Age assurance has moved from a product and compliance issue to a board-level governance priority. Across the UK and Europe, regulators and policymakers are placing greater emphasis on how digital platforms identify users’ ages, control access and apply appropriate safeguards for children.
For leadership, legal, policy and product teams, the challenge is to ensure that age assurance measures adopted are legally robust, proportionate and workable in practice. Decisions can affect regulatory and reputational risk, liability, user experience, vendor selection and how services are offered across markets.
The chart below is designed as a practical starting point for those trying to navigate this complex topic. Developed by Osborne Clarke lawyers across Europe as a practical snapshot of a fast-moving area, it highlights where specific UK and EU-wide legal frameworks (whether current or proposed) expressly require, or set a strong regulatory expectation of, the implementation of age assurance on digital platforms.
Note: This chart summarises existing and proposed UK and EU-wide legal requirements for digital platforms under platform, content and privacy laws (as at mid-October 2026).
It is not intended to cover: (i) product sales requirements or payments laws that may be relevant to, for example, marketplaces or e-commerce platforms; (ii) other regulatory frameworks which do not expressly require digital platforms to implement age assurance; (iii) services which are dedicated to the hosting/dissemination of content harmful to children (e.g. pornography sites); or (iv) requirements applying specifically to operating systems or app stores.
Request a PDF copy of the chart.
What is age assurance?
‘Age assurance’ is an umbrella term for the range of tools and techniques that online services can use to establish whether a user is above or below a certain age. Age assurance methods can generally be grouped into three categories:
● Age verification is the most robust form of age assurance. It relies on hard identifiers such as official identity documents, credit card checks, or mobile network operator data to establish a user's exact age with a high degree of certainty. Importantly, it can be designed to confirm only whether a user is above or below a particular age threshold, without sharing any other personal data with the service provider. In the UK, for example, age verification is capable of being a form of as "highly effective age assurance", assuming it is implemented in a manner that is technically accurate, robust, reliable, and fair, amongst others. Age verification is generally considered most appropriate for the highest-risk content and features.
● Age estimation sits in the middle of the spectrum. Rather than confirming a user's age, it uses indirect signals to estimate whether a user is likely to be above, below or within a given age range. These signals can include facial analysis, behavioural data, how a user interacts with a device compared to others of the same age, or metrics derived from motion analysis or knowledge testing. Age estimation is generally considered appropriate for medium-risk scenarios.
● Self-declaration is the least reliable method. It simply requires a user to state their age or confirm they meet an age threshold, without providing any supporting evidence. Regulators generally consider self-declaration insufficient on its own to meet robustness and accuracy requirements, though it may still play a limited role, for example, where a user declares themselves to be below the relevant threshold, triggering the most protective settings automatically.
The right level of age assurance for any given service will depend on the nature of the content or features being offered, the risks involved, and the specific legal framework that applies. Where age assurance is required, regulators increasingly expect services to offer more than one method and to provide a way for users to challenge an outcome they believe is incorrect. A recurring theme across regulatory guidance is that the more reliable the method, the greater the potential privacy impact, meaning that proportionality is key.
How to approach age assurance?
Age assurance is increasingly relevant for a wide range of digital platforms, including:
- Social media platforms
- Video-sharing platforms
- Online gaming services
- Virtual worlds and immersive environments
- Messaging services
- Dating apps and sites
- AI-powered products and services
- Online communities and forums
Although policymakers are seeking greater consistency across territories, for example throughout the EU with the proposed EU KIDS ACT, digital platforms are still having to reconcile requirements arising from numerous legal frameworks across different territories. Platforms operating across multiple jurisdictions may need to tailor user journeys, access controls and safeguards by market, particularly where local rules or regulatory expectations differ.
They will need to understand where children may access their services, assess the level of risk and put proportionate safeguards in place. They should also monitor proposals that may be introduced, amended or withdrawn quickly as political and regulatory pressure continues to build.
Age assurance is not a one-off compliance exercise. As legislation, guidance and enforcement priorities evolve, organisations will need to keep their position under review and adapt products, controls and governance processes accordingly.
To explore how age assurance may affect your organisation, please get in touch with one of our experts.
