Brits must prove their age on adult sites by July, says watchdog

The UK's communications regulator has published guidance for website operators aimed at preventing under-18s from accessing pornographic content online via "highly effective age assurance" techniques.

Ofcom expects age-checking processes on applicable services to be in place by July 2025. This includes verifying through open banking details, credit card checks, mobile network operator age checks, or facial age estimation.

The technical specifics of how the age verification is to work were not detailed by Ofcom, only that it needs to be "highly effective."

The regulator said: "It is for the service provider to determine which age assurance method(s) to use in order to implement an age assurance process that is appropriate to meet its duties under the Act."

Simply implementing one of the examples did not guarantee the service was compliant, added the watchdog. Instead, the content provider must demonstrate that the "process as a whole is highly effective."

As well as requiring "highly effective age assurance" in services that allow pornography, Ofcom expects all user-to-user and search services in scope of the UK's Online Safety Act to carry out a children's access assessment – to check if their service is likely to be accessed by children – with a deadline of April 16. Measures are also planned to protect children on social media, and these might include age checks too.

Dame Melanie Dawes, Ofcom's chief executive, noted that, historically, there had been little to prevent children from viewing the services of providers that allow pornographic "and other harmful material." Dawes added: "Today, this starts to change."

"As age checks start to roll out in the coming months, adults will start to notice a difference in how they access certain online services. Services which host their own pornography must start to introduce age checks immediately, while other user-to-user services – including social media – which allow pornography and certain other types of content harmful to children will have to follow suit by July at the latest."

Lina Ghazal, Head of Regulatory and Public Affairs at Verifymy, called Ofcom's announcement "a pivotal moment in the fight to make the internet a safer place, particularly for children."

Ghazal continued: "The regulator's long-awaited guidance on age assurance means adult content providers now have the clarity they need to get their houses in order and put in place robust and reliable methods to keep explicit material well away from underage users."

Verifymy describes itself as a "technology provider with a vision to provide solutions that safeguard children and society online."

• Pornhub pulls out of Florida, VPN demand 'surges 1150%'
• US standards agency reports back on just how good age verification software is
• It's ba-ack... UK watchdog publishes age verification proposals
• Children should have separate sections in social media sites, says UK coroner

There is a good chance of Ofcom's goals being thwarted. Age verification was introduced in Florida as a way of preventing children from watching smut online. Rather than verify the age of visitors in a way that would satisfy lawmakers, Pornhub withdrew from the US state, reportedly resulting in a four-digit percentage surge in VPN demand.

Australia took things a step further in 2024 with plans for a ban on access to social media for people under the age of 16.

There are also questions over civic rights and whether a well-intentioned move like Ofcom's might be a step toward the state demanding more monitoring powers to ensure users are kept "safe" online.

And of course, this isn't the UK's first go-around on this particular rodeo.

Speaking about the 2025 moves, Silkie Carlo, director of privacy campaigner Big Brother Watch, said: "Children must be protected online, but many technological age-checking methods are ineffective and introduce additional risks to children and adults alike including security breaches, privacy intrusion, errors, digital exclusion and censorship.

"There is a broad spectrum of age-checking methods, including dangerously intrusive methods like biometric face scans and even ID cards and passports for internet access. We must avoid anything like a digital ID system for the internet that would both eradicate privacy online and fail to keep children safe.

"Many technological age assurance methods can be easily circumvented and shouldn't be seen as a silver bullet solution, whilst parental controls, user controls and age ratings are other recognized, reliable methods to protect children from inappropriate content online."

Robin Tombs, CEO at Yoti - a business providing a trusted identity platform - welcomed the guidance and examples, and reckoned the direction of travel is clear.

However, Tombs called for more clarity from the regulator and said: "By not listing a definitive list of methods, which can be updated periodically, it does make it difficult for platforms to know if an alternative method they were considering might be suitable.

"Some of the methods that Ofcom has listed as highly effective must include the appropriate elements, such as liveness detection, otherwise they can be easily spoofed by children.

"There is too much that can be left open to interpretation in the guidance, which prevents parents and the public from having confidence that all regulated companies will complete effective checks." ®