Age Verification Explained
What the Online Safety Act requires for age assurance, what methods platforms can use, and the privacy and legal considerations involved.
The Online Safety Act requires services that host pornographic content to use 'highly effective age assurance' to prevent children from accessing it. It also requires services likely to be accessed by children to use age assurance more broadly when assessing and mitigating children's risks. This guide explains what age verification actually means in practice, the different methods available, and the ongoing debate about privacy and technical feasibility.
What counts as 'highly effective' age assurance?
Ofcom's guidance sets out what qualifies as highly effective age assurance. Methods must be technically robust enough that a determined child cannot easily bypass them by lying about their age. Accepted approaches include: credit or debit card checks (on the basis that most children do not have independent card accounts); digital identity verification using government-issued ID; mobile network operator age checks; and face age estimation technology, which uses a device's camera to estimate the user's age without storing an image. A simple date-of-birth tick-box is not considered sufficient.
Key takeaway: A simple age tick-box is no longer enough — platforms must use technically effective methods that cannot be bypassed by lying.
Methods in practice: what you might see
Different platforms are implementing different approaches. Adult content sites may ask users to verify their age using a credit card, a digital ID service such as Yoti, or a mobile operator check. Face age estimation is increasingly used — your device camera estimates your age without storing the image. Some platforms use indirect signals: for example, checking whether you have a credit card registered to the account, or whether your mobile contract indicates you are over 18. The user experience varies significantly between services.
Key takeaway: Age verification looks different on different platforms — some use credit card checks, others use face estimation or digital ID.
Privacy concerns and how they are addressed
Age verification raises legitimate privacy concerns, particularly around identity data being shared with adult content platforms. Ofcom's guidance requires that age assurance methods must not require users to hand over more personal data than necessary. Face estimation technology specifically is designed so that the image is processed locally on the device and not stored or transmitted. The Information Commissioner's Office (ICO) oversees data protection compliance alongside Ofcom's online safety work.
Key takeaway: Privacy-preserving methods exist — face estimation does not require storing your image, and ICO oversight applies.
Legal challenges and ongoing development
Age verification requirements have faced legal challenges from free speech groups, particularly in relation to adult content platforms. The government's position remains that the online safety duties are proportionate and that the privacy-preserving methods available mean there is no conflict with human rights obligations. The age assurance technology market is evolving rapidly, and Ofcom updates its technical guidance as new methods become available. Implementation has been phased rather than immediate.
Key takeaway: Legal and technical debates continue — age assurance is a developing area, not a settled technical standard.
What this means for families
For parents, the practical impact is that sites carrying pornographic content are now legally required to verify age, meaning a child who stumbles across such a site should be prompted to verify before accessing content. This does not make circumvention impossible — children may use VPNs, shared accounts, or devices outside the home. Age assurance online should be seen as one layer of protection alongside device-level filters, network controls, and family conversation.
Key takeaway: Age assurance adds a meaningful layer of protection but does not replace parental controls or family conversations.
What the Act does
Requires services carrying pornographic content to implement highly effective age assurance.
Requires services likely to be accessed by children to consider age assurance as part of children's risk assessments.
Sets Ofcom as the regulator responsible for approving what counts as effective age assurance.
Allows for privacy-preserving methods that do not require storing biometric data.
What the Act does not do
Understanding the limits of the Act helps you set realistic expectations when using complaint and reporting processes.
Prescribe a single technical standard — platforms can choose from a range of approved methods.
Make circumvention impossible — VPNs, shared accounts, and off-device access remain possible.
Require age verification on all websites — the duty targets pornographic content and services with children's risk duties.
Practical steps
Ensure your home router or internet service provider's parental controls are active — these provide a layer of protection alongside platform-level age checks.
Check whether your mobile provider offers age verification at the network level for mobile data.
Talk to your child about why some sites require age checks and what they should do if prompted.
If you encounter a site that hosts pornographic content without any age check, you can report it to Ofcom.
Review any shared devices to ensure accounts are not logged in with adult credentials that a child could access.
Frequently asked questions
Does age verification mean sites will store my ID documents?
Not necessarily. Many age assurance methods — particularly face age estimation — are designed to work without storing any image or document. Where ID verification is used, reputable providers use encrypted, minimal-data approaches. Always check a service's privacy policy before submitting identity documents.
Can children get around age verification?
Determined older teenagers may attempt to use VPNs, borrow adult accounts, or use devices outside the home. No technical measure is foolproof, which is why Ofcom requires methods that are effective against a typical child rather than requiring perfection. Age assurance is one layer of protection, not the only one.
Sources and further reading
Related guides
Last reviewed: 19 April 2026
This is practical educational content to support families. For case-specific concerns about a child's safety, contact the NSPCC helpline on 0808 800 5000 or your local safeguarding team.
Was this page helpful?