Ofcom has assessed 10 age-verification methods, identifying four capable of being highly effective at checking whether someone is 16 or older. The assessment examines how accurately and reliably these methods can verify a user’s age.
Age verification will be central to the UK’s planned 2027 social media ban for under-16s. In this article, we will take a close look at Ofcom’s findings, the challenges of age verification, and the UK government’s position on using VPNs to evade age checks.
How Does Ofcom Classify the 10 Age-Verification Methods?
Ofcom evaluated the methods against four criteria: technical accuracy, robustness, reliability, and fairness. It then classified them based on whether they could meet its effectiveness standards at age 16, age 18, or neither.
Four Methods Considered Highly Effective at 16 and 18
Ofcom identified four methods capable of meeting its standards at both age thresholds when implemented correctly:
- Photo ID matching: Compares a passport, driving licence, or another accepted photo ID with a live image of the person undergoing verification.
- Banking information: Uses age information held by a financial institution, with the user’s consent, to verify eligibility.
- Digital identity services: Allow users to verify their age through a digital identity provider and reuse that verification where supported.
- Facial age estimation: Analyses facial features to estimate age. Ofcom recommends a challenge-age threshold, with additional verification for users whose estimated age falls below it.
Three Methods Considered Highly Effective at 18 Only
Ofcom considers three additional methods capable of verifying adulthood, but not the lower age threshold of 16:
- Credit card verification: Uses credit card eligibility, generally restricted to adults aged 18 and over.
- Mobile network operator checks: Uses age-related information held by mobile network providers to determine adult status.
- Email-based age estimation: Estimates a user’s age using signals associated with their email address.
These methods may establish that someone is an adult, but they cannot reliably verify whether a 16- or 17-year-old meets the proposed minimum age.
Three Methods Not Considered Highly Effective at Any Age
Ofcom also identified three approaches that fail to meet its effectiveness standards:
- Self-declaration: Asking users to enter their date of birth or confirm their age.
- General contractual agreements: Relying on users to accept minimum-age requirements in a platform’s terms and conditions.
- Verifiable parental consent: Obtaining parental permission without independently establishing the user’s age.
Ofcom does not consider these methods reliable enough to qualify as highly effective age assurance. However, this does not mean they are prohibited for other purposes.
What Are the Challenges of Age Verification?
Implementing these age checks presents several challenges for both platforms and users. Some of them include::
Access to Photo ID
Ofcom found that 16- and 17-year-olds have fewer ways to verify their age than adults. Photo ID matching requires identification from the outset, while other methods may also depend on it. For example, banking checks typically rely on identity documents provided when opening an account, and facial age estimation may require a second check if the result is uncertain.
Around 150,000 people aged 16 and 17 in the UK have neither a passport nor a driving licence, according to Ofcom. For these users, obtaining a suitable photo ID may be necessary to access age-restricted services.
Personal Data Protection
Verifying age can involve processing identity documents, facial images or information held by a bank. Ofcom says these methods can be implemented in ways that protect privacy and comply with data protection law.
In its statement, the Information Commissioner’s Office (ICO) stressed that age checks must keep personal information safe and allow users to exercise their data rights. Platforms must also be clear about what personal information they collect, how they use it and how long they retain it.
Age-Check Circumvention
Ofcom acknowledges that no age-verification method can eliminate circumvention entirely. It points to measures such as letting users report suspected underage accounts and using age-inference models to identify people who may have bypassed an initial check.
Age inference uses signals from online behaviour to estimate age. It cannot replace an upfront age check because the person must already be using the platform for those signals to be available. Ofcom says platforms also need practical measures to identify and address attempts to bypass age checks.
The UK Government’s Stance on VPNs and Age Verification
In July 2026, the UK government confirmed that it would neither ban VPNs nor require age verification to use them. Its consultation response recognised legitimate uses of VPNs, including accessing online education and protecting sensitive communications.
Consultation respondents also warned that age restrictions on VPNs could compromise privacy, affect businesses and push users towards less secure services. However, the government maintains that online platforms must take steps to prevent, detect and respond to children circumventing age checks, including through VPNs.
To address this, it separately commissioned Ofcom, with input from the Information Commissioner’s Office (ICO) where necessary, to research how platforms can identify VPN traffic and prevent children from bypassing restrictions.
The government also plans to work with VPN providers on voluntary child-safety measures and publish practical guidance for parents. It has also left open the possibility of further action if evidence shows that circumvention is not being adequately addressed.
What Happens Next?
The UK government plans to introduce its first set of regulations for the proposed social media ban before Parliament by the end of 2026. The restrictions are expected to take effect in spring 2027, subject to parliamentary approval.
Once the regulations are presented, Ofcom will consult on guidance explaining how platforms should implement highly effective age checks for users aged 16 and over.
Ofcom has also stated that it will be ready to check compliance when the restrictions take effect. Until the regulations and guidance are finalised, the specific requirements for platforms remain subject to further decisions.
Arsalan Rashid
October 30, 2026
1 day ago
