Free guide: How to use AI in compliance
Age gate with a barrier lifting for a verified visitor beside an eighteen-plus badge

Age verification UK rules under the Online Safety Act: who must comply, what counts as highly effective age assurance, every Ofcom fine to date, and methods.

Table of contents
  • The UK Online Safety Act requires services that allow pornography, and user-to-user services that allow the most harmful content for children, to use highly effective age assurance. Ofcom has enforced the duty since 25 July 2025.
  • Self-declaration and payment methods that do not require the user to be 18 do not count. Ofcom judges a method on four criteria: technically accurate, robust, reliable and fair.
  • Ofcom has issued final age-assurance fines against eight providers, from £80,000 to £1.35 million, and in the summer of 2026 opened investigations into TikTok's age inference and Aylo's reliance on Apple's age signals.
  • Compliance is slipping at the long tail: 64 of the top 100 pornography services had age assurance in June 2026, down from 77 in January.
  • The maximum penalty is £18 million or 10% of qualifying worldwide revenue, whichever is greater.

Age verification in the UK is a legal duty under the Online Safety Act 2023: services that allow pornography, or other content the Act treats as most harmful to children, must use highly effective age assurance to stop under-18s reaching it. Ofcom has enforced the duty since 25 July 2025 and has already fined non-compliant services.

TL;DR

The Online Safety Act turned age checks from a self-declared formality into a duty with fines attached. Since 25 July 2025, in-scope services must use highly effective age assurance, and a tick-box "I am over 18" no longer satisfies the law. Ofcom lists methods capable of meeting the bar, from facial age estimation to open banking, and has fined eight providers so far. The open problem is privacy: collecting identity documents to prove age creates a breach target, so the strongest compliance posture confirms the age result without keeping the document.

This article is general information on UK law as of 28 September 2026, not legal advice.

What does the UK Online Safety Act require for age verification?

The Online Safety Act 2023 places duties on online services to protect children, and a central one is keeping under-18s away from content that is harmful to them. The age-assurance duties arrived in two steps:

  1. 17 January 2025. Services that publish their own pornographic content became subject to the Part 5 duty (section 81) to ensure children are not normally able to encounter it.
  2. 25 July 2025. The Part 3 duty took effect: services that allow pornography, and user-to-user services that allow "primary priority content" (pornography and content encouraging suicide, self-harm or eating disorders), must use highly effective age assurance to prevent children from encountering it.

The decisive shift is the standard. Many sites previously relied on a button asking the user to confirm they were over 18, which any child can click. The Act requires age assurance that is highly effective, a materially higher bar that self-declaration does not meet.

The penalty ceiling is set in Schedule 13: £18 million or 10% of qualifying worldwide revenue, whichever is greater. In serious cases Ofcom can also apply to court for business disruption measures requiring payment providers, advertisers or internet service providers to withdraw services from, or block access to, a non-compliant service.

Who must comply with the age-check duties?

The duties reach further than dedicated adult sites. Three groups are in scope:

  • Services that publish their own pornographic content (Part 5), which have been in scope since January 2025.
  • User-to-user and search services that allow pornography, including social platforms where users can post it.
  • User-to-user services that allow other primary priority content, such as content encouraging suicide, self-harm or eating disorders.

A service does not need age assurance for this purpose if its terms prohibit that content for all users and it enforces the ban. The practical consequence is that social media, forums, some gaming and dating services and any UK-facing platform with adult surfaces must either keep the content out entirely or put a highly effective age check in front of it. The cost of assuming you are out of scope is now an Ofcom investigation, as the enforcement record below shows.

What counts as highly effective age assurance?

Highly effective age assurance is Ofcom's standard for age checks under the Act. Ofcom's guidance on age checks requires a method to be technically accurate, robust, reliable and fair:

  • Technically accurate: it correctly distinguishes adults from children.
  • Robust: it resists being fooled or bypassed, including by spoofing and deepfakes.
  • Reliable: it works consistently across the user base.
  • Fair: it does not produce skewed outcomes for particular groups.

Ofcom is explicit about what fails the test: self-declaration of age, and online payments that do not require the person to be 18. Its July 2026 report added age inference, estimating age from behaviour, to the list of approaches that are not highly effective on their own. The standard is outcome-focused, so an operator must be able to show that its method meets the four criteria for its audience, not merely that it deployed something labelled age assurance. Robustness in particular connects to liveness detection and deepfake detection.

What are the approved age-assurance methods?

Ofcom publishes a non-exhaustive list of methods it considers capable of being highly effective:

  • Facial age estimation: software estimates age from a live selfie without establishing who the person is.
  • Photo-ID matching: a government identity document is matched to a live face capture.
  • Open banking: the user's bank confirms they are over 18 without sharing account details.
  • Mobile network operator checks: the mobile provider confirms the account holder's age status.
  • Credit card checks: UK credit card issuers require holders to be 18.
  • Email-based age estimation: age is inferred from the services an email address has been used with.
  • Digital identity services, including reusable digital identity wallets.

The list does not certify any particular implementation. The method must achieve highly effective age assurance in practice, and many services offer a choice so users can pick the route they are comfortable with. For a vendor-by-vendor view of who delivers these methods, see our comparison of the best age verification software.

How do the age verification methods compare?

Choosing a method is a trade-off between assurance strength, user friction and privacy exposure. Most UK services deploy one of three families.

Facial age estimationID document plus selfieEmail, telco, bank or card signals
How it worksEstimates age from a live selfie; no identity establishedVerifies a government ID, then matches it to a live faceInfers or confirms age from an existing account
AssuranceHigh for clear adults; needs a buffer age near 18Highest; proves age and identityDepends on the signal and its source
User frictionLow: a selfie, no documentsModerate: document capture plus selfieLowest: often no camera at all
Privacy exposureLow if the image is processed and deletedHighest, unless the platform never holds the documentMedium; ties the check to an identifiable account
Main fraud riskSpoofing and deepfakesForged documents, injection attacks, deepfakesBorrowed accounts and cards
Best fitContent gating where identity is irrelevantRegulated onboarding and fall-back for borderline resultsLow-friction first pass

Many compliant services run a waterfall: facial age estimation first, with a document check as the fall-back for users the estimate cannot confidently clear. That keeps friction low for most adults while preserving a highly effective route for edge cases. Our age verification and digital identity guide goes deeper on how each method works.

What enforcement has Ofcom taken?

Ofcom has moved from guidance to penalties. Its enforcement programme on age assurance has produced these final decisions with fines for age-assurance failings:

Decision dateProviderAge-assurance fineOther penalties
3 December 2025AVS Group Ltd£1,000,000£50,000 for not answering an information request; daily penalties
11 February 2026Kick Online Entertainment SA£800,000£30,000 for not answering an information request
20 February 20268579 LLC£1,350,000£50,000 for not answering an information request; daily penalties
19 March 20264chan Community Support LLC£450,000£70,000 for risk assessment and terms of service failings; daily penalties
26 May 2026Youngtek Solutions Ltd£500,000£100,000 for not answering an information request
18 June 2026First Time Videos LLC£80,000 (Part 5)
8 July 2026Provider of fapello.com£600,000£30,000 for not answering an information request
3 September 2026Provider of Xgroovy.com£700,000£30,000 for not answering an information request; daily penalties

Sources: Ofcom's enforcement programme page (updated 23 September 2026) and its 4chan investigation page.

Three patterns stand out.

  • Information requests are a separate breach. Almost every decision carries an extra fine for failing to answer Ofcom, so ignoring the regulator's letters costs money on its own.
  • Daily penalties make delay expensive. Several decisions add a daily amount that runs until age assurance is live or a cap is reached.
  • The net is widening beyond adult sites. In July 2026 Ofcom opened an investigation into TikTok over whether its age-inference models miss a significant proportion of children. In September 2026 it opened one into Aylo, Pornhub's owner, over a process that relies on Apple's age-check signals and the due diligence behind it.

Ofcom also has provisional decisions outstanding against further providers, so the list above will grow.

Is age assurance working a year in?

Ofcom's statutory report on the use of age assurance, published in July 2026, gives the first hard numbers:

  • Volume: over 69 million age checks were completed across a sample of 32 services in the second half of 2025, a 23-fold increase on the 3 million of the previous six months.
  • Reach: exposure to age assurance methods other than self-declaration rose from 25% of children in July 2025 to 43% in January 2026.
  • Method: facial age estimation was the method children most commonly recalled encountering.
  • Coverage is slipping: 64 of the top 100 pornography services had age assurance in June 2026, with a further 10 blocking UK users, down steadily from 77 in January.

Ofcom's own verdict is that "the job is not done". It has committed to deliver to Parliament, by the end of October 2026, a rapid assessment of how highly effective age checks could determine whether someone is over 16, and a separate statutory report on app stores by January 2027. Both point the same way: the duty is set to widen, not settle.

Do you have to store users' identity documents?

No, and you should design specifically to avoid it. Strong age verification requires checking something real about the user, but it does not require the platform to keep a database of passports and face images. On adult services in particular, such a database is a serious privacy liability and a breach target, and UK data protection law already pushes toward collecting and retaining only what is necessary.

The backlash to the July 2025 deadline showed how users see the trade. VPN apps became the most downloaded on Apple's UK App Store within days, and Proton reported an 1,800% spike in UK daily sign-ups, according to the BBC. When Discord expanded age checks the protest made mainstream news, which we covered in the Discord age verification backlash. The objection is rarely to age-gating as such. It is to the data trail, and our KYC and IDV breach tracker logs how often that trail leaks.

There are two structural answers, and a compliant platform should use both:

  1. Verify without identifying. Facial age estimation can confirm "over 18" from a selfie that is processed and deleted, with no name or document attached.
  2. Verify without holding the document. When an ID check is needed, the platform should receive the age result, not the passport. A reusable, user-held credential such as a KYC Passport lets a returning adult prove their age again without re-uploading anything, and Zyphe age verification runs the check without the platform storing the ID.

The worst outcome is to comply with the Online Safety Act by creating a data protection liability, which is why we argue your KYC vendor can be your biggest breach risk.

Are the US and EU moving the same way?

Yes, and fast. In the United States, the Supreme Court upheld Texas's age-verification law for pornography sites in Free Speech Coalition v. Paxton on 27 June 2025, applying intermediate rather than strict scrutiny. The Free Speech Coalition's own tracker lists 27 states with adult-content age-verification laws as of 28 September 2026, and we cover new ones as they land, such as Missouri's.

The next front is app stores. Texas's App Store Accountability Act was blocked by a federal judge in December 2025, and on 6 July 2026 the Supreme Court declined to halt its enforcement, as we explain in Texas app store age verification at the Supreme Court. Louisiana's law took effect on 1 July 2026, California's Digital Age Assurance Act applies from 1 January 2027, and Utah has moved its main app store duties to 6 May 2027.

In the EU, age verification is being built into the digital identity framework, including a trusted list of providers, covered in our report on the EU age verification trusted list. The direction is consistent across all three: age checks are becoming a baseline legal requirement, and the open question is how to run them without creating new privacy harms.

How do you implement compliant age verification?

Six steps take a UK-facing platform from exposure to a defensible position.

  1. Confirm scope. Establish whether you publish pornography, allow it, or allow other primary priority content, and whether your terms and moderation could keep it out entirely instead.
  2. Choose methods from Ofcom's list and document why your implementation is accurate, robust, reliable and fair for your audience.
  3. Run a low-friction waterfall. Estimation first, document verification as the fall-back, to protect conversion while keeping a highly effective route.
  4. Minimise data. Prefer methods that return an age result rather than an identity file, and avoid holding documents or face images.
  5. Keep audit evidence and answer Ofcom. Be ready to show age-check performance data on request; the enforcement record shows that silence is fined separately.
  6. Watch the under-16 assessment. Ofcom's report to Parliament, due by the end of October 2026, is the likeliest trigger for the next widening of the duty.

For adult platforms, our page on age and identity verification for adult platforms covers the operational detail. Book an age-assurance review to map your approach.

The bottom line

Age verification in the UK is now a control with teeth. In-scope services must use highly effective age assurance, self-declaration is finished, and Ofcom has fined eight providers and opened investigations into TikTok and Aylo. The trap is solving the age problem by creating a privacy problem. Choose methods that confirm the age result without keeping identity documents, document why your approach is highly effective, answer Ofcom when it writes, and plan for the under-16 duty that is coming next.

Book an age-assurance review, or see how it works.

Cited sources

Michelangelo Frigo Michelangelo Frigo (Co-Founder at Zyphe) Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.

Frequently Asked Questions

Yes, for in-scope services. Under the Online Safety Act, services that allow pornography, and user-to-user services that allow content encouraging suicide, self-harm or eating disorders, must use highly effective age assurance. The duty has applied since 25 July 2025 and Ofcom enforces it.

Ofcom can fine a service up to £18 million or 10% of qualifying worldwide revenue, whichever is greater, and can seek court orders cutting off payment, advertising or internet access. Actual age-assurance fines so far range from £80,000 to £1.35 million, often with daily penalties on top.

Final age-assurance fines have gone to AVS Group, Kick Online Entertainment, 8579 LLC, 4chan, Youngtek Solutions, First Time Videos, and the providers of fapello.com and Xgroovy.com. Ofcom is also investigating TikTok and Aylo, Pornhub's owner.

Yes, when implemented well. Ofcom lists facial age estimation among methods capable of being highly effective, and it was the method children most commonly recalled in Ofcom's 2026 report. Services usually set a buffer age above 18 and fall back to a document check for borderline results.

Not necessarily. Ofcom accepts routes that need no identity document, including facial age estimation, mobile network operator checks, open banking and credit card checks. A document plus selfie check is usually the fall-back when a lower-friction method cannot confidently confirm the user is an adult.

It depends on the provider. Good practice is to process the selfie, return an age result and delete the image. A platform should ask its vendor exactly what is retained, where, and for how long, because a stored face image is sensitive personal data.

No. Ofcom states that self-declaration of age, and online payments that do not require the person to be 18, are not highly effective age assurance. Its 2026 report adds that age inference from behaviour is not highly effective on its own either.

Increasingly, yes. After Free Speech Coalition v. Paxton in June 2025, 27 states have adult-content age-verification laws according to the Free Speech Coalition's tracker, and app store age-verification laws are arriving in Texas, Louisiana, California and Utah.

Compliance without the data honeypot

Zyphe verifies identity without holding your customers' PII. See it in action.

Book a demo