UK: Under-16 social media ban - Ofcom assesses age assurance methods

In our previous briefing following the announcement of the UK’s under 16 social media ban, we noted that the approach to enforcement remained unclear, but that Ofcom, the UK online safety regulator, had been asked to conduct a rapid assessment into age verification methods for 16 year olds. The assessment will inform the proposed restrictions, with draft regulations expected by the end of 2026.

The headline takeaways

Ofcom's central finding in the assessment, published on 29 October 2026, is that there are four methods that it deems possible of meeting the ‘highly effective age assurance’ (HEAA) threshold when determining whether a user is 16 or over:

1. photo ID matching;
2. digital identity services;
3. banking-based checks; and
4. facial age estimation. 

Those familiar with Ofcom’s existing guidance on HEAA methods will notice that these are not new concepts. Ofcom has confirmed that a further three methods (credit card and mobile network operator verification checks, and email-based age estimation) are not suitable to verify whether someone is over 16 and will remain only for verification at 18. 
This means there are currently fewer highly effective age assurance methods available at 16 than at 18. Ofcom’s assessment did not identify any emerging methods that would be ready before the ban takes effect, although new solutions may emerge once the restrictions are in place.

Alongside a helpful assessment of each of the tools, noting particular limitations in each, Ofcom has reiterated that self-declaration of age, general contractual restrictions and verifiable parental consent do not, on their own, constitute highly effective age assurance. Age inference however cannot itself act as an ‘age gate’, but may support the wider age assurance system. Ofcom’s July 2026 report highlighted the prevalence of passive verification methods already used across social media platforms.

As we discussed previously, Ofcom is aware of the circumvention methods seen used following Australia’s social media ban and have suggested some preliminary mitigation strategies which combine age inference, use of existing location-related signals like IP addresses and user reporting.

What can we learn about Ofcom's approach to age assurance

Above all, the assessment signals continuity. Ofcom has applied the same principles-based criteria it uses for identifying 18 year-olds, so existing compliance work under the Online Safety Act 2023 is unlikely to be wasted. Ofcom has seemingly revised its existing framework to create a more segmented system, whereby separate HEAA methods should be deployed for determining users under 16, 16-17 and over 18, to match the variety of tiered restrictions imposed by the upcoming regulation (see our previous briefing for further details). 

Central to the implementation of this stratified approach will be the use of photo-ID which is either required as part of the HEAA method itself, or as a backstop, given that Ofcom has flagged the limitations of other methods, including facial age estimation. Instead, Ofcom is suggesting the implementation of a ‘challenge age’ approach (similar to the UK’s ‘Challenge 25’ strategy for the purchase of alcohol). 

Next steps

The Government intends to lay the first draft of its under 16 social media ban regulations before Parliament by the end of 2026, after which Ofcom will consult on draft guidance. Until then, the scope of the ban and providers' obligations cannot be defined with certainty, and existing Online Safety Act duties (and wider duties such as data protection and consumer rights etc) continue to apply.

Organisations potentially affected by the proposed restrictions should monitor the draft regulations and proactively consider how to adapt their age assurance arrangements and user journeys, balancing effectiveness, privacy, accessibility and user experience. Those using age inference should assess whether additional checks are needed for the relevant age threshold and applicable requirements, while retaining inference where it provides a useful supporting role.

Further reading 

• UK: Social media ban for under 16s — implications for platform operators and age assurance