A teenager opens a social media app and is asked to prove their age. A parent may meet the same request when trying to see something marked for adults. Checks like this are becoming more common in the UK, and Ofcom has now outlined the ways social media services can verify who is using them.
The rules behind the checks
Ofcom is the UK's communications regulator. Under the Online Safety Act, it enforces rules requiring online services to protect children from harmful content. For some material, such as pornography or content that promotes self-harm, a service cannot rely on a user simply ticking a box to say they are over 18.
The industry term for the alternative is "age assurance". It is an umbrella for two things. Age verification confirms a person's age against solid evidence, such as an official document. Age estimation guesses a likely age range, for example from a face. Both can count, as long as the method is accurate and hard to dodge.
In practice, that means a method has to work reliably for most people and cannot be beaten by obvious tricks. A box that anyone can tick fails on both counts. A check that compares a live selfie with a document is much harder to get around.
The main methods
The options Ofcom has pointed to are ones we may already have met elsewhere online.
Facial age estimation. We take a selfie or short video, and software estimates our age from our features. It does not identify who we are. It judges whether we look comfortably over a certain age. If it is unsure, we are usually offered another route.
Photo ID matching. We upload a passport or driving licence, then take a selfie so the system can check the photo is really us. It is among the most reliable methods, though it means sharing sensitive documents.
Open banking. We allow a check with our bank, which can confirm we are adults without handing over our statements or balance. The platform gets a yes or no answer.
Credit card checks. Because UK credit cards are only issued to adults, a successful card check can act as proof of age. Some services run this without taking a payment.
Mobile network checks. Many phone accounts have adult content filters switched on by default. A provider can confirm that the filters have been removed, which suggests an adult account holder.
Digital identity services. Some apps store a verified ID and let us share just one fact, such as "over 18", with a website.
Email-based estimation. Some services can estimate age from how an email address has been used across other online services.
Estimation versus verification in everyday use
The two approaches suit different situations. Estimation is quick and asks for very little, so it works well as a first step. A person who looks clearly adult may be through in seconds. The trade-off is that it deals in probabilities. Someone close to the age threshold may be asked to try something else, such as photo ID matching.
Verification is more certain but involves more effort and more sensitive information. For that reason, many services offer a choice of methods, so that people without a passport, a credit card or a particular bank can still prove their age another way.
Where your data goes
Handing over a face or a passport to a social media company understandably makes many of us nervous. In many cases the check is carried out by a separate specialist firm rather than the platform itself. The platform sends us to that provider, the provider carries out the check, and the platform is told only whether we passed.
This split matters because it limits what the social media company ever sees. If the system works as intended, the app learns that a user is over 18 and nothing more. It does not receive the selfie, the document or the bank details. Providers are also bound by UK data protection law, which expects personal information to be collected only for a clear purpose, kept secure and not held longer than necessary.
It is still sensible to look at what a check asks for before going ahead. We can look at which company is running it, what it says about deleting images, and whether a less intrusive option is on offer. A method that only needs a quick face scan may feel more comfortable than one that needs a scanned passport, even if both are accepted.
The limits of the checks
No method is perfect. Facial estimation can misjudge age, particularly near the cut-off. Some people lack the documents or accounts that certain checks rely on. Others may try to get round the systems, for instance by using someone else's identity or a tool that hides their location, which is why the rules stress that methods should be hard to dodge.
The aim is to make it much harder for children to reach material meant for adults, while keeping the process workable for the adults who are asked to prove their age. For users, the likely result is a few extra moments at the point of sign-up or when opening restricted content.
