Proof of youth in the UK

On 29 October 2026, Ofcom announced four methods it considers capable of being highly effective age assurance (HEAA) to determine whether someone is over or under 16 years old. The purpose of this is to help inform the Government’s plan around the social media ban for U16s (see our previous article here for details of the proposals including in-scope services), with full implementation targeted for Spring 2027.

What counts as HEAA according to Ofcom? 

• Photo ID matching: This checks relevant information on a photo ID document (e.g., passport or driving licence) and compares that to a live image of the user captured during the age check. 
• Banking checks: These access the information a financial institution has on record regarding a user’s age, with the user’s consent. 
• Digital identity services: Enables people to use a photo ID to verify their age with a digital ID service.
• Facial age estimation: This analyses the features of a user’s face to estimate their age. Services should take a ‘challenge age’ approach and use secondary age verification as an additional check to account for the margin of error. 

Whilst these methods aim to reduce the ability of U16s accessing restricted services or functionalities, Ofcom recognises that they are not entirely uncircumventable, so further mitigation steps such as age inference (see below), using existing location-related signals, and user reporting will still have a place. 

What is actually different? 

Not much of this is genuinely new as the methods are based on Ofcom’s existing guidance on HEAA at 18. The list remains non-exhaustive and based against the standard criteria of technical accuracy, robustness, reliability and fairness. 

The key takeaway is that there are fewer choices for HEAA methods at 16 than 18 given the practical limitations. This means that credit card verification (which is only available for over 18s in the UK), mobile network operator checks (where the content restriction filter to prevent children from accessing age-restricted websites on phones doesn’t currently exist at 16), and email estimation (where signals tend to be derived from adult services like mortgage lenders) are not deemed acceptable in this scenario. As before, self-declaration and general contractual agreement will not suffice. 

Interestingly, Ofcom has added verifiable parental consent — which typically involves a child self-declaring their age and providing an adult’s email address and is often used in the US — to the list of no-goes, because the method is not considered to be robust enough. 

Another key point is that Ofcom has retained its position from the July 2026 Age Assurance Report that age inference methods should not, in its view, act as an age gate for new U16s wanting to access services, given that the models rely on user activity over a period of time to effectively estimate age.

Ofcom again emphasises the need for data protection concerns to be balanced and points to working with the ICO in developing HEAA. Nothing significant has changed here.

What about the role of App Stores? 

The report touches on the role of operating systems, devices, browsers, and app store providers in supporting HEAA. Ofcom continues to make clear that it is ultimately the responsibility of the regulated service to ensure that HEAA is implemented effectively, but who carries out the checks is not mandated. 

Ofcom has separately published a report on the role of app stores which are not (currently) covered by the OSA but the report suggests they too could make greater use of HEAA, alongside implementing greater controls (e.g., over download and discovery, user reporting, and parental tools) without going as far as saying whether they will be directly regulated.

What next? 

The first set of regulations on the U16 ban is set to be published before the end of this year, and Ofcom will consult on related draft guidance, which may include additional methods capable of being HEAA at 16. Twelve months after the new age restrictions come into force, Ofcom also intends to publish research on circumvention, to ensure that the new protections are effective in practice. 

For the latest OSA developments, see our tracker.