Search every question across sub-FAQs

Treat the information notice as a controlled legal and evidence process. Maintain a live requirements matrix, give the named individual authority to direct business and technical teams, and escalate immediately when a requirement cannot be met as written or on time.

The response record should cover information held by vendors and overseas teams, data lineage, calculation methods, samples, source preservation, and whether Ofcom can understand any encrypted material. For a data-preservation notice, document how the hold prevents both deliberate alteration and routine irreversible deletion for the required period.

Evidence should show what the manager did, when, with what information, and how the team addressed problems. It cannot determine by itself whether all reasonable steps were taken; that conclusion depends on the full facts.

The answers below separate the statutory trigger from useful governance. They explain the general law, not whether an offence or defence is proved in a particular case.

Part 5 providers that publish or display regulated provider pornographic content must use age verification or age estimation that is highly effective at determining whether a user is a child, so children are not normally able to encounter that content. Those duties took effect on 17 January 2025.

For Part 3 user-to-user and search services, highly effective age assurance can support a conclusion at stage one of the children's access assessment that children cannot normally access the service or a particular part of it. Services likely to be accessed by children must also use highly effective age assurance where the child-safety duties or Ofcom's codes require it, including to protect children from pornography and other primary-priority content. The Part 3 child-protection measures applied from 25 July 2025.

Ofcom assesses the whole process, not the vendor label. Its criteria are technical accuracy, robustness, reliability, and fairness. The provider should test the method in the real user journey, including circumvention, repeat attempts, false acceptance of children, false rejection of adults, bias across relevant groups, outages, and the effect of fallbacks.

Methods can include open banking, photo identification matching, facial age estimation, mobile-network checks, credit-card checks, digital identity services, and email-based age estimation where the method meets Ofcom's guidance. No method is automatically compliant in every deployment. Ofcom's July 2026 report says age inference is not accepted as highly effective for services that must prevent child access unless the provider can support a different conclusion with reliable and compelling evidence.

Every age-assurance method processes personal data. UK GDPR and the Data Protection Act 2018 continue to apply alongside the Online Safety Act. The organisation must identify a lawful basis, use only data needed for the stated age decision, explain the processing, secure it, set retention limits, support rights, and assess processors and international transfers.

Complete a data protection impact assessment where the processing is likely to create a high risk to people. Connect it to the online-safety rationale so the record explains why the method and threshold are necessary and proportionate, what less intrusive options were considered, and how misclassification is corrected. The Children's Code may also apply to an online service likely to be accessed by children.