Ofcom Says Age Checks at 16 Can Work. Its Own Assessment Shows What They Will Cost

If the UK goes ahead with a social media ban for under-16s, platforms will need a reliable way to tell a 15-year-old from a 16-year-old. Ofcom says that is possible today, with caveats. On October 29, 2026, the regulator published a rapid assessment of what “highly effective” age assurance looks like at 16, written to inform Parliament’s debate on the government’s proposed age restrictions.

The short version: Ofcom identified four methods it considers capable of being highly effective at 16. They are photo ID matching, banking information, digital identity services and facial age estimation. It also said there is less choice at 16 than at 18, that 16- and 17-year-olds are more likely to need a photo ID somewhere in the process, and that no method is completely resistant to circumvention.

Why an assessment at 16 is different

The UK already has a working standard for age checks at 18. Under the Online Safety Act, services that host pornography or certain harmful content must use highly effective age assurance to keep children out, and Ofcom’s guidance sets out the methods and criteria. We looked at how that has played out in enforcement in Ofcom’s age-check fines.

Moving the line to 16 is harder for practical reasons. Many adult checks rely on things teenagers do not have: credit cards, mobile contracts in their own name, long financial histories. Facial age estimation has to be accurate in a narrow band where faces change quickly. Ofcom based its assessment on the same four criteria it uses at 18: technical accuracy, robustness, reliability and fairness. It also considered accessibility and interoperability.

The four methods Ofcom considers capable at 16

1. Photo ID matching. The user uploads an identity document and a live image, and the service checks that they match and that the document shows the user is 16 or over.
2. Banking information. The user authorizes a check with their bank, which confirms age without sharing other account details.
3. Digital identity services. A trusted provider that has already verified the user’s age shares a yes-or-no answer.
4. Facial age estimation. Software estimates age from a face image. It does not identify the person, but accuracy near the threshold is the weak point, so photo ID is often the fallback.

Services could also offer adults over 18 the three extra methods listed in Ofcom’s existing guidance for age checks at 18. That helps older users but does nothing for the 16- and 17-year-olds the new rules are meant to sort.

The photo ID problem

Ofcom’s most important finding may be about access. Of the methods available at 16, photo ID is either part of the method or the likely backstop when another method is inconclusive. People without a photo ID will probably need to get one to use age-restricted services. That will fall hardest on teenagers who do not have a passport or provisional driving licence, and on families who cannot easily pay for one.

It also creates a privacy question. A system that routes many teenagers to a photo ID upload is collecting identity documents from minors at scale. Whether that is acceptable depends on how the checks are built, who keeps what, and for how long.

Privacy and the data protection regulator

Ofcom says age assurance at 16 will involve processing personal data, but that available methods can be deployed in ways that protect privacy and comply with data protection law. It worked with the Information Commission, the UK’s data protection regulator, on those questions. The Commission’s response welcomed the assessment and stressed that age assurance must keep personal information safe and allow people to exercise their information rights.

For services, that means two sets of rules apply at once. Ofcom will judge whether a check is effective. The Information Commission will judge whether it is lawful, proportionate and secure. Designs that minimize data, such as yes-or-no tokens from a digital identity provider, or zero-knowledge proofs of age, are likely to satisfy both more easily than designs that store documents.

Circumvention is expected, not exceptional

Ofcom is direct that no method is completely resistant to circumvention, and that services will need practical steps to identify and address attempts by children to bypass checks. Borrowed IDs, an older sibling’s face, VPNs and account sharing are all predictable. The regulator’s view appears to be that effectiveness is judged on the whole system, including detection and response, not just the moment of the check.

Ofcom also published a statutory report on children’s use of app stores, designed to inform whether app stores should be brought into the Online Safety Act. That matters because app-store-level age signals are one of the ways platforms hope to reduce repeated checks. Singapore has already tested that model, as our report on Singapore’s app store safety audit showed.

The international picture

The UK is one of several jurisdictions moving the age line for social media. The EU is considering its own approach, covered in our pieces on the proposed EU Kids Act and on DSA enforcement and age verification. In the US, California has signaled support for under-16 limits, as we reported in California’s under-16 debate. The methods Ofcom lists are largely the same ones vendors sell everywhere, so its findings will be read well beyond the UK.

What platforms should do before the guidance arrives

Ofcom will consult on draft guidance for highly effective age assurance at 16 in the coming months, once the government lays its draft regulations. Services that will be in scope can prepare now.

• Map which features or services would be restricted at 16 and which users would be affected.
• Compare vendors against Ofcom’s four methods and ask for accuracy data in the 14 to 18 age band specifically.
• Design for minimal retention: keep the result and the method, not the document or image.
• Plan a fallback path for users without photo ID, and document why it is still effective.
• Build circumvention detection and a review process into the system, not as an afterthought.
• Run a data protection impact assessment that covers the checks, the vendors and the retention settings.

Frequently asked questions

Is the under-16 social media ban law yet?

Not yet. Ofcom’s assessment was produced to inform parliamentary debate on the government’s proposed restrictions. The ban and its details depend on legislation and regulations still to come.

Does Ofcom require a specific method?

No. It has identified methods it considers capable of being highly effective. Services will choose, and will have to show their approach works.

Can facial age estimation be used alone?

It is one of the four methods, but Ofcom notes photo ID is often the likely backstop when estimation is inconclusive near the threshold.

Will services have to store ID documents?

Ofcom says methods can be deployed in privacy-protective ways. Data protection law favors keeping only what is needed, which usually means the result of the check, not the document.

When will the guidance be final?

Ofcom says it will consult on draft guidance in the coming months, after the government lays draft regulations. A final date has not been set.

Ofcom has shown that a 16-year-old line can be enforced with today’s tools. It has also shown the price: more teenagers handing over photo ID, more data to protect, and a system that will be tested daily by the people it is meant to keep out. Parliament will decide whether that trade is worth it. Platforms will have to make it work either way.