UK Online Safety Act: Ofcom's 3 Age Checks Every Adult Faces

Since July twenty-fifth, twenty twenty-five, an adult in Britain who wants to watch certain videos on Reddit, X, or Bluesky may have to show a computer their face first.

A petition demanding the government scrap the rule

A petition demanding the government scrap the rule gathered more than four hundred fifty thousand signatures in just a few days.

If you've ever been asked to prove your age online, this story is about you.

Maybe you clicked a box that said "I'm over eighteen." That box is going away in the U.K.

It's reasonable to feel uneasy about handing over your face or your passport just to open a website.

The law is called the Online Safety Act. Parliament passed it in twenty twenty-three, and the regulator, Ofcom, now enforces it.

Sites that show adult material must confirm a

Sites that show adult material must confirm a visitor is an adult before anything appears. That applies to porn sites, and also to social media, dating apps, and some video games.

The stated goal is protecting children. But a check that stops a child also has to check every adult.

So what happens to the information adults hand over?

Start with the three ways to prove you're old enough.

One is a face scan. A camera looks at you, and software estimates your age. It doesn't name you. It guesses a number.

Another is a credit card, since in the U

Another is a credit card, since in the U.K. you generally must be an adult to hold one.

The third is an identity document, like a passport or a driver's license, uploaded to the service.

Many platforms don't run these checks themselves. They hire outside companies, such as Yoti and AgeChecked.

Yoti says it deletes user data once the age check is complete.

That's a promise from a company. It isn't something you can see happening.

For the rest of us, that means your face or your

For the rest of us, that means your face or your passport briefly sits with a business you've probably never heard of.

Now the legal side. Campaigners point out that these tools answer mainly to data protection law, including the U.K. version of the G.D.P.R.

That means no special rulebook exists just for age checks. The general privacy rules apply, and that's it.

The government sees this differently. It says the Information Commissioner's Office oversees privacy, so platforms can't use age checks as an excuse to collect extra data.

So the rules exist on paper. Whether anyone enforces them, and whether adults believe it, is a separate question.

There's also a better design, and it's not complicated

There's also a better design, and it's not complicated.

A well-built check collects only what's needed to answer one question: is this person old enough? Then it keeps almost nothing.

Privacy analysts argue that many platforms don't build it that way. Collecting more is simply easier than designing restraint into the system.

For a company, that's convenience. For you, it's a copy of your identity stored somewhere new.

And a breach turns that stored copy into a real problem. If a company holds millions of faces or I.D. scans and gets hacked, those can't be changed like a password.