Control GuideAge Assurance

Age Assurance Options

Age assurance should follow the harm profile of the service and the age exposure decision.

Use stronger measures where the service carries pornography or very high child harm risk, and keep privacy, accessibility, and failure modes in the design review.

Back to main artifact Review sources

Author

Sorena AI

Published

Feb 21, 2026

Updated

Feb 21, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Feb 21, 2026

Updated Feb 21, 2026

Overview

Government implementation materials state that Ofcom published age assurance guidance for online pornography in January 2025 and that Part 5 services had to move immediately to robust age checks that meet that guidance. For broader UK OSA work, age assurance should be chosen only after the child access and child risk assessments are complete.

Section 1

Use the service risk to decide the strength of assurance

The right question is not whether age assurance is available. It is what level of assurance is needed to stop children reaching the harmful surface in question. Pornography and other extremely harmful content require a stronger answer than low-risk community features.

Age estimation, age verification, and layered models each have different privacy, usability, and evasion consequences.

Low to moderate risk: evaluate estimation or tiered access models carefully
High risk or pornography exposure: use robust checks that actually block underage access
Document why the chosen method is effective for the relevant harm path

Recommended next step

Turn Age Assurance Options into an operational assessment

Assessment Autopilot can take Age Assurance Options from turning this guidance into a repeatable review process to a reusable workflow inside Sorena. Teams working on Age Assurance can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Assessment workflow

Open Assessment Autopilot for Age Assurance Options

Start from Age Assurance Options and turn the guidance into owned tasks, evidence requests, and review checkpoints.

Explore next step

Talk to Sorena

Talk through Age Assurance

Review your current process, evidence gaps, and next steps for Age Assurance Options.

Explore next step

Section 2

Test privacy, accuracy, and inclusion together

The July 2025 strategic priorities statement pushes Ofcom toward effective deployment of age assurance while supporting continued innovation and privacy respectful standards. The ICO material also makes clear that age assurance cannot be separated from the wider child-data impact of profiling, consent, defaults, and transparency.

A method that produces high friction, exclusion, or excessive data retention can still fail the wider governance test.

Run a DPIA and document retention, deletion, and vendor boundaries
Measure false positives, false negatives, and easy bypass routes
Check accessibility for users who lack standard identity documents or devices

Section 3

Do not over-rely on legacy standards labels

PAS 1296:2018 was withdrawn on 5 January 2026, so it should not be treated as a current safe harbour by itself. It can still inform historical control thinking, but live programs should look at current regulatory guidance, measurable effectiveness, and newer standards work such as the IEEE child digital experience initiatives.

In practice, Ofcom and ICO readiness comes from evidence of effectiveness and governance, not from dropping a standards name into a vendor contract.

Review vendor claims against current regulatory expectations, not only certificates
Retest assurance methods after product, policy, or threat changes
Keep an exit plan if a chosen method fails on privacy, accuracy, or scale

Primary sources