Ofcom publishes inaugural age assurance report

Communications regulator Ofcom has published its first report assessing the use and effectiveness of age assurance technologies under the Online Safety Act 2023 (OSA). Drawing on evidence from the first six months since the OSA's child protection duties came into effect in July 2025, the report reveals that while age checks are being deployed at an unprecedented scale, further industry action is required.

These findings will underpin plans to require social media platforms to block under-16s from accessing their services. Ofcom will present a rapid assessment to Parliament by the end of October detailing how checks can verify if users are over 16, ahead of any potential restrictions being introduced in 2027.

The report highlights that no single method eliminates circumvention 100% of the time. Instead, Ofcom is advocating for multi-layered protections across devices, app stores, and operating systems. Some adult-focused techniques, like credit card checks, do not work for 16 and 17-year-olds. Ofcom has also ruled out age inference for minimum age enforcement, noting that it only works after a child has already accessed a service. As a consequence, the regulator warns that services that rely on age inference should switch to more effective methods immediately. 

Training Announcement: The IAPP Certified Information Privacy Technologist (CIPT) is a privacy-focused IT professional certification from the IAPP that addresses data protection requirements and controls in complex technical environments. It explores the data lifecycle, privacy risk models and frameworks, the principles of Privacy by Design, and the role of privacy-enhancing technologies within the organisation. Find out more.