What did Ofcom recommend on 29 October 2026?
Ofcom published a rapid assessment on 29 October 2026 of how social media platforms can reliably tell whether a user is 16 or over. The report is the technical groundwork for the government's plan to bar under-16s from the largest social apps from March 2027.
The regulator concluded that four methods can reach its “highly effective” standard. They are photo ID matching, digital identity services, checks built on banking information and facial age estimation. Traditional document checks remain part of the system, not a legacy option.
Deeside.com reported that the assessment puts photo ID at the centre. It is either the method itself or the likely fallback for the others, including facial age estimation. On that reading, people without a photo ID may need to obtain one to use age-restricted services.
Ofcom judged each method on four tests: technical accuracy, robustness, reliability and fairness. Those are the same criteria it applies to age checks at 18. Adults could also be offered three further methods that already appear in its guidance for 18-plus services.
The assessment does not settle policy. The government will consider the report, with a decision due by the end of the year, according to the BBC. The first regulations are expected to be laid before Parliament by the end of 2026, and Ofcom is drafting guidance to consult on once they are laid.
The choice of method matters beyond Whitehall. It decides who gets challenged, how much personal data changes hands and how easily a determined 15-year-old can slip through. The report is the closest thing yet to a specification for the UK's ban.
It also draws a line under a debate inside the regulator. Ofcom has argued for months that guessing age from account activity is weaker than checking it directly. Behavioural inference is not among the four methods in the new assessment.
Who will actually have to prove their age?
The checks will not be confined to teenagers. The BBC reported that many UK adults are likely to have to confirm they are not under-age through one of the proposed methods, which remain subject to government approval.
Ofcom said it had no firm estimate of how many adults would face a check. It conceded that a “large number of accounts” would need to be dealt with. That phrase matters for platforms planning sign-up flows at national scale.
The government's fact sheet sketches a narrower burden for some adults. Accounts open for more than 16 years, accounts with a credit card attached and accounts tied to an age-verified email address may not need a fresh check. Adults who already passed a check under the Online Safety Act would not repeat it.
Responsibility stays with the platforms. Meta has argued for checks at device or app-store level, which would shift the burden to Apple and Google. Apple introduced UK age checks with iOS 26.4 in March 2026, asking users to confirm adulthood with a credit card or an ID scan.
Apple's system can switch on web content filters for users who do not confirm their age. Ofcom called the move a “real win for children and families”. Device-level checks are not currently required by the Online Safety Act, and Ofcom says they would not remove a platform's own duty.
The practical effect is a layered system. A phone may check an age once, an app store may check it again, and a platform may still ask for a document. Each layer adds friction, and each creates another store of sensitive data.
For adults with long-standing accounts the change may be invisible. For anyone opening a new account, or returning after a long gap, the check will be the first thing they see.
Why are 16- and 17-year-olds the hardest age to verify?
Sixteen is an awkward threshold. People of that age can look older or younger than they are, and many hold none of the documents that make checks easy. The BBC noted that 16- and 17-year-olds may have no credit card, no full driving licence and no passport.
Banking checks rely on the date of birth a financial institution already holds. Whether banks will build a process for social media requests is unresolved. The BBC put the question to three of the UK's biggest banks and did not report a commitment.
Facial age estimation has improved enough for Ofcom to treat it as highly effective. It estimates age from a facial image, rather than deducing age from behaviour over time. That difference is central to the new report, and it is why the method can be applied at sign-up.
Digital identity services would let a user prove an age attribute without handing over a full document. Ofcom said the available methods can be deployed in ways that protect privacy. It also said it worked closely with the UK's data-protection regulator on the implications.
Photo ID remains the backstop. A standard adult passport costs £102 online, according to GOV.UK, and not every adult holds one. Obtaining a document takes money, paperwork and time, which is why the fairness test matters.
Ofcom's four criteria each test something different. Technical accuracy covers whether a method works. Robustness covers whether it survives tampering, reliability covers consistency, and fairness covers whether it works across groups. A method can pass the first three and still exclude people.
The age group also sits at the edge of the law's logic. The ban protects under-16s, but the checks must separate 15 from 16 with enough confidence to satisfy a regulator. That is a narrower margin than distinguishing a child from an adult.
How does the UK plan compare with Australia's ban?
The UK has borrowed Australia's model but not its legal test. Australia's ban began in December 2025. The UK government says its rules will capture user-to-user platforms that allow posting and use algorithms, and will exclude messaging services such as WhatsApp and Signal.
The BBC reported that ten of the biggest platforms will be covered, naming Instagram, TikTok and Snapchat. The government has also cited YouTube, Facebook and X. The final list will be set in regulations.
The standards differ. Australia requires platforms to take “reasonable steps” to stop under-16s. The UK requires “highly effective” age assurance, which ministers describe as a tougher test and which the Ofcom report is meant to define at 16.
Australia's first evaluation is a warning about enforcement. The eSafety Commissioner surveyed 803 children aged 10 to 15 and their parents. It found that 81.5% still used an age-restricted platform three months after the ban, down from 85.9% beforehand.
Account ownership fell from about 52% to 42%. More than half of the children said platforms had not asked them to confirm their age. Some 37% said they had simply listed an age of 16 or above, and 18% said a platform had over-estimated their age.
The commissioner concluded that reductions in use and account ownership had been “limited in scale”. It found early movement towards Reddit and Pinterest, and a 10% increase in the proportion of parents who did not know their child used social media. Logged-out access remained open.
That last point undercuts any simple claim that a ban removes access. Australia's law restricts accounts, not viewing. The UK's rules will face the same gap, and the regulations have not yet said whether platforms must gate logged-out browsing.
Ministers have responded by promising tougher enforcement. Lisa Nandy, the culture secretary, confirmed at Labour conference in September that the ban will take effect in March 2027.
Will age checks actually work?
Ofcom's own evidence cuts both ways. In its July 2026 statutory report, it said the share of children encountering highly effective age checks rose from 25% to 43% between July 2025 and January 2026.
It credited the pornography industry with compliance. All of the UK's top 10 porn sites had age checks in place, and Ofcom had opened 23 investigations covering 88 adult services. It also fined the operator of Fapello £630,000 in July for having no checks at all.
The fine had two parts: £600,000 for failing to introduce checks and £30,000 for not answering information requests on time. Earlier fines included £600,000 for YoungTek Solutions in May 2026 and £1.35m for another adult site operator.
Social platforms told a different story. Ofcom said many relied on “age inference” systems that guess age from account activity. The regulator argued that inference can only work after a child has signed up and used the service, which makes it unsuitable for a ban.
In July, Ofcom opened an investigation into TikTok's child age checks. TikTok said it was confident it met its obligations and would work with the regulator. The case is a test of how far behavioural signals can substitute for a direct check.
No method is airtight. Ofcom accepted that “the risk of circumvention cannot be entirely eliminated” and that some children will get past the checks. It wants platforms to take practical steps to detect and respond to evasion.
Enforcement has limits of its own. The BBC reported that Ofcom had never heard from a firm handed a £1m fine, and that a message board was refusing to pay a £520,000 penalty. A fine is only a deterrent if it is collected.
The wider picture is sobering. The Guardian reported that Ofcom's review of the first nine months of the child-safety duties found no significant change in the proportion of children encountering harmful content. Tougher age checks are meant to change that number, not just the sign-up page.
What are the privacy and civil-liberties objections?
Age assurance turns a browsing habit into an identity event. Every check processes personal data, and the most accurate methods depend on documents, faces, bank records or digital identity apps. Ofcom says the methods can be designed to collect only what is needed.
Critics see a larger shift. Silkie Carlo of Big Brother Watch described Apple's UK checks as a “chokehold on Britons' freedom to search the internet”. The objection is not only about children, but about routine identity checks for adults.
Exclusion is the other risk. A photo-ID backstop assumes everyone can produce a passport or licence. People without documents, or without the money and time to obtain them, could lose access to services their peers use.
The commercial layer matters too. Age-verification vendors have called for mandatory independent audits of platforms, arguing that fines can be treated as a cost of doing business. The companies selling the checks have an interest in making them compulsory.
Data protection law does not resolve the argument. Ofcom says the checks can comply, and it has worked with the information regulator. The proportionality question remains open: the system would verify many adults to protect a minority of children.
The device-level route sharpens the trade-off. A check at the operating system could spare users repeated document uploads, but it would also put a gate on the phone itself. Apple's UK rollout already shows how a software update can change what every user must do.
None of this is settled. The government has not published the regulations, and Ofcom's guidance is still in draft. The privacy terms of the final system will be written in those documents, not in the assessment published this week.
When does the ban start, and what happens next?
The next milestone is the regulations, due to be laid before Parliament by the end of 2026. They will set the platform list, the exemptions and the legal test that platforms must meet. Ofcom will then consult on guidance for complying.
The ban is due to take effect in March 2027. The government had previously said only “spring 2027”, before Nandy named the month. Platforms will have only a few months between the regulations and the ban, leaving little room for delay.
A second Ofcom report published on 29 October examined app stores. It is intended to inform a decision on whether app stores should be brought under the Online Safety Act. That decision could shift part of the verification burden onto Apple and Google.
Several questions remain open. Will photo ID really be required for adults without an existing account? Will banks participate? Will dedicated educational platforms be carved out, as the government has suggested? Each answer changes how many people face a check.
The 16- and 17-year-old measures add a second layer. From the same date, overnight curfews from midnight to 6am and switches for addictive features are due to apply by default to those ages. Restrictions on livestreaming and stranger contact will also apply by default.
Australia will publish further evaluations over two years, giving the UK a running comparison. The eSafety Commissioner's first report already suggests that removing accounts and reducing use are different goals.
For now, the evidence supports a narrow conclusion. Age checks can be made accurate enough to satisfy a regulator. Whether a ban changes what children actually do depends on enforcement, circumvention and whether the services they lose are replaced elsewhere.