Ofcom has set out the ways social media companies can check the ages of their users, as the Online Safety Act pushes platforms to keep children away from harmful material. For households, the practical effect is a new kind of prompt on apps and websites, and with it a fresh opening for scammers and a set of privacy decisions.
The methods on the table
The regulator's list covers facial age estimation, photo identification matching, open banking checks, credit card checks, mobile network operator checks, and digital identity services. Email-based age estimation also features. Each method asks users for a different kind of information, and each carries its own trade-off between convenience, accuracy and the amount of personal data handed over.
Simply asking users to tick a box to confirm they are adults is not enough under the approach Ofcom has outlined. Platforms are expected to choose methods that work in practice, and the regulator has indicated that the checks need to be accurate, reliable and fair. Companies can choose which of the listed methods to use, and some are likely to offer several so that users without a passport or a credit card still have a route in.
The checks apply most directly to services that carry material considered harmful to children. That includes social media platforms, where the pressure to prove age is greatest. Where a service cannot establish that a user is an adult, the expectation is that the user is shielded from the most harmful content rather than given full access.
Who is affected
Children are the group the rules are designed to protect, but adults will feel the change just as directly. Anyone who wants to keep using an affected service may be asked to prove their age, which means a new step when opening an app, signing in or reaching certain content. Parents and carers will also notice the prompts on shared devices and family accounts, and teenagers who currently use platforms freely may find some features restricted.
People without easy access to formal documents or bank products could face more friction. A household that relies on a single shared phone, or an adult who does not hold a card or photo identification, may find some methods closed to them. That makes the availability of alternatives an important part of how well the system works for ordinary users.
The scam risk
Any new routine that asks people to upload a photo, scan a document or link a bank account creates an opportunity for fraud. Scammers tend to copy the look of official prompts, and age checks give them a convincing pretext. A message claiming an account will be locked unless the holder verifies their age can be used to steer people toward fake pages that harvest identity documents, card numbers or banking details.
The risk is greatest when the request arrives unprompted, by text message, email or a pop-up outside the app itself. A genuine check is triggered when a person tries to use a service, not by a message from an unknown sender. Links in unexpected messages are a common route to fake verification pages, and going straight to the official app or website is the safer way to complete any check that is genuinely required.
Requests that ask for more than the check should need are another warning sign. Age verification does not require a person to hand over a password, a full set of card security details or a one-time passcode sent for a different purpose. A demand for any of these points to a scam rather than a legitimate check.
Privacy decisions for households
The range of methods means users will often have a choice, and the choice involves privacy. Some methods rely on a single image or a quick confirmation from a bank or mobile provider, while others involve sharing a government-issued document. Households may want to weigh how much information each option reveals, who handles it, and whether it is kept after the check is complete.
Many checks are carried out by outside specialist providers rather than by the social media company itself. Privacy notices and the explanation in the app should say what data is kept, for how long, and whether it is linked to an account. Where a service offers a method that confirms age without keeping the underlying document, that option may suit people who are cautious about sharing identification.
Parents deciding how to handle checks on behalf of children also face choices about whether to supply their own details. Using an adult's identification to unlock access for a child would defeat the purpose of the rules, and platforms are expected to guard against that kind of workaround.
The rollout
Platforms now have to decide which methods to adopt and how to put them in front of users. Ofcom, as the regulator for the Online Safety Act, is responsible for overseeing whether companies comply, and services that fail to put effective checks in place can expect scrutiny. The regulator has powers to enforce the rules, and companies that fall short may face action.
Users should expect age prompts to appear on more services over time, and the form they take is likely to vary from one platform to the next. Some companies may roll out a single preferred method, while others may let users pick from several. Households will need to treat each new prompt with care, confirm that it comes from the genuine service, and decide how much personal information they are willing to share to keep their access.
