UK Age Verification Law in 2026: The Complete Guide for Businesses

The Online Safety Act 2023 (c. 50) is an Act of the UK Parliament that regulates internet services — primarily "user-to-user" services (social media, forums, messaging platforms with public content) and search engines. It gives Ofcom wide-ranging powers to enforce duties around illegal content, content harmful to children, and fraudulent advertising.

Two things trip businesses up early on:

1. Royal Assent is not the same as "in force." The OSA received Royal Assent on 26 October 2023, but the vast majority of its substantive duties only took effect later, through a series of commencement regulations (Commencement No. 2, No. 3, and so on) made by the Secretary of State. Some duties are still being phased in through 2026.
2. It applies regardless of where you're based. The OSA applies to any in-scope service with a significant number of UK users, or that targets the UK market — a US or EU-based platform with UK visitors is still caught by it.

The full text is maintained at legislation.gov.uk/ukpga/2023/50, and it's worth checking that source directly for anything commencement-date-critical, since the Act has already been amended by the Digital Markets, Competition and Consumers Act 2024, the Media Act 2024, the Data (Use and Access) Act 2025, and the Children's Wellbeing and Schools Act 2026.

This is the part most businesses get wrong — they assume it's only "adult sites." It isn't.

The children's safety duties apply to any user-to-user service or search service that is "likely to be accessed by children," which Ofcom interprets broadly. In practice, that captures:

• Dedicated adult content platforms
• Social media and dating platforms
• Gaming and livestreaming services
• Any platform where pornographic or otherwise harmful content could appear incidentally, even if that's not its main purpose

Ofcom has estimated that more than 100,000 online services could fall within scope of these rules — far more than the "porn site" stereotype suggests. If your platform hosts user-generated content, allows messaging, or could plausibly be used by a minor, you need to actually check whether the duties apply to you — not assume they don't.

The specific duty requiring "highly effective" age assurance for pornographic content sits in Part 5 of the Act, given effect through Section 82, which came into force as part of the phased rollout. In short: providers must ensure children cannot normally encounter regulated provider pornographic content — full stop, not "discourage," not "warn," prevent.

Alongside this, the broader Part 3 children's safety duties (covering user-to-user services generally, not just pornography) also became enforceable from 25 July 2025. These require in-scope services to:

• Carry out children's risk assessments
• Apply age-appropriate design principles
• Prevent children encountering "primary priority content" (which includes pornography and content encouraging suicide, self-harm or eating disorders)
• Protect children from a wider list of "priority content" that's harmful but not always illegal
• Restrict certain features — including some recommendation algorithms — for under-18 users

This phrase is doing a lot of legal work, and Ofcom has been deliberately specific about what does and doesn't qualify. To meet the bar, an age check method has to satisfy all four of Ofcom's criteria simultaneously:

1. Technically accurate — it actually determines age correctly
2. Robust against circumvention — a determined teenager can't easily beat it
3. Reliable — it performs consistently, not just in ideal conditions
4. Fair — it doesn't unreasonably disadvantage particular groups of users

Methods Ofcom has explicitly ruled out as not highly effective:

• Self-declaration ("I confirm I am 18+")
• Online payment methods that don't themselves require the payer to be 18 (general debit card checks, for instance)

Methods Ofcom has listed as capable of being highly effective (non-exhaustive):

• Photo ID matching (document upload combined with facial comparison)
• Facial age estimation using biometric technology
• Open Banking data checks
• Digital identity services
• Mobile network operator age checks

The word "capable" matters — using a method from this list doesn't automatically make a business compliant. Ofcom expects the implementation to meet all four criteria too, and providers must publish clear information about which checks they use and how user data is handled as part of that.

This isn't a paper tiger. Ofcom has enforcement powers with real teeth:

• Maximum fines of up to £18 million, or 10% of qualifying worldwide revenue — whichever figure is higher
• Ofcom can also require platforms to change how they operate, and in serious cases can seek business disruption measures
• June 2026 saw Ofcom's first confirmed fine under the age verification rules, issued against a pornography website for failing to have adequate age checks in place

The direction of travel is clear: this has moved from "guidance being finalised" to "regulator actively fining non-compliant businesses" within about 12 months.

On 15 June 2026, Prime Minister Keir Starmer announced that the UK will:

• Ban social media access for under-16s outright on platforms including Snapchat, TikTok, YouTube, Instagram, Facebook and X (messaging apps like WhatsApp and Signal are not expected to be caught by the ban)
• Introduce feature-level restrictions for a wider range of services — including gaming and livestreaming platforms — around stranger contact, livestreaming, and potentially addictive design patterns like infinite scroll
• Require "romantic companion" AI chatbots to enforce a minimum user age of 18, with related restrictions on intimate chatbot functionality more broadly for under-18s
• Task Ofcom with studying what "highly effective" age assurance for the 16-and-under threshold specifically should look like, with findings expected by October 2026

Separately, on 8 June 2026 at London Tech Week, the government announced it will require device manufacturers and operating system providers to build in default, device-level detection and blocking of nude images for children, with a three-month deadline for tech companies to act — again, an announcement with a deadline attached, not yet a statutory duty.

Timeline as things currently stand: the government intends to bring enabling legislation before Parliament before the end of 2026, with the under-16 protections expected to come into force in Spring 2027. This followed a public consultation (March–May 2026) that drew over 116,000 responses, more than 90% supporting a ban. Until the legislation is actually passed and commenced, businesses should treat this as a strong signal of direction rather than a current compliance obligation — but one worth building toward now rather than reacting to later.

Age verification inevitably means processing sensitive personal data — ID documents, biometric facial data, or financial data via Open Banking. That pulls in UK GDPR and the Data Protection Act 2018 alongside the OSA itself, with the ICO (not Ofcom) as the relevant regulator for how that data is handled.

The practical takeaway for businesses choosing an age assurance method or provider: compliance isn't just "did we check the age correctly" — it's also "did we minimise, secure and appropriately retain the data used to check it." A method that satisfies Ofcom's four criteria but handles data carelessly still creates real legal and reputational risk under a separate regulatory regime.