UK Online Safety Act Age Assurance Options

Choose from method families, not marketing labels. Methods based on age verification can compare identity or age evidence, query authoritative records, or use relevant account attributes. Facial age estimation predicts an age or range; behavioural or usage signals infer likely age; and attestation relies on another party's statement. Each family has different coverage, error, privacy, security, and circumvention risks.

Compare methods at the exact threshold and in the complete user journey. Measure false-adult and false-child results, performance near the boundary age, demographic variation, spoofing and repeat attempts, account sharing, fallback use, abandonment, accessibility, device requirements, geographic coverage, and the consequences of an error.

A document or database match may exclude users who lack the required record. Facial age estimation processes an image and returns an estimate rather than documentary proof. Payment or mobile-account data may describe the account holder rather than the person using the service. Treat each limitation as a test question and provide another route where the primary method excludes a legitimate user.

Ofcom's current codes and guidance, not a vendor's category label, determine whether a deployed method can satisfy a particular Online Safety Act duty. Check the current guidance for the duty, then retain implementation-specific evidence showing what the complete process does at the relevant threshold.

A layered design can route clear low-risk results automatically and send uncertain cases to another method or review. The combination still needs testing as one system, with data minimisation, retention, security, vendor, and deletion controls for every layer.

Start with the duty and consequence of error. A control that must prevent children from a service or regulated content needs evidence that it reaches the applicable standard at the relevant threshold. A method used only to adapt an age-appropriate experience may have a different certainty requirement, but the decision still needs evidence.

Compare candidates on the same test population and journey. Include accuracy near the threshold, false-adult and false-child results, robustness, reliability, fairness, circumvention, accessibility, coverage, fallback, data use, retention, security, supplier dependencies, and monitoring. Record why rejected options failed these criteria.

Check shared and family accounts, logged-out access, embedded content, optional sign-up, alternate clients, VPN use, account recovery, users close to the threshold, and users who cannot use the primary document, device, biometric, payment, or database route.

Revisit the choice when the service adds content or features, changes the age threshold or downstream control, changes supplier or model, expands to a population not represented in testing, or monitoring shows bypass, error, exclusion, or unexpected retention.

Create a decision record that names the service, statutory purpose, threshold, protected journey, chosen method, test evidence, fallback, downstream control, data flow, retention, supplier, privacy and security safeguards, owner, approval, and residual risk.

Monitor threshold-specific errors, bypass, repeated attempts, abandonment, fallback use, complaints, demographic disparity, and deletion failures. Set a named response when a threshold is crossed rather than waiting for a scheduled review.

Section 230 of the Online Safety Act supplies the binding definitions of age verification and age estimation. The duty that triggers age assurance depends on the service and content, while current Ofcom codes and guidance explain the regulator's effectiveness expectations. ICO guidance and the joint Ofcom and ICO statement explain the separate data-protection duties that apply to personal data used by an age-assurance process.

Before approving a selection, confirm the current Ofcom code and guidance for the service and duty, then test the chosen process in the actual user journey. Record the decision threshold, uncertainty handling, bypass testing, privacy controls, accessibility checks, and evidence supporting the chosen method.

Do not treat a method name as an approval or prescribe an unsupported numerical buffer. Effectiveness depends on the deployed system, its configuration, the user journey, and the evidence that it meets the applicable legal duty and current regulator guidance.