representing age verification under the UK Online Safety Act

The UK Online Safety Act's age-check duties are live and Ofcom-enforced. Here's who must comply and what highly effective age assurance really means now.

Table of contents

The UK Online Safety Act requires services hosting or publishing content harmful to children, pornography in particular, to keep under-18s out using highly effective age assurance, with Ofcom enforcing the duties from 25 July 2025.
Self-declaration of age and payment methods that do not confirm age are explicitly not acceptable; the bar is "highly effective."
Ofcom judges methods against four criteria: technical accuracy, robustness, reliability, and fairness, and publishes a non-exhaustive list of methods capable of meeting them.
Approved approaches include open banking, photo-ID matching, facial age estimation, mobile-network-operator checks, digital identity services, credit-card checks, and email-based age estimation.
The privacy tension is real: strong age verification must not become a honeypot of identity data, which favours data-minimising, no-retention approaches.
Ofcom has moved from rules to enforcement, opening many investigations and issuing fines, so compliance is now a live operational requirement, not a future one.

Under the UK Online Safety Act, services that publish or host pornographic or other content harmful to children must use highly effective age assurance to keep under-18s out, with the duties enforced by Ofcom from 25 July 2025. Self-declaration is not sufficient, and approved age verification methods include open banking, photo-ID matching, facial age estimation, and digital identity services.

TL;DR

The UK Online Safety Act has turned age checks from a patchy, self-declared formality into a hard legal duty. Services that publish or host pornography, and more broadly content harmful to children, must use highly effective age assurance to prevent under-18s from accessing it, and Ofcom began enforcing these duties from 25 July 2025. A tick-box "I am over 18" no longer satisfies the law.

Ofcom assesses age-assurance methods against four criteria, technical accuracy, robustness, reliability, and fairness, and lists approaches it considers capable of being highly effective, including open banking, photo-ID matching, facial age estimation, mobile-network-operator checks, digital identity services, credit-card checks, and email-based age estimation. The hard part is doing this without building a privacy liability, because collecting identity data to prove age creates a honeypot. This playbook covers who must comply, the criteria, the methods, the privacy trap, Ofcom's enforcement, and how to implement age verification well.

!An operator playbook for age verification under the UK Online Safety Act, showing the highly effective age assurance criteria and approved methods such as open banking, photo-ID matching, and facial age estimation.

11 min read. Last updated 18 November 2026.

What does the UK Online Safety Act require for age verification?

The UK Online Safety Act places duties on online services to protect children, and a central one is keeping under-18s away from content that is harmful to them. For pornography specifically, in-scope services must ensure that children are not normally able to access it, which in practice means robust age verification or age estimation at the point of access. Ofcom, the regulator, set out the detailed expectations and began enforcing the age-assurance duties from 25 July 2025.

The decisive shift is the standard. Previously many sites relied on a self-declared age gate, a button that asks the user to confirm they are over 18, which any child can click. The Act requires "highly effective age assurance," a materially higher bar that self-declaration and non-age-confirming payment methods do not meet. So age verification under the Act is no longer a formality but a real control that must actually work, which connects to the identity-verification techniques covered in our identity verification software comparison.

Who must comply with the age-check duties?

The duties reach a broad set of services. Most directly, services that publish or display pornographic content must use highly effective age assurance. More broadly, user-to-user and search services that are likely to be accessed by children, and that carry content harmful to children, have duties to protect those children, which can include age assurance for the relevant content. The largest, highest-reach services face additional categorised duties.

The practical test many operators must apply is whether their service is "highly likely to be accessed by children," because that triggers child-safety duties. The result is that the Act's age-verification expectations extend well beyond dedicated adult sites to social media, some gaming, and any UK-facing platform with restricted-content surfaces. If your service is reachable by UK users and carries adult or harmful content, you should assume the age-assurance duties are relevant and confirm your specific obligations, because the cost of assuming you are out of scope is now an Ofcom investigation.

What counts as highly effective age assurance?

"Highly effective" is the heart of the regime, and Ofcom defines it through four criteria rather than a single technology. A method should be technically accurate, robust against circumvention, reliable, and fair. Technical accuracy means it correctly distinguishes adults from children; robustness means it resists being fooled or bypassed; reliability means it works consistently across the user base; and fairness means it does not produce discriminatory or skewed outcomes across different groups.

Critically, Ofcom is explicit about what does not meet the bar: self-declaration of age, and payment methods that do not require the user to be 18, are not highly effective. The standard is outcome-focused, so an operator must be able to show that whatever method it uses genuinely meets the four criteria for its audience, not merely that it deployed something labelled age assurance. This mirrors the way liveness and verification are judged on real-world robustness, as in deepfake detection.

What are the approved age-assurance methods?

Ofcom publishes a non-exhaustive list of methods it considers capable of being highly effective, which gives operators concrete options. These include open banking, where a bank confirms the user is over 18 without sharing underlying details; photo-ID matching, comparing a submitted ID to the user; facial age estimation, which estimates age from a selfie; mobile-network-operator checks, using the age status held by a mobile provider; digital identity services and wallets; credit-card checks, since cards generally require the holder to be 18; and email-based age estimation, inferring likely age from how an email address is used across services.

The list is not a guarantee that any implementation of these methods is compliant; the method must actually achieve highly effective age assurance in practice. But it gives operators a menu of approaches that can meet the bar, and many will offer a choice so users can pick the one they are comfortable with. The right selection balances effectiveness, user friction, and, crucially, privacy, which the next section addresses.

Do you have to store users' identity documents?

This is the question that should worry operators most, and the answer is no, you should design specifically to avoid it. Strong age verification requires checking something real about the user, but it does not require the platform to retain a database of identity documents, and doing so creates a serious privacy liability and a breach target, especially given the sensitivity of users on adult-content services. UK data-protection law and the regulator's own guidance push toward data minimisation, collecting and retaining only what is necessary.

The privacy-preserving pattern is to confirm the age outcome, over 18 or not, without the platform storing the underlying identity data. Approaches like open banking confirmations, facial age estimation that does not retain the image, and reusable, user-held credentials let a service satisfy the highly effective bar while holding minimal or no sensitive data. A decentralised, no-honeypot architecture is the cleanest way to square strong age verification with privacy, the same principle behind decentralised KYC and our work on why your KYC vendor is your biggest data breach risk. The worst outcome is to comply with the Act by creating a different, data-protection liability.

What enforcement has Ofcom taken?

This is no longer theoretical. Since the age-assurance duties took effect in July 2025, Ofcom has moved into active enforcement, opening investigations into many online services for suspected non-compliance and issuing financial penalties against services that failed to put effective age checks in place. The regulator has the power to impose significant fines and, in serious cases, to seek measures restricting access to non-compliant services.

For operators, the message is that the enforcement phase has begun and the regulator is willing to act, so treating the duties as a future problem is itself a risk. The practical posture is to implement compliant age verification now, document why your chosen method meets the highly effective standard, and be ready to demonstrate that to Ofcom, because the cost of waiting is an investigation and potential penalty rather than a quiet grace period.

How do you implement compliant age verification?

Implementation comes down to a few steps. First, confirm scope: determine whether your service publishes adult content or is highly likely to be accessed by children with content harmful to them, and therefore which duties apply. Second, choose methods that meet the four criteria for your audience, ideally offering users a choice among approved approaches like open banking, facial age estimation, or photo-ID matching. Third, design for privacy: confirm the age outcome without retaining identity documents, using data-minimising or reusable-credential approaches so you do not build a honeypot.

Fourth, document your reasoning: record why your chosen method is highly effective against the criteria, so you can evidence compliance to Ofcom. Fifth, monitor and update, as methods, threats, and guidance evolve. Done well, age verification under the Act protects children, satisfies the regulator, and respects adult users' privacy simultaneously, which is the outcome the privacy-preserving methods are designed to deliver. Book an age-assurance review to map your approach.

The bottom line

The UK Online Safety Act has made age verification a real control with teeth: in-scope services must use highly effective age assurance, self-declaration is dead, and Ofcom has been enforcing since July 2025. The four criteria, accuracy, robustness, reliability, and fairness, define the bar, and Ofcom's listed methods give operators a menu to meet it.

The trap to avoid is solving the age problem by creating a privacy problem. Choose methods that confirm the age outcome without retaining identity documents, document why your approach is highly effective, and treat compliance as a now requirement, not a later one. Done right, you protect children, satisfy the regulator, and keep adult users' data out of a honeypot, all at once.

Book an age-assurance review, or see how it works.

Cited sources

Ofcom, age assurance and the Online Safety Act: https://www.ofcom.org.uk/online-safety/protecting-children/age-assurance
UK Government, Online Safety Act 2023: https://www.legislation.gov.uk/ukpga/2023/50/contents
Information Commissioner's Office (ICO), age assurance and data protection: https://ico.org.uk/
FATF Recommendations (identity and verification context): https://www.fatf-gafi.org/en/topics/fatf-recommendations.html

Michelangelo Frigo (Co-Founder at Zyphe) Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.

Frequently Asked Questions

It requires services that publish or host pornography, and more broadly content harmful to children, to use highly effective age assurance so that under-18s are not normally able to access it. Ofcom enforces these duties, which took effect on 25 July 2025. A self-declared age gate no longer satisfies the law; the method must genuinely and reliably distinguish adults from children.

It is Ofcom's standard for age checks, defined by four criteria: technical accuracy, robustness against circumvention, reliability, and fairness. A compliant method must genuinely distinguish adults from children, resist being bypassed, work consistently, and not produce skewed outcomes across groups. Self-declaration of age and non-age-confirming payment methods explicitly do not meet the standard.

Ofcom publishes a non-exhaustive list of methods capable of being highly effective, including open banking, photo-ID matching, facial age estimation, mobile-network-operator checks, digital identity services, credit-card checks, and email-based age estimation. The method must actually achieve the highly effective standard in practice; being on the list is not an automatic guarantee of compliance for every implementation.

Services that publish pornographic content must use highly effective age assurance, and user-to-user and search services likely to be accessed by children that carry content harmful to them have child-safety duties that can include age assurance. This reaches well beyond adult sites to social media, some gaming, and any UK-facing platform with restricted-content surfaces.

No, and you should design to avoid it. Strong age verification requires checking something real but not retaining a database of identity documents, which would create a privacy liability and breach target. Data-minimising approaches, open banking confirmations, facial age estimation without image retention, and reusable user-held credentials, let you meet the standard while holding minimal or no sensitive data.

The age-assurance duties for in-scope services took effect on 25 July 2025, and Ofcom began enforcing them from that point. Since then the regulator has opened investigations into numerous services and issued penalties for non-compliance, so the requirements are live and actively enforced rather than a future obligation.

Ofcom can investigate non-compliant services and impose significant financial penalties, and in serious cases pursue measures to restrict access to a service. Since enforcement began in 2025 the regulator has acted against multiple services, so non-compliance carries real, current risk, including reputational damage alongside the financial penalty.

Yes. Privacy-preserving age verification confirms only the age outcome, over 18 or not, without the platform storing underlying identity data, using methods like open banking confirmations, facial age estimation without retention, or reusable user-held credentials. A decentralised, no-honeypot architecture lets a service meet the highly effective standard while minimising the sensitive data it holds, satisfying both Ofcom and data-protection expectations.

Related products

Know Your Customer

Verify users seamlessly and securely

Verify users in 190+ countries with 99.8% document matching accuracy and reusable identity credentials that enable one-click onboarding for up to 70% higher completion rates.

Learn more →

Decentralized KYC

agents on a substrate where users own their identity

Decentralized KYC verifies users with AI agents on a substrate where customers own their credentials. Users reuse identities across platforms; you never become the honeypot.