UK Online Safety Act Age Assurance Selection Workflow

Step 1 - identify the duty and threshold. Record whether the service or relevant part is governed by Part 3 or Part 5, the content or feature being controlled, the age boundary, and the harm caused by a false-adult or false-child result. Under section 230, age verification verifies a user's exact age, while age estimation estimates a user's age or age range. The applicable duty may permit either method or both, but the complete process must satisfy the legal standard for that duty.

Step 2 - screen methods against the current Ofcom code and guidance for the duty. Do not infer that a method is highly effective from its name or a supplier's general accuracy figure. Record the evidence source, threshold, test population, known limitations, fallback, and access restriction for the deployed process.

Step 3 - assess privacy and inclusion before procurement. Map every data item, processor, retention period, deletion event, fallback route, and human-review step. A method can support online-safety compliance while still creating UK GDPR or equality risks. Provide an accessible route for users who lack a particular identity document, device, payment method, biometric capability, or credit history.

Step 4 - pilot the full system, not only the vendor component. Test enrolment, retries, the decision boundary where estimation is used, fallback paths, parental or guardian flows where appropriate, account recovery, appeals, and downstream access controls. Test foreseeable circumvention, repeat attempts, account sharing, VPN use, synthetic media, and spoofing where relevant. Approve the method only when evidence shows that the complete journey produces the required outcome.

The decision record should let a later reviewer reconstruct the choice. Record the exact age threshold and protected content, the required level of assurance, candidate methods, test population, error rates around the threshold, demographic performance, attack tests, fallback route, data fields, retention, processors, accessibility barriers, complaints route, and the person who approved the residual risk.

Review the method when Ofcom changes its guidance or codes, the service or threshold changes, the supplier changes its model or data flow, monitoring shows material error or circumvention, complaints identify exclusion, or the children's access or risk assessment changes. A scheduled review does not replace an immediate review after evidence that the control may no longer be effective.

Section 230 of the Online Safety Act supplies the binding definitions of age verification and age estimation. The applicable duty and start date depend on the service and content. Current Ofcom codes and guidance explain the regulator's effectiveness expectations, while ICO guidance and the joint Ofcom and ICO statement explain the separate data-protection duties.

Confirm the current Ofcom code and guidance for the service and duty before approving a method. Keep the version and date reviewed with the decision record.

The workflow must assess the deployed method and user journey instead of relying on a generic approval list. Record the performance test, decision threshold, uncertainty handling, bypass testing, privacy and security controls, accessibility checks, and evidence supporting the final choice.