Compare age-assurance methods only after identifying the legal purpose, age threshold, protected content or feature, and required certainty. Where is required, test the complete deployed process rather than relying on a method name. This page covers the main method families, their practical trade-offs, the evidence to request, and the fallback a service needs when the primary method excludes a legitimate user.
1
Section 1
Which age-assurance methods should a service compare?
Choose from method families, not marketing labels. Methods based on can compare identity or age evidence, query authoritative records, or use relevant account attributes. Facial predicts an age or range; behavioural or usage signals infer likely age; and attestation relies on another party's statement. Each family has different coverage, error, privacy, security, and circumvention risks.
Compare methods at the exact threshold and in the complete user journey. Measure false-adult results (a child accepted as an adult) and false-child results (an adult treated as a child), performance near the boundary age, demographic variation, spoofing and repeat attempts, account sharing, fallback use, abandonment, accessibility, device requirements, geographic coverage, and the consequences of an error.
A document or database match may exclude users who lack the required record. Facial processes an image and returns an estimate rather than documentary proof. Payment or mobile-account data may describe the account holder rather than the person using the service. Treat each limitation as a test question and provide another route where the primary method excludes a legitimate user.
Ofcom's current codes and guidance, not a vendor's category label, determine whether a deployed method can satisfy a particular Online Safety Act duty. Check the current guidance for the duty, then retain implementation-specific evidence showing what the complete process does at the relevant threshold.
Ofcom's 2026 report rules out age inference as for pornography services and other services required to prevent child access. Behavioural inference needs a user to sign up and use the service before it can infer age, so it cannot protect the initial access point. For other child-protection uses, the report says services relying on inference should switch to methods listed as highly effective or provide reliable and compelling evidence that their method meets the standard.
A layered design can route clear low-risk results automatically and send uncertain cases to another method or review. The combination still needs testing as one system, with data minimisation, retention, security, vendor, and deletion controls for every layer.
Best fit: state the legal purpose, threshold, protected content or feature, required certainty, and acceptable error direction before comparing vendors.
Evidence: protocol, representative test population, threshold-specific results, attack testing, demographic analysis, accessibility findings, privacy assessment, and production monitoring.
Fallback: provide an equivalent route for users without a particular identity document, device, payment method, biometric capability, or credit history.
Decision: approve, layer, pilot, reject, or restrict the method, with an owner and review trigger.
Distinguishes inference for prevention of child access from other child-protection uses and calls for switching method or reliable and compelling effectiveness evidence.
2
Section 2
How should teams choose an age-assurance method?
Start with the duty and consequence of error. A control that must prevent children from a service or regulated content needs evidence that it reaches the applicable standard at the relevant threshold. A method used only to adapt an age-appropriate experience may have a different certainty requirement, but the decision still needs evidence.
Compare candidates on the same test population and journey. Include accuracy near the threshold, false-adult and false-child results, robustness, reliability, fairness, circumvention, accessibility, coverage, fallback, data use, retention, security, supplier dependencies, and monitoring. Record why rejected options failed these criteria.
Define the age threshold and whether the control needs verification, estimation, or a layered result.
For , document the decision boundary and test how uncertain results move to another method.
Test uncertain results, retries, fallback, appeals, account recovery, and downstream access enforcement.
Choose the method that meets the duty while limiting collection, disclosure, retention, and exclusion.
Record approval, residual risk, monitoring thresholds, and the events that require re-selection.
Evidence and ownership support for UK Online Safety Act.
If you are a service in scope of the OSA, you will need to consider applying age verification and age estimation where required by the OSA.
3
Section 3
Which access and exclusion edge cases should be tested?
Check shared and family accounts, logged-out access, embedded content, optional sign-up, alternate clients, VPN use, account recovery, users close to the threshold, and users who cannot use the primary document, device, biometric, payment, or database route.
Revisit the choice when the service adds content or features, changes the age threshold or downstream control, changes supplier or model, expands to a population not represented in testing, or monitoring shows bypass, error, exclusion, or unexpected retention.
Check whether the service is likely to be accessed by children, or is designed to keep children out.
Separate the safety aim from the data protection impact so the control does not collect unnecessary information.
Review any age assurance vendor to confirm who receives the data and for what purpose.
Treat any uncertainty as a review item, not as a reason to copy a previous decision unchanged.
Current joint-regulator source for preventing underage access where a service is not suitable for children.
your focus should be on preventing underage children from accessing your service.
4
Section 4
How should teams put the age-assurance decision into operation?
Create a decision record that names the service, statutory purpose, threshold, protected journey, chosen method, test evidence, fallback, downstream control, data flow, retention, supplier, privacy and security safeguards, owner, approval, and residual risk.
Monitor threshold-specific errors, bypass, repeated attempts, abandonment, fallback use, complaints, demographic disparity, and deletion failures. Set a named response when a threshold is crossed rather than waiting for a scheduled review.
Write the exact user journey or feature that needs age assurance.
State the selected method and why it is the least intrusive option that still works.
List the evidence used to support the decision, including policy notes, risk assessment, and implementation tickets.
Set a review trigger for product, vendor, or legal changes.
Current joint-regulator source for applying data-protection principles to the selected method.
You must also ensure that whatever method you choose, this complies with UK GDPR data protection principles.
5
Section 5
Which legal sources and final checks control the age-assurance choice?
Section 230 of the Online Safety Act supplies the binding definitions of and . The duty that triggers age assurance depends on the service and content, while current Ofcom codes and guidance explain the regulator's effectiveness expectations. ICO guidance and the joint Ofcom and ICO statement explain the separate data-protection duties that apply to personal data used by an age-assurance process.
Before approving a selection, confirm the current Ofcom code and guidance for the service and duty, then test the chosen process in the actual user journey. Record the decision threshold, uncertainty handling, bypass testing, privacy controls, accessibility checks, and evidence supporting the chosen method.
Do not treat a method name as an approval or prescribe an unsupported numerical buffer. Effectiveness depends on the deployed system, its configuration, the user journey, and the evidence that it meets the applicable legal duty and current regulator guidance.
Distinguishes inference for prevention of child access from other child-protection uses and calls for switching method or reliable and compelling effectiveness evidence.