Ofcom has named the four age checks it believes can reliably tell a 16-year-old from a 15-year-old, ahead of the UK’s planned social media ban for under-16s. Every one of them eventually leans on photo ID, which means a lot more sensitive identity data moving through platforms and their suppliers.
What happened
On 29 October 2026 Ofcom published a rapid assessment setting out how “highly effective age assurance” could work at 16. The Secretary of State commissioned the work to inform Parliament before the Government sets out detailed rules for the under-16 social media ban it announced in June. Ofcom also published a separate report on how children use app stores.
The shortlist has four methods: matching a photo ID document against a live image, bank-based checks, digital identity services, and facial age estimation. Ofcom’s existing Online Safety Act guidance lists seven methods for checks at 18. Three of them (credit card checks, mobile network checks and email-based age inference) drop out at 16 because they depend on things normally only adults have.
The Information Commissioner’s Office, now operating as the Information Commission, responded the same day. Katie Searle, its director for children’s strategy, said age assurance must keep people’s personal information safe and allow them to exercise their information rights. She also reminded platforms that they should already be enforcing their current minimum ages, usually 13.
Not everyone welcomed it. Big Brother Watch director Silkie Carlo, quoted by The Register, called the plan “a national ID system by the back door”. The Government says it intends to publish the first regulations for the ban before the end of this year. Ofcom will consult on draft platform guidance once those regulations are laid, and expects the ban to take effect in 2027.
The detail
Ofcom is open about the limits of each method. Photo ID matching compares a passport or driving licence with a live capture of the user. Around 94 per cent of over-16s in the UK hold one of those documents, which still leaves roughly 150,000 16- and 17-year-olds with neither. Bank checks rely on the age a bank already holds, with the user’s consent, and about nine in ten people in that age group have an account. Digital ID services verify someone once and then vouch for their age with other services. The Register noted these were bypassed quickly once the adult content checks began.
Facial age estimation is the weakest near the threshold, because some tools are a few years out either way at 16. Ofcom suggests a “challenge age” approach, like Challenge 25 in pubs, where anyone who looks borderline is sent to a second, document-based check. In practice, photo ID becomes the fallback for all four routes.
Ofcom accepts that circumvention “cannot be entirely eliminated”. Its suggested mitigations include easy reporting of suspected under-age accounts and age inference models to find children who got past the gate. Ofcom will publish research on circumvention within a year of the ban starting. Adults are affected too: platforms with reliable age data may wave some existing users through, but many will be asked to prove their age.
The app store report found that three in four children online mainly use apps downloaded from a store. Every store examined relies mainly on self-declared age, and app stores sit outside the Act.
Why it matters for UK organisations
This is a regulatory story, but much of the risk is about security. Any service caught by the ban will have to choose and integrate an age assurance supplier, and most of those flows can end in someone uploading a passport, a driving licence or a selfie. A central store of identity documents linked to social media accounts is exactly what criminals look for, both for fraud and for extortion.
Two regulators will be looking at the same check. Ofcom will decide whether it works. The Information Commission will decide whether the processing is lawful, proportionate and secure. Ofcom believes the shortlisted methods can respect privacy and data protection law, but that depends on how each one is built. A design that keeps the scanned passport for months will struggle with the data minimisation and storage limitation principles, however well it keeps children out.
Smaller social services, their developers and the many small UK age assurance suppliers will all handle more children’s identity data. Supply chain assurance will matter as much as the check itself.
Expert view
In my experience, the riskiest part of any identity check is rarely the matching algorithm. It is everything around it: the storage bucket where uploads wait for review, the support console that shows an agent the document, debug logs nobody clears, and a third-party SDK sending images to a region nobody recorded. When we test onboarding and KYC journeys, those side paths are where the exposure usually is.
So my questions for any age assurance supplier are practical. What do you keep, and for how long? Does the platform get a simple yes or no token, or the document itself? Who on your staff can see raw images, and is that access logged and reviewed? Which subprocessors handle the data, and where? I would favour designs that return only an over-16 result, because data you never collect cannot leak.
Detecting children who slip through means profiling behaviour, and done carelessly that becomes a second sensitive dataset with its own retention and access problems. Big Brother Watch goes further than I would, but its warning about normalising document uploads is worth taking seriously. Users who get used to handing over a passport whenever a site asks are easier for phishing sites to fool.
What to do now
- Work out whether the ban will apply to you. Map restricted features and estimate how many users need checking.
- Start a data protection impact assessment early. Cover the method, the supplier, retention, and the fallback for users without photo ID, and use the regulator’s March 2026 open letter on age assurance as a benchmark.
- Collect as little as possible. Keep the outcome and the method used, not the document or the image.
- Do proper supplier due diligence. Ask for accuracy figures for the 14 to 18 age band, subprocessor lists and processing locations. Cyber Essentials Plus is a sensible minimum for a UK supplier handling this data.
- Apply Cyber Essentials controls to the integration. Log and restrict who can view uploads (user access control), harden storage and APIs (secure configuration), and keep SDKs patched (security update management).
- Plan for bypasses and breaches. Set retention and access rules for any under-age detection data, and add a compromise of your age assurance supplier to your incident response exercises.
- Enforce your current minimum age now. The regulator is clear that under-13 age gates are already expected.
Bottom line
Ofcom has shown that a line at 16 can be enforced with existing technology, but in almost every case that runs through photo ID. For UK platforms and their suppliers, this is a data security project as much as a compliance one. Those that build privacy-preserving checks now, and test them as hard as any payment flow, will face fewer problems from either regulator.
