Ofcom has set out how it thinks the biggest social media platforms should check that their UK users are over 16, ahead of the under–16 social media ban coming into force in March 2027. The regulator has published recommendations covering the ten biggest platforms, including Instagram, TikTok and Snapchat, and it names four methods it considers “highly effective” at gauging age, in addition to traditional ID: photo ID matching, banking–based checks, facial age estimation and digital ID services.
What Ofcom has not done is just as significant. It has deliberately avoided telling platforms exactly how to do it. Chief executive Dame Melanie Dawes said the regulator had learned from introducing age checks for pornography sites, and from other countries’ experience, that prescribing a single method does not work. Responsibility for choosing and implementing checks sits with the platforms themselves. Ofcom’s role is to make sure the checks they choose are adequate.
The report now goes to the government, which is due to decide on the approved methods by the end of 2026. For the ten platforms in scope, the work is already under way. For every other UK business that runs a website, app or online community, this is a good moment to look at the direction of travel. Age assurance is becoming a normal part of the UK online landscape, and the expectations being set for the largest services tend, over time, to shape what customers, partners and regulators expect from everyone else.
The four methods Ofcom recommends
Ofcom’s report describes four approaches, alongside checking traditional identity documents, that it says would be highly effective at telling whether a user is over or under 16.
Photo ID matching
The user provides a photo identity document, and the service checks it against a live image of the person. The aim is to confirm both that the document shows someone over 16 and that the person presenting it is the person on the document, rather than an older sibling or a parent whose passport happened to be in a drawer.
Banking–based checks
Here the service relies on age information that a financial institution already holds about the user. Banks verify identity when accounts are opened, so a check that draws on that information can confirm age without the user uploading a document to the platform itself.
Facial age estimation
Facial age estimation technology analyses an image of the user’s face to estimate how old they are. It does not need an identity document and does not, in itself, establish who the person is — only roughly how old they appear to be.
Digital ID services
Digital ID services let people prove who they are digitally, typically by setting up a verified identity once and then sharing selected attributes, such as being over a certain age, with services that ask. Our earlier coverage of digital ID being used for alcohol sales looked at how the same idea is reaching the high street.
Each method comes with trade–offs: how much personal data the user has to share, how many people can actually use it, how easy it is to get around, and how much friction it adds to signing up or logging in. Ofcom’s position is that any of them can work if done properly, provided the approach preserves privacy and protects people’s data.
“It’s on you”: why Ofcom chose not to prescribe
Dame Melanie Dawes was clear about the reasoning. “What a lot of countries did before us was say you need to do it this way and... it didn’t work,” she said. “So what we’ve said all along is here are things that can work, they must preserve privacy, they must protect people’s data, but it’s on you to put in place what you think works for you.”
That approach places the responsibility for implementation squarely on platform providers, not on Ofcom or the government. The regulator’s job is to make sure companies put adequate checks in place, not to mandate a specific technical method. In practice, that means each platform must choose, build or buy an approach, and be ready to show that it works.
Outcome–based regulation of this kind is familiar to anyone who has dealt with data protection. UK GDPR rarely tells an organisation exactly which technology to use; it sets out what must be achieved and expects the organisation to justify its choices. The same pattern is now being applied to age assurance, which means the quality of each platform’s reasoning and records will matter as much as the technology it picks.
To separate over–16s from under–16s, platforms will need a way to check ages across their whole UK user base, not just people opening new accounts. Ofcom acknowledged this would involve a “large number of accounts”. Many UK adults are therefore likely to be asked to confirm they are not under–age using one of these methods. Expect a wave of age–check prompts, and expect criminals to imitate them: messages asking people to “verify your age” via a link are an obvious phishing lure, and staff should be told that genuine checks happen inside the official app or website.
How we got here, and what happens next
The timeline below draws on the reporting around Ofcom’s recommendations. Where the coverage does not give a precise date, the step is marked as undated rather than guessed.
The gap between the government’s decision and the ban taking effect is short. If the decision lands at the end of 2026, platforms will have only a few months to finalise and roll out checks to millions of existing accounts. Most will not wait: the sensible course is to build on the four methods already named and adjust once the approved list is confirmed.
Comparing the approaches
The chart below is our indicative assessment — not an Ofcom rating and not measured data — of how much assurance each approach gives a typical UK service that wants to know whether a user is over 16. It is intended to help non–specialists understand the trade–offs, not to rank suppliers or products.
Two points stand out. First, the gap between the four recommended methods is smaller than the gap between any of them and self–declaration. A checkbox is not among the methods Ofcom recommends, and it offers almost no assurance. Second, device or app–store signals on their own score lower in our assessment, not because they are useless but because Ofcom has said they would not remove a platform’s own obligation to check.
The app–store argument
Some tech companies, including Meta, have argued that age verification should be handled at device or app–store level by Apple and Google. The case is easy to follow: a phone’s operating system or app store could confirm a user’s age once, and every app on the device could then rely on that signal rather than each running its own check. Users would face fewer prompts, and fewer companies would handle sensitive identity data.
Ofcom has not dismissed the idea, but it has been clear that device–level checks would not remove platforms’ own obligation to carry out checks as well. In other words, even if Apple and Google build age signals into their systems, Instagram, TikTok, Snapchat and the other platforms in scope will still need to demonstrate that they have adequate checks of their own.
For businesses outside the ten platforms, the debate is a useful signal. Age assurance is likely to become layered: some signals from devices and app stores, some from the service itself, some from third–party providers. Websites and apps that are built with that flexibility in mind will find it easier to adapt as the rules and tools settle down.
Circumvention: Ofcom’s candid admission
Ofcom has acknowledged that “the risk of circumvention cannot be entirely eliminated”. Some under–16s will very likely find ways around the checks. The regulator pointed to Australia’s earlier, similar ban as an example where many children found workarounds. The UK says it intends to take a tougher approach.
That candour matters. It sets a realistic expectation: the goal is checks that are robust and proportionate, not a system that nobody can ever get around. For platforms, that means monitoring for patterns of circumvention and improving over time. For parents, schools and employers, it means age checks are one layer of protection rather than a guarantee.
What it means beyond the big platforms
The recommendations are aimed at the ten biggest social media platforms. A typical UK small business website is not in scope of the under–16 ban, and nothing in Ofcom’s report requires a local retailer or professional services firm to add facial age estimation to its contact form. It would be wrong to suggest otherwise.
But the story still matters for any business running a website or app that could plausibly be used by under–16s. Separately from the ban, the Online Safety Act already places duties on many online services that let users share content with each other or interact, particularly where children are likely to use them. Whether and how those duties apply depends on what a service does, and it is worth taking proper advice rather than assuming. Businesses that sell age–restricted products online, run forums or community features, host user reviews with images, or operate apps aimed at young people should all be paying attention.
There are three practical reasons to watch closely even if your business is clearly out of scope.
Customer expectations shift
When millions of UK adults are asked to prove their age to the largest platforms, they become familiar with what good age assurance looks like — and with what a clumsy, intrusive one looks like. Businesses that need to check ages for their own reasons, such as selling alcohol, knives, vapes or age–rated games online, will be judged against that experience.
Suppliers and tools mature quickly
The demand created by the ban will accelerate the market for age–assurance services. Photo ID matching, facial age estimation, banking–based checks and digital ID will all become easier to integrate into ordinary websites and apps through established providers. That is good news for smaller businesses that need checks, because it reduces the temptation to build something homemade.
Data protection risk rises with every check
Age checks involve personal data, sometimes highly sensitive data such as identity documents and facial images. Ofcom has been explicit that methods must preserve privacy and protect people’s data. Any business that adds an age check must think about what it collects, where it is stored, who processes it and how long it is kept. Our report on the ICO’s fine against TikTok over children’s data shows how seriously UK regulators treat the handling of young people’s information.
Readiness score card for UK websites and apps
The score card below rates common positions for UK businesses whose websites or apps could be used by under–16s. It is a judgement framework to support conversations with your web team and advisers, not a legal assessment.
The “Weak” rows share a theme: they either collect sensitive data without the safeguards to protect it, or they provide no meaningful assurance at all. Storing scanned passports on a small business web server is a particularly poor combination — it creates a valuable target for attackers while doing nothing that an established provider could not do more safely.
What it costs to add age assurance to a website
The figures below are indicative ranges for a smaller UK business adding age assurance to an existing website or app. They are planning estimates rather than quotations, and they depend heavily on volumes, the method chosen and how the site is built.
| Item | Indicative one–off cost | Indicative ongoing cost | Notes |
|---|---|---|---|
| Scoping: does the service need age checks, and where? | £500–£2,500 | Reviewed when the service changes | Often the most valuable step; some businesses find they need less than they feared |
| Integration with an age–assurance provider | £2,000–£10,000 | Provider fees, usually per check | Covers sign–up, checkout or gated content flows |
| Per–check provider fees | None | Pence to around a pound per check, depending on method and volume | Estimation methods are generally cheaper per check than document–based ones |
| Data protection impact assessment and privacy notice updates | £750–£3,000 | Annual review | Essential where facial images or ID documents are involved |
| Accessibility and user–experience testing of the new flow | £500–£3,000 | After major changes | Reduces drop–off and makes sure alternative methods are available |
| Security hardening of the website and admin accounts | £1,000–£5,000 | £50–£300 per month in maintenance | Age checks raise the stakes if the site is compromised |
| Cyber Essentials certification | A few hundred pounds upward, depending on organisation size | Annual renewal | Baseline controls for the systems around the website |
The biggest hidden cost is usually not the technology. It is lost customers when a check is confusing, slow or appears untrustworthy. A well–designed flow that explains why the check is needed, offers more than one method and hands off cleanly to a recognised provider protects conversion as well as compliance.
Platform checks versus device–level checks
Checks run by each platform
What Ofcom expects the ten platforms to do
Checks at device or app–store level
What Meta and others have called for
The likely outcome is a combination. Device signals may become one input among several, but each platform will still need its own checks to satisfy Ofcom. For website and app owners, the lesson is to avoid designs that depend on a single source of age information.
How ready are smaller UK websites?
The gauge below is our indicative estimate of how prepared a typical smaller UK business website or app is to add robust, privacy–preserving age assurance if it needs to. It is a judgement based on the patterns in the score card, not a survey result.
A score of 28 reflects a common picture: many sites were built years ago on templates or plugins, with age controls limited to a checkbox or a date–of–birth field, and with little thought given to how a third–party verification step would fit into sign–up or checkout. Moving that score does not require rebuilding everything, but it does require a clear view of where checks are needed and a site architecture that can accommodate them.
If your business needs age checks, integrate an established age–assurance or digital ID provider rather than collecting passports or selfies yourself. Ask the provider to return only the answer you need — “over 16” or “over 18” — not the underlying document or image. That reflects Ofcom’s emphasis on privacy and data protection, keeps sensitive data off your own systems and makes your website a less attractive target.
Analysis: outcome–based rules put the burden on design
Ofcom’s refusal to prescribe a method is, in one sense, a gift to the platforms: they get to choose the approach that suits their users and their technology. In another sense, it is a heavier burden. A prescriptive rule can be followed; an outcome must be achieved and defended. Each platform will need to explain why its chosen checks are adequate, how they protect privacy and data, and what it is doing about circumvention.
That shifts the hard questions from “which box do we tick?” to “how do we design this well?”. Good age assurance is a product and engineering problem as much as a compliance one. It touches sign–up journeys, account recovery, support processes, data retention, accessibility and security. The platforms that handle it well will be those that treat it as part of the service rather than a bolt–on.
The same logic applies further down the market. Businesses that need age checks for their own reasons — selling age–restricted goods, running community features, offering services aimed at young people — will increasingly be measured against the standard the largest platforms set. A clumsy, intrusive or insecure check will stand out.
The privacy tension is real
Checking the ages of a large number of accounts, including adults, means a great deal of personal data flowing through age–assurance systems. Ofcom has insisted that methods must preserve privacy and protect data, but every additional check is another opportunity for a breach or misuse. Approaches that share only the minimum — a yes or no answer to “is this person over 16?” — are better aligned with that principle than those that pass around full identity documents.
The security tension is real too
Large–scale age verification creates new opportunities for criminals. Fake “verify your age” messages, cloned verification pages and fraudulent apps claiming to help users pass checks are predictable. Businesses should brief staff, and consumer–facing firms may want to remind customers that they will never be asked to verify their age through an unsolicited link. Our coverage of the BT email password reset attack shows how quickly attackers exploit any process that asks users to act on a message.
The tougher approach still has limits
The UK says it intends to be tougher than Australia, where many children found workarounds. Ofcom has been honest that the risk of circumvention cannot be entirely eliminated. The ban will reduce under–16s’ access to the largest platforms; it will not remove it. Parents, schools and businesses that work with young people should continue to treat online safety as a shared responsibility rather than assume the checks will do the job alone.
At a glance
| Item | Detail |
|---|---|
| What happened | Ofcom published recommendations on age checks for the UK under–16 social media ban |
| Who is covered | The ten biggest social media platforms, including Instagram, TikTok and Snapchat |
| Recommended methods | Photo ID matching, banking–based checks, facial age estimation and digital ID services, in addition to traditional ID |
| Ofcom’s stance | Not prescriptive; methods must preserve privacy and protect data |
| Who is responsible | The platform providers, not Ofcom or the government |
| Adults affected | Many UK adults are likely to need to confirm their age; Ofcom acknowledged a “large number of accounts” |
| Device–level checks | Called for by Meta and others; Ofcom says they would not remove platforms’ own obligations |
| Circumvention | Ofcom says the risk “cannot be entirely eliminated”, citing Australia’s experience |
| Next step | Government decision on approved methods by the end of 2026 |
| Ban takes effect | March 2027 |
| For other businesses | Review whether under–16s use your site or app, and design any age checks for privacy and security |
For related coverage, see our reports on the ICO’s TikTok fine and age verification, digital ID for alcohol sales and what it means for businesses, Ofcom’s scrutiny of AI in telecoms customer service, the Supreme Court ruling on the data protection threshold and the BT email password reset attack.
Build age checks into your website the right way
If your website or app needs to check ages, we design and build flows that integrate established verification providers, keep sensitive data off your servers and protect conversion. We also review older sites to see where checks are needed and where they are not.
Talk to us about Web DevelopmentFrequently asked questions
Not sure whether your site needs age checks?
We review UK business websites and apps to work out whether under–16s are likely users, what checks are proportionate and how to add them securely without hurting the customer experience.
Talk to us about Web DevelopmentOfcom has drawn the outline and left the platforms to fill it in. For the ten biggest services, the next five months will be demanding. For everyone else, the message is simpler: age assurance is becoming part of the UK online landscape, and the businesses that design for privacy and security now will find the transition easiest.
Cloudswitched
London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.
