Ofcom report outlines highly effective age assurance for 16-year-olds

Communications regulator Ofcom has published a rapid assessment of how social media companies can reliably verify that users are aged 16 or over, ahead of the government's plans to enforce a national ban on under-16s using social media.

After the government announced the ban in June, the Secretary of State asked Ofcom to assess methods that meet a highly effective age-assurance standard, which Ofcom noted provides a stricter benchmark than the reasonable steps criteria applied in Australia.

Ofcom identified four methods currently capable of achieving this standard at age 16:

• Photo ID matching, which compares credentials such as a passport or driving licence against a live image. While 94% of 16-year-olds and over possess these documents, roughly 150,000 individuals aged 16 and 17 currently hold neither.
• Banking-based checks, which access existing financial age records with user consent. Approximately 90% of 16-17-year-olds hold a bank account.
• Digital ID services let users verify their age once using credentials and then prove it digitally without repeatedly presenting documents.
• Facial age estimation, which analyses facial features. Because technology at age 16 carries an error margin of a few years, Ofcom recommends a challenge age framework paired with secondary verification, mirroring retail Challenge 25 policies.

Ofcom acknowledged that young people without photo ID may need to obtain documents to pass checks or secondary verification. While existing adult accounts may bypass checks where platforms already hold reliable age data, many adults will still need to verify their age using wider options available at age 18 under existing Online Safety Act 2023 (OSA) guidance. Although behavioural age inference cannot act as a barrier to initial entry, it could help identify underage users who circumvent controls.

The regulator clarified that these processes can comply with data protection laws, and confirmed that it will continue to engage with the Information Commission (ICO). 

On the risk of circumvention, Ofcom noted that it cannot be entirely eradicated and that platforms must deploy mitigation measures, including user-reporting tools. 

A separate report, Ofcom noted that three-quarters of online children access the internet primarily via mobile apps, highlighting that app stores currently rely largely on self-declaration and could play a significant role in broader child safety frameworks.

In a statement responding to the news, Katie Searle, Director of Children's strategy at the Information Commission (ICO), welcomed the report, saying "Age assurance plays an important role in the ICO and Ofcom's shared goal of protecting children from harm online. However, it must be implemented in a way that keeps people's personal information safe and allows them to exercise their information rights.

"We are working closely with Government and Ofcom to ensure that data protection is considered as the new regulations are developed. This also complements our own work assessing how age assurance providers currently comply with data protection law.

"Social media and video-sharing platforms should already be putting in place appropriate age gates to ensure users under their current minimum ages – usually 13 - are not exposed to risks arising from the unlawful processing of their information.

"We urge all social media and video-sharing platforms to act now to protect underage users from harm."

A statement by Silkie Carlo, Director at Big Brother Watch, warned that the proposed ban is "a national ID system by the back door. Both the government and Ofcom have admitted that children will get around the ban, which means the real effect will be normalising adults and children alike to hand over their passports just to get online.

"Hundreds of thousands of people without ID, who tend to be poorer people, and many more who don’t want to risk handing their passports over to foreign tech companies will be locked out of huge parts of the internet. The plan will kill anonymity online, whilst the UK’s culture of speech policing is reaching a crisis point. The policy is painfully misguided, an Orwellian assault on free speech and privacy, and will make children no safer at all.

"The false illusion that children aren’t on social media will cause the companies to abandon all their child safety measures. The Government could be promoting meaningful safety measures and supporting parental controls that genuinely protect children, but instead they’re demanding government ID from the whole population just for uncensored internet access. It is authoritarian madness."

Training Announcement: Find out more about our range of independent accredited qualifications from BCS and IAPP. These include professional certifications for practitioners covering data protection and AI governance, information security and risk management, along with access to public information.