Age Verification for UK Kids: Faces, IDs and No Delete Date

Picture your 15-year-old asking for a minute of your time. They need to prove their age to keep using an app, and the app wants a selfie. Or a photo of a passport. Or access to a bank. That is where age verification is heading in the UK, and most families have not been told what the fine print says.

Short answer to the 11pm question: nobody is asking you to panic. Keeping kids safer online with age verification is a fair goal. But "safer" and "private" are not the same thing, and right now parents are being asked to accept the first without seeing the terms on the second.

Age Verification and the Under-16s Ban: What Ofcom Has Actually Set Out

Here is the basic story. The UK is planning to ban social media for under-16s, with the ban due to start in March 2027. Ofcom, the UK's online safety watchdog, has now said how companies could carry out age verification. According to LBC, four methods are on the table: photo ID, banking checks, facial age estimation and digital ID.

Notice the word "estimation." Facial age estimation means software looks at your face and guesses how old you are. It does not say who you are. That sounds gentler, and in some ways it is. But the guess can be off by a few years, which is a big deal when the cutoff is a single birthday.

That number is worth a pause. It is not a measure of how many kids were hurt. It is a line on a calendar. Everything else, the scans and uploads and databases, exists to enforce that one line. And a line like that only works if somebody checks everyone near it.

How Social Media Age Verification Works for Under-16s

Because the ban covers under-16s, platforms cannot just check the kids. They have to check the people who look old enough too. That includes you. The Next Web notes that many adults will also have to go through age verification. So this is not a kids-only story. It is a story about a whole population being asked to prove something about themselves to use apps they already use. This article is part of a series, start with Uk Shop Face Recognition Innocent Shoppers Named As Thieves.

Ofcom also recommends that facial age estimation be paired with a second method, because the guess alone is not reliable enough. Read that again. The gentler option is not trusted to work by itself, so some people will end up handing over a face and a document.

---

Why Does Age Verification Raise Privacy Questions for Families?

Age verification raises privacy questions because proving your age means handing sensitive personal information to a company, and that company may keep it. Critics warn age verification systems can tie names, faces, birthdays and home addresses to what a person does online. Once that link exists, it can be hacked, sold or demanded later.

Security and privacy researchers call this the risk of tying someone's "most sensitive and immutable data" to their online activity. "Immutable" just means it cannot be changed. You can reset a password. You cannot reset your face.

This is not a hypothetical worry. Earlier this year, a data breach at Discord exposed ID images belonging to roughly 70,000 users. The leak came through a third-party service, not Discord's own front door. That detail matters, because it shows how age verification often works: the app hands the job to an outside vendor, and now there are two places your child's information can leak from. CNBC has covered the risks of vendor security and data retention, which is how long a company keeps what you gave it.

What Does Biometric Data Mean for a Child's Face Scan?

Biometric data means body-based details that are uniquely you, like your face, voice or fingerprints. A face scan used for age verification is biometric data. Some systems only estimate age and then discard the image. Others may store it. Families deserve to know which one they are dealing with before anyone clicks "allow camera."

---

Ofcom Age Verification: What Is Promised and What Is Missing

Here is where it gets interesting. A privacy lawyer would ask three boring questions: what is collected, who sees it, and when is it deleted? On the third one, the picture looks thin. In the United States, the FTC, a government consumer watchdog, has tied age verification to familiar privacy rules: use the data only to check age, limit who gets it, get written promises from vendors, and delete it when it is no longer needed.

The research behind this piece found that Ofcom's guidance, as described, lacks comparable limits on how long data is kept and who it can be shared with. For a closer look at how Ofcom frames what counts as "highly effective," see ISPreview UK.

Question for any age verification check	FTC approach (US)	Ofcom guidance as described
Why is the data used?	Only for age assurance (proving a person is old enough)	Highly effective age verification required
Who can see it?	Disclosure limited	No comparable limit described
What about vendors?	Written commitments secured	No comparable rule described
When is it deleted?	When no longer needed	Retention limit left undefined

To be fair, this is not a story with only one villain. Safety groups have a point too. The Molly Rose Foundation welcomed Ofcom's view that strong age verification can work. Previously in this series: Steam Uk Age Verification Credit Card Only No Selfie Scan.

It can work if social media firms do highly effective age checks properly.

The Molly Rose Foundation, welcoming Ofcom's guidance

Fair. But look at the last word: "properly." Everything hangs on how it is done. The real argument is not whether to use age verification. It is where the check happens (on the device or inside each app) and whether the rules for deleting data are as strict as the rules for collecting it. The Center for Democracy and Technology has laid out guardrails, such as retention limits and bans on secondary use, and the Electronic Frontier Foundation has raised concerns about data brokers and tracking.

Is Ofcom Age Verification a Real Choice for Parents?

It looks like a choice, but the options all ask for something personal. Picking face estimation over ID for age verification feels lighter, yet it may still need a backup method. A real choice would include a clear promise about deletion.

---

What Can Parents Do Before March 2027?

If you have ever wondered whether a photo or profile is really who it claims to be, that is the exact question this kind of technology exists to answer. The flip side is just as fair: before your child's face answers that question for a company, you get to ask a few of your own.

Here is the one useful thing to do. When any app or service asks your child to prove their age, stop and look for three answers in writing: what exactly is collected, which outside company handles it, and how soon it is deleted. If the screen cannot tell you the third one, treat that as a yellow flag. Choose the option that collects the least, and say no to anything that seems to keep a copy "just in case."

Also talk to your teen. Kids are good at workarounds, and the Australian experience shows it. A calm chat about why you are cautious about uploading ID beats a fight about a blocked app.

One last thought. The whole system is built around the number 16, a single birthday. Yet the data collected to enforce it, a face or a passport, never turns 16 and never gets a birthday. It just sits there. So the real question for March 2027 is not "how old are you?" It is "how long do you plan to remember that I answered?"

Age Verification: Frequently Asked Questions