- Ofcom identifies four age assurance methods capable of being ‘highly effective’ at 16 or over – photo ID, digital ID, banking checks and facial age estimation
- By the end of 2026, Government will set out how the ban will work in practice
- Regulator will then consult on industry guidance and be ready to check compliance when the ban comes into force next year
Ofcom has today published its rapid assessment of how social media firms could reliably determine whether someone is aged 16 or over, ahead of Government and Parliament deciding how the UK’s social media ban will work in practice.
In June, the Government announced a social media ban for under-16s and said the use of highly effective age assurance by tech firms – a stronger test than the “reasonable steps” criteria applied in Australia – will be critical for the ban’s successful implementation in the UK.[1]
To help inform Parliament’s consideration of the Government’s forthcoming detailed rules for the ban, the Secretary of State asked Ofcom to carry out a rapid assessment of what highly effective age assurance could look like for determining whether someone is 16 or over.[2]
Four methods for age checks at 16
When we produced our age assurance guidance for platforms under the Online Safety Act last year, we set out seven methods capable of being highly effective at 18. However, there is currently less choice of highly effective methods at 16 than 18, as some options are only available to people aged 18 or over.
Our rapid assessment, published today, has identified four age assurance methods that are currently capable of being highly effective at determining whether a user is 16 or over: photo ID matching, digital ID services, banking-based checks and facial age estimation.[3]
Photo ID matching: This checks relevant information on a photo ID document – such as a passport or driving licence – and compares the photo on the document to a live image of the user captured during the age check. An estimated 94% of people aged 16 and over in the UK have either a passport or driving licence. Evidence suggests around 150,000 16- and 17-year-olds in the UK have neither.[4]
Banking-based checks: These access the information a financial institution has on record regarding a user’s age, with the user’s consent. People would typically need to provide ID to open a bank account, then use banking information as a more convenient method thereafter. Evidence suggests around 90% of UK 16- to 17-year-olds hold a bank account.
Digital ID services: These enable people to digitally prove who they are or information about themselves, such as their age. They can use a photo ID to verify their age with a digital ID service once, then use the digital ID services thereafter, reducing the need to access their photo ID repeatedly.
Facial age estimation: This analyses the features of a user’s face to estimate their age. Some technologies have a margin of error of a few years at 16. To account for the margin of error, services should take a ‘challenge age’ approach and use age verification as a second check in the same way retailers take a ‘Challenge 25’ approach when selling alcohol in real life.[5]
Given photo ID is either required as part of our recommended methods – or likely to be part of a second check – our assessment acknowledges that those 16-17 year-olds that do not yet have a photo ID would likely need to take steps to obtain one.[6]
Some adults with existing social media accounts will not need to complete an age check if the platform already holds accurate and reliable information to establish they are over the required age. That said, many adults are still likely to be asked by sites and apps to prove their age, using the wider range of methods at age 18 identified in our existing guidance.
Age checks at 16 will involve the processing of personal data. However, our assessment concludes that available methods can be delivered in a way that protects users’ privacy and complies with data protection law, and we will continue to work closely with the Information Commission in this respect.
Current age inference methods – which analyse a user’s online behaviour to estimate their age – cannot act as an age gate, as this involves a user already being on a platform. However, it may still have a supporting role to play as part of a wider age assurance system – for example, to help detect under-16s that have bypassed an age check.
Some circumvention inevitable, but services can mitigate risks
Social media platforms will need to implement highly effective age assurance in full, which includes taking measures to tackle circumvention by children. If implemented correctly, this should significantly reduce the likelihood of under-16s accessing restricted sites and apps.
However, the risk of circumvention cannot be entirely eliminated, and some children will succeed in bypassing age checks. We have identified some ways services could mitigate the circumvention risks – for example, enabling other users to easily report suspected underage accounts, and using age inference models.
We will monitor circumvention by children and publish research on this within twelve months of the ban coming into effect, to help inform any future actions by Government.
Dame Melanie Dawes, Ofcom’s Chief Executive, said: “This ban will shape the future of children’s lives online, so it’s important to get it right. It can work if social media firms do highly effective age checks properly, and we’ve set out ways that could be achieved. When it comes into force next year, we’ll be ready to take swift and firm action against any company that fails to comply.
“We should expect that motivated children will seek to bypass the restrictions – just like alcohol laws can’t completely eradicate underage drinking – but there’ll be ways for platforms to mitigate this risk. This will be a huge cultural shift for our society, so it’ll take time to adjust, and everyone will have a part to play.”
Next steps
The UK Government has said it intends to publish its first set of regulations for the ban before the end of 2026. We are already developing our draft guidance for platforms, and will consult on this as soon as the Government’s regulations are laid in Parliament.
App stores could make greater use of age checks to better protect children
While it will, unequivocally, be the responsibility of regulated services themselves to meet their current and future online safety duties – including by using highly effective age checks – a separate Ofcom report, published today, identifies that app stores could also have an important role to play.
Our research found that three quarters of children who use the internet reported that apps downloaded from an app store were their primary means of going online. However, all the app stores we analysed currently rely on children self-declaring their age, with only a small number using additional checks in limited circumstances.
App stores could do more to protect children online by making greater use of highly effective age assurance. To be effective, this would need to be supported by reliable information about the risks apps pose to children and well-designed protections that address those risks.
With app stores currently not regulated under the Act, our report raises important technical, policy and compliance considerations for Government, should it consider bringing app stores in scope of a future regulatory model.
We also maintain there is a need for continued innovation from the wider tech industry – including at a device and operating system level as well as app stores – to deliver better online safety outcomes for children and support service-level protections. Ultimately, a layered or whole-of-system approach may be most effective, avoiding any single point of failure and increasing public trust.
Notes to editors:
- The UK Government announced that it plans to use “the same model for a social media ban as Australia” but intends to “learn the lessons from Australia’s experience by introducing more highly effective age assurance measures to support compliance”.
- We have based our assessment on the criteria and principles set out in our existing guidance on highly effective age assurance at 18. We have therefore assessed methods against the criteria of technical accuracy, robustness, reliability and fairness, and considered the principles of accessibility and interoperability.
- The market may develop new and innovative solutions once new age restrictions are in place, and we will continue to monitor emerging developments in the market.
- Evidence provided to us by CitizenCard, estimated from a non-representative sample survey conducted in schools with 8,459 respondents aged 16 and 17.
- Illustration of a how a challenge age may work in practice:
- Sixteen and 17-year-olds can apply for a passport or provisional driving licence, or apply for a photo ID card certified by the Proof of Age Standards Scheme (PASS). There are PASS cards available for free to 16- and 17-year-olds, and in many cases it is possible for 16- and 17-year-olds to apply for one without holding an existing photo ID.
Related content