UK online safety: Ofcom assesses highly effective age assurance methods as online services prepare for new restrictions for under-16s

Distinguishing a 15-year-old from a 16-year-old through digital age assurance is not straightforward. Ofcom's rapid assessment, published on 29 October 2026, considers which methods could meet "highly effective age assurance" (HEAA) requirements at age 16. The government has said these requirements will underpin its proposed social media restrictions for under-16s and other age-related restrictions on risky features and functionalities. Ofcom concludes that HEAA can indeed be used to determine whether someone is 16 or over.

The assessment builds on Ofcom's existing HEAA guidance at age 18 for Part 3 services under the Online Safety Act 2023 (OSA), which sets out seven age assurance methods capable of being highly effective at 18. However, it is a preliminary assessment only, to inform parliamentary debate on the legislation to implement the new restrictions.

What makes age assurance highly effective?

Ofcom has based its assessment on the criteria and principles set out in its HEAA guidance for 18, looking at the whole process, not simply the technology selected. Providers must also ensure that whichever age assurance method they choose to use, it fulfils the same technical criteria and takes account of the same principles. The four technical criteria are:

• Technical accuracy: the degree to which a particular method, which should perform against appropriate metrics and be reviewed for improvements periodically, can correctly determine age under test lab conditions.
• Robustness: the degree to which a method can correctly determine age in practice, including steps taken to mitigate any circumvention techniques that children might use.
• Reliability: the degree to which the age output is reproducible and derived from trustworthy evidence, including, where AI is used, appropriate steps taken to ensure it is regularly tested, monitored and assessed and that any data relied on comes from a trustworthy source.
• Fairness: the extent to which an age assurance method avoids or minimises bias and discriminatory outcomes, including, where AI is used, ensuring the technology is trained and tested on diverse population data to minimise bias or discriminatory outcomes.

The principles of accessibility (the ability of a method to work for all users with a wide range of characteristics, and physical and intellectual abilities) and interoperability (the ability of the system to communicate with other systems and share information in line with data protection laws) must also be considered.

Which methods could work at 16?

Ofcom identifies four methods capable of meeting HEAA requirements at 16, compared with the seven assessed to be highly effective at age 18: 

• Photo-ID matching. 
• Digital identity services.
• Banking-based checks.
• Facial age estimation.

It is a non-exhaustive list and Ofcom acknowledges that new and innovative solutions may emerge in the market once the new age restrictions are in effect. 

The least robust of the four approved methods is facial age estimation, which Ofcom finds has a margin of error, particularly significant near the 16-year threshold. Providers choosing this option should therefore also set a "challenge age" above the minimum age (a higher age threshold below which users must complete an additional check), based on the margin of error of the technology being used, and require further assurance where necessary if the user appears to be below this challenge age. Ofcom suggests a challenge age of 19 for a 16-year threshold.

Ofcom finds that credit-card checks, mobile-network operator checks and email-based age estimation can support checks at 18, but cannot currently reliably distinguish 16- and 17-year-olds from younger children. They can nevertheless offer adults additional routes to demonstrate eligibility, since establishing that someone is over 18 also establishes that they are over 16. 

Other insufficient methods rejected by Ofcom include, unsurprisingly, self-declared birthdays, which the OSA already establishes are not effective for determining if a user is over 18, and contractual age restrictions included in a service's terms and conditions or in any general disclaimer on the service. Ofcom also considers verifiable parental consent (where a parent or carer undergoes an age check to approve a child's access to a platform) in its current form, to be insufficiently robust at 16. Even if the parent-child relationship can be verified, there is evidence to suggest that some parents may provide incorrect age information to assist a child to bypass age restrictions. Behavioural age inference also cannot act as an initial age-gate because it requires users to interact with the service first, although it may help detect users who manage to bypass initial checks.

Challenges for children

Ofcom acknowledges the practical consequence that, unlike checks at age 18, all approved methods for checks at 16 years involve photo ID, either as part of the method itself or as a backstop for other methods, such as facial estimation. 

Evidence cited by Ofcom suggests around 150,000 of 16- to 17-year-olds hold neither a passport nor a driving licence, although other documents, including ID cards certified by the Proof of Age Standards Scheme (PASS), may offer alternatives. Around 90% have a bank account, but banking-based checks also depend on which banks have bank-based age assurance solutions by the time the regulations come into effect.

Circumvention

Ofcom recognises that no age assurance method completely eliminates circumvention. However, using liveness detection and document-authenticity checks for photo-ID matching or appropriate retry limits if using facial estimation can strengthen safeguards. 

Ofcom also acknowledges VPN-related risks and suggests ways that services could mitigate such circumvention, such as enabling the reporting of underage users, but it does not require services to prevent VPN access. 

Adults also affected

Adults may also need to demonstrate that they are over 16. However, social media services will be able to use the wider range of methods approved for 18 years and over. If a service already holds accurate and reliable information, perhaps from the results of a previous highly effective age check or the length of time the user's account has been in existence, unnecessary repeat checks can be avoided.

Privacy 

Ofcom acknowledges that introducing age assurance at 16 will involve the processing of additional personal data and services will have to comply with data protection requirements. However, HEAA and privacy are not inherently incompatible and both Ofcom and the ICO are of the view that there are ways of ensuring compliance with data protection laws at the same time as deploying age checks. For example, Ofcom suggests that if using photo-ID matching, third-party providers do not have to share identifying information, but can instead simply confirm whether a user meets an age threshold. 

What else do services need to think about?

The government did not just announce restrictions on social media services for under-16s, but also safety defaults for 16- to 17-year-olds for certain features and functionalities. 

Although these latter restrictions will be coming into effect later than the social media restrictions for under-16s, they too will be underpinned by HEAA. This means that services in-scope of both sets of forthcoming regulations may need to operate age assurance processes to identify both under-16s and under-18s. Ofcom suggests that in this situation, an age verification method, rather than an age estimation method, will be more appropriate.

Osborne Clarke comment

Ofcom's rapid assessment provides a useful guide as to the general direction of travel, not least its conclusions that age assurance and privacy can work together. Nevertheless, it remains unclear exactly which services will be affected by the upcoming restrictions, and will therefore need to adhere to Ofcom's conclusions, until the new legislation is formally proposed. 

Implementing age checks will involve a considerable amount of work for all in-scope service providers, not least in choosing the right age assurance solution for the service. It will not be a one-off compliance exercise and will involve ongoing monitoring, testing and review.

In addition, the regulatory landscape is becoming increasingly fragmented in this area, with the EU seeking to introduce a different set of age restrictions across its member states through the EU KIDS ACT and other countries, including within the EU, attempting to forge their own paths. This necessarily adds further complexity for cross-border services, especially since different countries are developing different solutions for age assurance as well. Our UK and EU Age Assurance Chart aims to cut through some of these key age assurance issues. 

The government intends to lay initial regulations on the social media restrictions for under-16s by the end of 2026, after which Ofcom will consult on draft HEAA-at-16 guidance. Existing children's safety duties continue in the meantime unchanged. Providers should monitor the situation closely and start considering options for compliance.