Use of Age Assurance Report 2026

In just one year, age checks are being deployed at an unprecedented scale, ensuring the UK is at the forefront of global efforts to make online experiences safer for children, but the job is not done. As the UK prepares to introduce a social media ban for under 16s, more action from the tech industry is needed to further strengthen protections for children across the system.

This report assesses how sites and apps use age checks to protect children from online harm

Many online services are now required to use highly effective age assurance to determine whether users are aged 18 or over to comply with their duties under the Online Safety Act. Under the Act, Ofcom is required to produce this report assessing how regulated services have used age assurance and how effective it has been for the purpose of complying with their duties.

Our report draws on a broad range of evidence, with a particular focus on the first six months following the start of protection of children duties in July 2025.

This report presents our early findings across the pornography, social media and online dating sectors. It examines the impact of age assurance on children’s online experiences, identifies areas where progress has been made, and highlights where further action is needed to strengthen protections for children online.

What does this mean for planned age restrictions on social media for under 16s?

Today’s report shows that when implemented properly, highly effective age checks work, and they will be vital in underpinning future social media restrictions for under 16s.

In June, the UK Government announced its intention to require social media services to use highly effective age assurance to prevent under-16s from accessing their sites and apps. Ofcom will deliver to Parliament by the end of October a rapid assessment of how highly effective age checks could work in practice to determine whether someone is over 16. This will help inform parliamentary debate ahead of potential age restrictions coming into force in 2027, with guidance for services expected in the coming months.

A number of the issues that our report covers are relevant to our upcoming rapid assessment, and the broader discussion of restrictions for under 16s:

• There is no single age assurance method or process that eliminates the risk of circumvention. To make age checks more robust, there is a strong argument for layers of protections across the system. We expect to see further innovation from the whole tech industry - including app stores, operating systems and at device-level - to strengthen protections for children.
• While the methods that we set out as ‘highly effective’ in our guidance can be used to determine whether a user is an adult, some techniques such as credit card checks will not work for 16 and 17 year olds, and firms will need to use other methods.
• We have already ruled out age inference as highly effective age assurance for porn sites and other sites and apps that are required to prevent child access. Our view remains unchanged that age inference cannot be appropriate for the purposes of the ban or minimum age enforcement – because it can only be used after the child has signed up and used the service for enough time for the inference to be made. As such, sites and apps must strengthen their approach.

It’s also clear that to date, social media companies have failed to enforce their minimum age requirements properly. Together with our report findings, this shows that social media companies will need to take a more effective approach to ensure that any social media restrictions for under 16s work in practice.

As required by the Act, we are also looking at protections for app stores, and we will publish a statutory report on this by January 2027. 

Industry must take action to improve protections for children

In light of the evidence in our report, today we are calling on services to act to strengthen protections for children:

1. Pornography services without age checks must introduce highly effective age assurance without delay, in line with our guidance.
2. Following engagement, Google and Bing have agreed to work with Ofcom and other relevant stakeholders to explore practical solutions to address discoverability of porn services without protections via search engines. We welcome these efforts and encourage other search services and industry actors to work constructively with us to provide safer experiences for children.
3. Services that use age inference to comply with their child protection duties should switch to other methods listed in our guidance as highly effective without delay. If they don’t, they must be able to prove using reliable and compelling evidence to Ofcom that their current method is highly effective.
4. Services with age assurance in place must ensure it is highly effective without any further delay. Based on our evidence, we have identified three areas for improvement that we urge services to implement where relevant:

• Follow our HEAA guidance in full
• Conduct regular due diligence on any age assurance vendors you employ
• Comply with your privacy and data protection obligations

Services should consult our guidance on highly effective age assurance, review their existing age assurance process against these areas for improvement and implement improvements as a matter of urgency. Regardless of whether it is implemented by the service themselves or outsourced to a third-party vendor, it is the responsibility of the regulated service to ensure that the age assurance process is highly effective.

Ofcom continues to prioritise enforcement of existing protections for children under the Act. We will not hesitate to take enforcement action against services based on the risk of harm they pose, including focusing on porn sites which are growing their user numbers as a result of failure to put age checks in place. If they still fail to comply following enforcement action, we will use all the powers at our disposal.