Ofcom’s age checks: what the proposed under-16 rules mean for families

Families do not need to start uploading ID or changing a child’s accounts because of Ofcom’s rapid assessment published on 29 October. It looks at ways a service might check whether someone is 16 or over. It was produced to inform the Government’s plan for under-16 social-media restrictions; it is not the restriction itself, and it does not tell every platform to use one particular check. The Government has said it wants regulations by the end of 2026 and expects implementation in spring 2027. That is a timetable and an aim, not a guaranteed start date. The regulations, including the exact services and features covered, have not yet been set.

Ofcom has assessed routes, not set the rule

Ofcom says four approaches are currently capable of being highly effective at determining whether a person is 16 or over: photo-ID matching, banking-based checks, digital identity services and facial age estimation. In plain English, photo-ID matching compares a document’s details and photograph with a live image; a bank check uses age information held by a financial institution; a digital identity service lets someone prove their age through an identity provider; and facial age estimation predicts an age from facial features without establishing identity. Ofcom assessed capabilities, not a mandatory shopping list. Whether any method is used, and how, will depend on the eventual rules and the services that fall within them.

The assessment looks at technical accuracy, robustness, reliability and fairness, alongside accessibility and interoperability. Facial age estimation is especially easy to misunderstand: Ofcom says some systems have a margin of error of a few years around age 16. A service could therefore use a “challenge age” and send borderline users to another check. That is not a guarantee that a genuine 16-year-old will always pass first time.

Privacy and access are not solved by the label

Every age-assurance route raises practical questions about personal data. A photo-ID or bank-linked check may involve information that identifies a person, while facial age estimation can process a face even when it does not identify the person. Ofcom says methods can be deployed in ways that comply with data-protection law; that does not mean every provider will collect, share or retain data in the same way. The Information Commissioner’s Office statement says age assurance should support children’s safety while respecting information rights. For families, the useful questions are: does the platform see the document or only an age result; who operates the check; how long is data kept; what happens after a failed result; and what is the appeal route? Ofcom also warns that people aged 16 have fewer routes than adults. It cites high ownership of passports, driving licences and bank accounts, but access is not universal. Its estimate of about 150,000 16- to 17-year-olds without a passport or driving licence is based on a non-representative school survey, so it should not be treated as an exact national count.

What families can rely on today

The Government’s family-facing guidance says there is nothing parents need to do now. The proposed restrictions are not the same as existing online-safety duties or platforms’ current age rules, and they are not yet a universal 16+ gate. The Government says it intends to protect continued access to learning, news, games and messaging, and has said it does not intend to include messaging services such as WhatsApp and Signal. Those are policy intentions; the final legal definitions may draw different lines around a service or a feature.

Ofcom’s assessment also says no method is entirely resistant to circumvention. Behaviour-based age inference cannot be the initial gate because it needs someone to be on the service already, although it may help services look for people who bypass a check. That means the design of the system—not simply the name of the check—will matter.

What still needs to be decided

Before families can know how this will work, several decisions are still needed: which services count as social media; whether rules apply to particular features; which age-assurance methods providers may use; what alternatives exist for people without standard ID; how errors and accessibility needs are handled; and what information can be shared between a checker and a platform. Section 70 of the Children’s Wellbeing and Schools Act gives the Government a regulation-making power, but it is not an operating under-16 ban. Parliament must still consider the regulations, and Ofcom says it will consult on guidance once they are laid. It would be premature to assume a particular app, start date or age-check requirement.

That leaves a simple, reliable takeaway for now: the Ofcom report is about what might work, not what families must do. Watch for the regulations and the detail that follows them. Until then, a headline about a coming restriction should not be read as a new rule already operating on a child’s account.