Age assurance at 16: Ofcom names four methods for the UK social media ban

On 29 October 2026 Ofcom published its rapid assessment of age assurance at 16, naming four methods that can reliably show a user is 16 or over: photo ID matching, banking-based checks, digital ID services and facial age estimation. The UK ban itself is not yet law. Regulations are due before Parliament by the end of 2026.

• Ofcom found four methods capable of being highly effective at 16, against seven in its existing guidance at 18. The three methods at 18 missing from the list at 16 are mobile network operator checks, credit card checks and email-based age estimation.
• Ofcom says photo ID is either part of each method or the likely backstop for it. It cites evidence that around 150,000 16- and 17-year-olds hold neither a passport nor a driving licence.
• Facial age estimation can be wrong by a few years at 16, so Ofcom expects a challenge age with a second check. Its announcement does not set a challenge age figure.
• The legal power is section 214A of the Online Safety Act 2023, in force since 29 April 2026. The first regulations need approval by both Houses, with the ban expected in spring 2027.
• Ofcom will consult on draft guidance once the regulations are laid, and says no method fully stops circumvention.

What did Ofcom publish on 29 October 2026?

Ofcom published a rapid assessment of age assurance at 16, written at the Secretary of State's request to inform Parliament before it votes on the ban. It names four methods that can be highly effective at telling whether a user is 16 or over, sets out the accessibility trade-offs and lists ways to reduce circumvention.

The Ofcom announcement explains why the list is shorter than at 18: some options are only available to adults. The rapid assessment page adds that platforms could offer adults the three remaining methods from its existing guidance. Ofcom assessed each method against its four criteria of technical accuracy, robustness, reliability and fairness.

Sources: Ofcom's 29 October 2026 announcement and its January 2025 guidance announcement, which lists the seven methods at 18. Ofcom's 16 assessment refers to them only as the remaining methods for adults; they are the three that appear at 18 but not at 16.

Ofcom's Chief Executive, Dame Melanie Dawes, framed the result as conditional in the announcement: "It can work if social media firms do highly effective age checks properly." She added that Ofcom will be ready to act against companies that fail to comply once the ban is in force.

Where does the UK social media ban stand legally?

The UK ban has been announced and its legal power is in force, but it does not yet bind any platform. Section 214A of the Online Safety Act 2023 lets the Secretary of State require providers to prevent or restrict access by children of, or under, a specified age. No regulations have been laid.

Section 214A was inserted on 29 April 2026 by section 70 of the Children's Wellbeing and Schools Act 2026. It allows regulations about the steps providers must take to comply, about monitoring and about enforcement. Subsection (5) lets a requirement become enforceable under Chapter 6 of Part 7, the Act's enforcement powers. Subsection (7) allows exceptions. Subsection (9) says the Secretary of State must exercise the power following the "Growing up in the online world" consultation, so some restriction must follow, though its age, scope and detail are left to the regulations. Subsections (10) and (11) oblige Ofcom to give research or advice on request and to publish that advice.

The Government announced the ban on 15 June 2026, naming Snapchat, TikTok, YouTube, Instagram, Facebook and X as in scope. It said it does not intend to include messaging services such as WhatsApp and Signal. Its progress statement, laid under section 71 of the 2026 Act, commits to the following timeline.

The progress statement also says the regulations "must be approved by both Houses of Parliament".

What does this mean for platform and identity obligations?

The assessment creates no new duty today, but it shows what the coming duty will demand. Social media platforms keep their current child safety duties and face a stronger age gate. Identity providers and banks become likely sources of age attributes. Data protection rules apply to every check, and the age result must be provable.

Existing Online Safety Act duties. The Secretary of State's June letter to Ofcom says the age restrictions are additional to the Act and that its child safety duties continue to apply, including for 16- and 17-year-olds. A platform cannot pause its current age assurance work while waiting for the regulations.

The standard at the gate. Ofcom notes that the Government chose highly effective age assurance, a stronger test than the reasonable steps duty applied in Australia. For platforms this means the check must meet Ofcom's four criteria, and existing adult accounts may skip a check only where the platform already holds accurate and reliable age information.

Banks as age sources. Banking-based checks draw on the age a bank holds on record, with the user's consent. That record usually exists because the bank verified identity at account opening for customer due diligence. Reusing it for age checks is a new purpose, so banks offering it should document the lawful basis and share only an over-16 result.

Data protection by design. Ofcom says age checks at 16 involve personal data but can comply with data protection law, and that it worked with the Information Commission (formerly the Information Commissioner's Office). Under UK GDPR Article 5, data must be limited to what is necessary and kept no longer than needed. An age gate needs a yes or no answer, not a stored copy of a passport.

Reusable digital ID. The progress statement promises work on "reusable checks that confirm someone meets an age threshold". For providers this points towards certified, reusable credentials. Our explainer on the DVS trust framework 1.0 covers the certification route that already exists.

What is still uncertain, and where are the risks?

The largest risk in age assurance at 16 is that a privacy-friendly method list still funnels teenagers towards identity documents. Facial estimation needs a photo ID backstop, digital ID needs photo ID once, and most bank accounts were opened after an identity check. The final scope, exemptions, start date and Ofcom's guidance are not yet published.

Document concentration. If most 16- and 17-year-olds end up uploading a passport or licence image, platforms or their vendors hold a large new store of minors' identity documents. Recent leaks of document images, such as the Times Car breach, show what that store attracts.

Exclusion. The 150,000 figure comes from CitizenCard, estimated from a survey in schools that Ofcom describes as a non-representative sample of 8,459 16- and 17-year-olds, so the real number could be higher or lower. Ofcom notes that PASS cards are available free to 16- and 17-year-olds, the same proof of age scheme now accepted in digital form for alcohol sales. Every teenager without ID still faces an extra step that adults with a credit card do not.

Circumvention. Ofcom's rapid assessment states that "No age assurance method is completely resistant to circumvention". It suggests user reporting and age inference to catch children who bypass the gate. Ofcom will publish research on circumvention within twelve months of the ban taking effect.

Timing. The regulations need affirmative votes in both Houses. Ofcom cannot consult on its guidance for age assurance at 16 until they are laid, so a spring 2027 start is likely to leave platforms a short window between final guidance and enforcement.

App stores. Ofcom's separate report on children's use of app stores, published the same day and summarised in its announcement, found that the app stores it analysed rely on children self-declaring their age. App stores are not currently regulated under the Act, so a layered check at device or store level remains a policy choice for later.

How does the UK approach compare with Australia and the EU?

The UK plans the same age as Australia but a higher bar for the check. Australia requires reasonable steps and has applied that since 10 December 2025. The EU KIDS Act proposal would set 15 for autonomous accounts and would require certified zero-knowledge proofs. The UK names methods but leaves the technology to platforms.

Sources: Ofcom, the eSafety Commissioner, the Commission proposal COM(2026) 681 and our analysis of the EU KIDS Act proposal. eSafety states the Australian maximum as 300,000 penalty units for corporations, currently 109.2 million Australian dollars.

The contrast matters for multi-market platforms. A single global flow tuned to Australia's reasonable steps may fall short in the UK, and a UK flow built on document checks may not meet an EU rule that, as proposed, would demand zero-knowledge proofs.

How should compliance teams respond?

Teams should design for age assurance at 16 now, while the rules are still being drafted. Map where users aged 16 to 17 enter, choose at least two methods so users without ID have a route, and decide what each check retains. Then prepare evidence that the gate meets Ofcom's four criteria.

First, inventory every surface the regulations may name, including live streaming and contact from strangers, which the June announcement also targets and section 214A(4) lists alongside daily time limits and location sharing. Second, build a waterfall: facial estimation with a challenge age, then photo ID, digital ID or a bank check for users near the threshold. Third, set retention to the minimum, keep the age result and drop the document. Fourth, log each decision so you can show accuracy and circumvention controls when Ofcom asks. For the wider duty, our guide to age verification in the UK covers the existing Online Safety Act rules.

Zyphe's age verification is built for the third step and supports the fourth. It confirms an age threshold from a chip-read passport or reusable KYC passport, returns a result rather than a document copy, and keeps no central store of customer PII. To see it run against a 16 threshold, book a demo.

The bottom line

Ofcom has shown that age assurance at 16 is technically possible, and says itself that photo ID is part of, or the likely backstop for, every method. That makes the design of the check, not the choice of method, the real compliance question. Platforms that keep only the age result and offer more than one route will be ready when the regulations land; those that collect documents by default will carry a new store of minors' data into a regime that is still being written.

Cited sources

• Ofcom, How age checks at age 16 can work to underpin UK's social media ban, 29 October 2026
• Ofcom, Rapid assessment of highly effective age assurance at 16, 29 October 2026
• Online Safety Act 2023, section 214A, legislation.gov.uk
• UK Government, Growing up in the online world: progress statement
• UK Government, Social media to be banned for under-16s, 15 June 2026
• UK Government, June progress statement: letter from DSIT Secretary of State to Ofcom
• Ofcom, Age checks to protect children online, 16 January 2025
• eSafety Commissioner, Social media age restrictions
• European Commission, Proposal COM(2026) 681 (EU KIDS Act), EUR-Lex
• UK GDPR, Article 5, legislation.gov.uk