The UK's Online Safety Act brings in new rules for age verification on certain online services. If your service provides pornography or other harmful content, you'll need to implement 'age assurance' to prevent children from accessing it. In this article, we'll go over the specific rules you need to follow if your service is affected by these changes in the UK.
What are services required to do, and by when?
The Online Safety Act is a new set of laws designed to protect both children and adults online in the UK. It implements a range of rules affecting online service providers, including age verification requirements. The Act's age verification rules apply to services hosting pornographic content or other types of harmful material. If your service falls into this category, you must:
- implement age verification or age estimation (or both) to ensure that children (users under 18 years of age) cannot normally access regulated pornographic content; and
- ensure the age verification and/or age estimation methods are highly effective at determining whether the user is a child.
Services publishing their own pornographic content, including certain Generative AI tools, must start implementing robust age checks immediately. Meanwhile, services that allow user-generated pornographic content must have age checks fully implemented by July 2025.
What does highly effective age assurance mean?
Highly effective age assurance is a cornerstone of the Online Safety Act. Ofcom, the regulator for online safety in the UK, has published guidance to help understand what this concept entails:
- age-checking methods deployed must be technically accurate, robust, reliable, and fair to be considered highly effective;
- methods such as self-declaration of age and online payments that don't require a person to be 18 are not highly effective;
- pornographic content must not be visible to users before or during the process of completing an age check, nor should services host or permit content that directs or encourages users to attempt to circumvent an age assurance process; and
- sites and apps must consider the interests of all users when implementing age assurance – affording strong protection to children while respecting privacy rights and ensuring that adults can still access legal pornography.
While Ofcom has not set numerical thresholds for highly effective age assurance (e.g., 99% accuracy), such thresholds may be introduced in the future. This will depend on further developments in testing methodologies, industry standards and independent research.
Methods of age assurance
A range of age assurance methods may be appropriate, with some considered more effective than others. Examples of methods that meet the criteria for "highly effective" age assurance include:
| Methods capable of being highly effective | Methods not capable of being highly effective |
|---|---|
| Open banking | Self-declaration of age |
| Photo-identification (photo-ID) matching | Age verification through online payment methods which do not require a user to be over 18 (Debit cards) |
| Facial age estimation | General contractual restrictions on the use of the service by children |
| Mobile-network operator (MNO) age checks | |
| Credit card checks | |
| Digital identity services | |
| Email-based age estimation |
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
