UK Online Safety Act Age Assurance

Ofcom uses age assurance as the collective term for age verification and age estimation. Under section 230, age verification verifies a user's exact age, while age estimation estimates a user's age or age range. The Act does not require one universal technique, and the method must be assessed against the duty it supports.

The main triggers differ. A children's access assessment may rely on highly effective age assurance when a provider seeks to conclude that children cannot normally access the service. Services likely to be accessed by children may need age assurance to apply child-safety measures by age. Services within the pornography duties must use highly effective age assurance to prevent children from encountering regulated pornographic content.

The current Ofcom code and guidance for the duty determine what highly effective age assurance requires. The complete process, including fallback and the downstream restriction, needs implementation-specific evidence; a supplier's product name or general accuracy claim does not establish compliance.

Age verification and age estimation can use different evidence and expose users to different privacy or exclusion risks. Compare candidate methods against the named duty, the relevant threshold, the actual population, the data collected, and the route offered when the primary method cannot produce a usable result.

Place the check before a user can encounter the protected content. If age estimation is used, document the decision boundary and route uncertain results to another method. Test previews, embeds, logged-out access, alternate clients, account sharing, recovery, and VPN or other foreseeable bypass routes.

Online-safety and data-protection duties apply together. Define the purpose, minimise the personal data used, assess lawful processing and children's interests, secure transfers and templates, limit retention, control vendors, provide usable information, and offer an accessible alternative where the primary method excludes a user.

Product owns the user journey and downstream access control; safety and legal identify the duty and threshold; privacy maps processing and retention; security tests circumvention; accessibility and equality owners test exclusion; an accountable decision-maker accepts residual risk.

Evidence should show the service scope, statutory trigger, method and supplier, threshold-specific testing, attack testing, demographic performance, fallback, data flow, deletion, user information, complaints route, approval, and production monitoring.

Boundary issues arise where logged-out or embedded access bypasses the check, one account is shared, a user is near the threshold, a supplier cannot cover a population, an uncertain result has no fallback, or the same age signal is reused for another purpose.

Test every access path and state what happens after failure, retry, challenge, account recovery, supplier outage, or a change in the age result. A successful age check is ineffective if the downstream content or feature gate can be bypassed.

Use a workflow that starts with the statutory purpose and ends with a tested downstream restriction. Capture service scope, user groups, children's-access and risk-assessment links, method choice, data flow, fallback, test results, owner, approval, monitoring, and escalation.

The output should include a decision record, method test pack, privacy and security assessment, implementation evidence, monitoring plan, complaint route, and change trigger.

Section 230 of the Online Safety Act supplies the binding definitions of age verification and age estimation. Ofcom uses age assurance as the collective term for those methods. The duty that triggers age assurance depends on the service and content. Current Ofcom codes and guidance explain the regulator's effectiveness expectations, while ICO guidance and the joint Ofcom and ICO statement explain the separate data-protection duties.

Confirm the current Ofcom code and guidance for the service and duty before relying on a control design. Keep the version and date reviewed with the decision record.

Assess the deployed system and user journey instead of relying on a generic method approval list or an unsupported numerical buffer. Record the performance evidence, decision threshold, uncertainty handling, bypass testing, privacy and security controls, accessibility checks, and reassessment triggers.