UK Online Safety Act Age Assurance

Part 5 providers that publish or display regulated provider pornographic content must use age verification or age estimation that is highly effective at determining whether a user is a child, so children are not normally able to encounter that content. Those duties took effect on 17 January 2025.

For Part 3 user-to-user and search services, highly effective age assurance can support a conclusion at stage one of the children's access assessment that children cannot normally access the service or a particular part of it. Services likely to be accessed by children must also use highly effective age assurance where the child-safety duties or Ofcom's codes require it, including to protect children from pornography and other primary-priority content. The Part 3 child-protection measures applied from 25 July 2025.

Ofcom assesses the whole process, not the vendor label. Its criteria are technical accuracy, robustness, reliability, and fairness. The provider should test the method in the real user journey, including circumvention, repeat attempts, false acceptance of children, false rejection of adults, bias across relevant groups, outages, and the effect of fallbacks.

Methods can include open banking, photo identification matching, facial age estimation, mobile-network checks, credit-card checks, digital identity services, and email-based age estimation where the method meets Ofcom's guidance. No method is automatically compliant in every deployment. Ofcom's July 2026 report says age inference is not accepted as highly effective for services that must prevent child access unless the provider can support a different conclusion with reliable and compelling evidence.

Every age-assurance method processes personal data. UK GDPR and the Data Protection Act 2018 continue to apply alongside the Online Safety Act. The organisation must identify a lawful basis, use only data needed for the stated age decision, explain the processing, secure it, set retention limits, support rights, and assess processors and international transfers.

Complete a data protection impact assessment where the processing is likely to create a high risk to people. Connect it to the online-safety rationale so the record explains why the method and threshold are necessary and proportionate, what less intrusive options were considered, and how misclassification is corrected. The Children's Code may also apply to an online service likely to be accessed by children.