UK Online Safety Act: Ofcom Age Assurance Checks for Adults
Quick answer
What does the UK Online Safety Act mean for adults and age checks?
It means adults may have to prove their age to reach some content, usually with a face scan, photo ID or credit card. The law sets the goal and Ofcom publishes acceptable methods, but each platform picks one. Data protection law covers how the check providers handle what you submit.
Picture a Tuesday night. You open a dating app, or click a clip on X, and the screen says: prove you're an adult. Scan your face, upload a passport, or hand over a credit card. For many people in Britain, that is the daily reality of the UK Online Safety Act. The question nobody answers clearly is the simple one: where does all of that information go?
The UK Online Safety Act aims to protect children, but in practice adults must prove their age with a face scan, ID or card, so the real question is who holds that data and whether you get a privacy-friendly choice.
UK Online Safety Act: How Ofcom Turned Child Safety Into a Check for Every Adult
Let's start with the good intention, because it is real. The Online Safety Act is a law meant to protect children from harmful content, like the pornographic content no ten-year-old should stumble onto. Nobody sensible argues with child safety. The fight is about the method.
Here is the catch. You can't check a child's age without checking everyone's age. So the law meant to protect children online also builds a gate that every adult walks through. The Wikipedia history of UK age verification notes that campaigners have worried about exactly this: how trustworthy and safe the checking tools are.
Why the UK's Online Safety Act came with new duties
Age checks are not a brand new idea. Britain floated them in the Digital Economy Act 2017, then dropped the plan. The idea was brought back through the Online Safety Act 2023. That law began life as the Online Safety Bill (a draft law, before the UK Parliament voted on it) and now requires mandatory age verification for porn and other content judged harmful.
The checks went live on July 25, 2025. The rules, which Ofcom enforces, put safety duties (the legal to-do list) on companies. Checks must be finished before any adult content is visible. Services can't host content that helps people dodge the checks. And the methods must tell children from adults while still respecting the privacy of adults who are looking at legal material. In plain terms, the Online Safety Act requires websites that host violent or adult material to prove they know who is looking.
The regulator, Ofcom, publishes which methods count. According to Jumio's summary, those are photo ID, biometric checks (checks using your face or other body traits) and credit cards, held to a "highly effective" standard. The Online Safety Act is a rulebook for the goal, not for the tool.
Search services and the other providers the Act covers
The Online Safety Act reaches user-to-user services (sites where people post things for others to see) and search services (search engines). Tom's Guide reports that adults may face a face scan, card or ID document to see certain content on X, Reddit or Bluesky. The same goes for a new over-18 video game, a new match on a dating app, or an adult-only video. That is a lot more than a single website. This article is part of a series, start with Deepfake Laws By State 8 States Push Chatgpt Id Checks.
What a Provider Actually Collects: UK Online Safety Act Checks Compared
Not all checks are the same. Each one hands over a different slice of you. Here is how the three common routes look side by side.
| Method | What the provider sees | The privacy question |
|---|---|---|
| Face scan (facial age estimation, software that guesses age from a selfie) | Your face, briefly | Is the image deleted, and is that promise written into a privacy policy? |
| Photo ID document | Name, birth date, photo | This is the most identity you can give, so who stores it, and for how long? |
| Credit card | Card details | Security matters here: what happens if the company is breached? |
Yoti, one of the age-check companies named in the research, uses facial age estimation and ID checks. It says it deletes all user data "after the age assurance process is complete." AgeChecked is another service in the mix. That is a decent promise. But a promise is not the same as proof, and the Online Safety Act leaves it to each company to design its own restraint.
There is also a split worth knowing. Ondato separates age verification (hard evidence, like an ID) from age estimation (a guess from your face). A guess sounds gentler. Whether it is accepted depends on what Ofcom allows and what each platform picks.
Age verification measures came with a schedule problem
Ask any of the service providers holding your data for its deletion schedule (how long it keeps things, and when it wipes them). Then ask who else touches the data, and what happens in a breach. A vendor may delete your selfie in seconds, yet keep a record that you passed. That record is small, but it is still about you.
Some vendors argue for different measures. OneID's guide lays out the tradeoffs between bank-verified identity and biometric methods. Whichever you choose, you make a trade: some privacy for access.
The privacy standards of the different age check tools are regulated only under data protection law, such as the UK General Data Protection Regulation. Concern raised by campaigners, as summarized by Wikipedia
Does the UK Online Safety Act Force Adults to Hand Over ID? The Impact on Privacy
Not always ID, but in practice, yes, adults must prove their age with something: a face scan, an ID document or a credit card. The UK Online Safety Act does not pick one method, so what you face depends on the platform. The impact is that proving you are one of the adult users online is now a normal chore.
Can a subsection of the Online Safety Act protect adult privacy?
I can't point to a specific subsection, because the research behind this piece does not quote one. It does say the Online Safety Act expects privacy to be respected, that data protection law covers the tools, and that the Information Commissioner's Office (the UK privacy watchdog) oversees compliance. Whether that is enforced is the open question. Previously in this series: Missouri Age Verification App Scans Ids To Shield Children.
Here is my honest worry, and it is not a conspiracy theory. Most platforms pick the easiest design, not the most private one. Collecting more is simpler than building restraint in. And once millions of adults get used to a face scan at the door, that infrastructure does not quietly go away. In effect, a temporary hurdle becomes the new normal.
There is a different model. TechRadar describes the EU approach using zero-knowledge proofs (a way to prove a fact, like "over 18," without revealing anything else). The government can set a goal without demanding your whole identity. And Cybernews reports that privacy worries are pushing some adults toward VPNs (tools that hide where you are connecting from). When people go around a rule, that tells you something about trust.
Why UK Online Safety Act Age Checks Matter
- It touches every adult. Child protection needs a gate, and the gate is for all online users.
- Choice is thin. The Online Safety Act names acceptable methods, but a given site may offer only one.
- Data lingers. Even a deleted selfie can leave a record that you passed a check.
UK Online Safety Act Questions: A Section to Save Before Trusting Any Check
If you have ever wondered whether a photo, a profile or a person online is really who they claim to be, that is the exact question identity technology exists to answer. It works in both directions. A site wants to know you are an adult, and you deserve to know the site is trustworthy. At CaraComp, we think that second question gets skipped far too often.
So here is the one useful thing to do. Before you upload anything, look for three answers in plain words: what exactly is collected, how long it is kept, and who else handles it. If you can't find them in a minute, treat that as your answer. And if a site offers a choice, take the method that shares the least about you, such as a face estimate that is deleted over an ID scan that sticks around.
The UK Online Safety Act is a law about children that gives every one of the adult users online a new job: prove your age. The debate should not stop at whether checks are needed. It should ask what you must provide, who handles it, and whether you get a privacy-respecting choice.
Here is the line I keep coming back to. A law written so a child won't see something once now asks millions of adults to prove who they are, over and over, to a growing list of companies. Who is keeping the receipts?
UK Online Safety Act: Frequently Asked Questions
Does the Online Safety Act cover scam advertisements and illegal content?
The research behind this article focused on age checks, so I can't give details on scam advertisements. The Online Safety Act is best known for protecting children, and illegal content is a related but separate part of the topic. For the exact scope, read the official guidance from the regulator, which you can find by searching Ofcom org, and treat anything else as unconfirmed until you see it there. Up next: Uk Online Safety Act Ofcoms 3 Age Checks Every Adult Faces.
What are the new rules for search services and internet companies?
According to the research, the new rules, which Ofcom oversees, ask internet companies to finish age checks before any adult content is visible, and they cover search services as well as sites where users post. Safety duties require platforms to take action to keep children away from pornographic content. They also can't host content that helps people dodge the checks. Beyond that, measures differ by service, so check the guidance for the site you use on the wider internet.
Can age checks block fake IDs or fake faces?
Checks are meant to block fake ages, but no system is perfect, and I don't have figures on how often they fail. Tools aimed at fake photos usually test liveness (whether the camera is looking at a live person, not a picture). A weak check is a security risk, since bad actors can slip through. A strong one collects more data. That is the tradeoff in a nutshell.
What does it mean to assess online risks?
A risk assessment is a company's own review of how its service could prove harmful to people. The basic idea is that online services must protect their users, so providers are expected to assess online risks and act on what they find. I don't have the exact legal wording, so treat this as the plain-English version. It is the reason age checks exist in the first place: the company has to show it thought about who could be harmed.
Does the law force social media platforms to scan faces?
Not by name. The law does not force a single method. It sets the goal, and each platform picks a method, such as a face scan, photo ID or credit card. Research says X, Reddit and Bluesky use checks for some content. Whether this feels like a threat to your privacy depends on the method and how the data is handled. An online user-controlled choice, where you pick the option that shares the least, is the thing to look for.
What is the Online Safety Bill, and how is it different from the Act?
The Online Safety Bill was the draft version of the law, before it passed. A bill is a proposed law, and an act is the finished one that companies must follow, with Ofcom as the regulator. The government's stated aim is child safety, including protecting children from harmful content. Once the bill passed in 2023, it became the Online Safety Act, which now requires platforms to run age checks for certain material.
What does the UK Online Safety Act mean for my data, and who handles it?
Age-check companies such as Yoti handle the checks for many platforms. According to campaigners, the privacy of these tools is regulated under data protection law, and that regulation is less specific than many users expect. So ask before you upload. The UK Online Safety Act sets the goal, but you still decide whether a particular check has earned your trust.
Ready for forensic-grade facial comparison?
Full forensic reports with detailed similarity scoring. Results in seconds.
Run My First SearchMore News
Missouri Age Verification: App Scans IDs to Shield Children
Missouri's new age-check app promises to keep your ID data on the device. Before you cheer or panic, here are the three questions every family should ask.
digital-forensicsDeepfake Scam: 94% Fraud Filter Misses a Fake Kid's Cry
A telecom says AI blocks 94% of fraud. Officials still warn that deepfakes can reach kids. Here is what slips through, and the one habit that stops it.
privacyAge Verification Georgia: ID Scanning Could Reach All Adults
A federal appeals court just cleared the way for Georgia to enforce its social media age-check law. Here is what that could mean for your family's ID, face and data.