UK age checks online: the four methods Ofcom set out

The UK is preparing for a planned social media ban for younger users. As part of that preparation, Ofcom, the UK's communications regulator, has set out four ways platforms could check whether someone is aged 16 or over. Government and Parliament still have to decide how any ban would actually work in practice, so none of this is live yet. But it's worth understanding the options now, because they involve handing over some fairly sensitive information.

Ofcom has named four methods it considers 'highly effective':

• Photo ID matching: a live photo of you is compared against the photo on an ID document, such as a passport, and the age on that document is checked.
• Bank-based checks: a platform uses age information your bank already holds about you, with your consent.
• Facial age estimation: software estimates your age from a photo of your face. Ofcom says this technology has improved recently.
• Digital ID services: you prove your age through a digital identity service instead of a physical document.

Ofcom has also been honest about a limitation: facial age estimation can be wrong by a few years around the age of 16, so someone close to that line might be asked for a second check on top of the facial scan.

None of this means any particular platform is using these methods yet. It's a set of options Ofcom considers workable, not a rollout schedule.

What this actually means for you

If you use social media, nothing changes today. There is no current requirement to verify your age by any of these methods, and no date has been set for when a ban might take effect. What this does mean is that, at some point, you may be asked to prove your age using one of these four approaches, or something similar. It's worth knowing in advance what each one actually asks of you.

Each method trades a different kind of data for convenience. A photo ID check asks you to upload a copy of a government document. A bank check uses data your bank already holds, so you're not creating a new copy of your ID, but you are letting a bank share information about you. A facial scan creates a biometric estimate, not necessarily tied to a document, but still a photo of your face sent somewhere. A digital ID service sits in between, built specifically to answer the age question without handing over a full ID document each time.

What to do

• If and when you're asked to verify your age, check which of the four methods is being used and what data it accesses. A bank check and a photo ID upload are not the same thing, and you're entitled to know which one you're being asked for.
• Be cautious about uploading ID photos or facial images to any service, even a legitimate one. Check the verification provider's name (it's often a third party, not the platform itself), what it says it keeps, and for how long.
• If you already store ID documents or use identity apps, keep them updated and protected, and pay attention to any breach notifications from services you've used for identity or age checks.
• Don't assume a VPN solves this. A VPN can change the location a website sees, which might affect checks based on where you appear to be. It will not get you past an identity check or a facial scan that a service still requires. If a platform wants a photo ID match or a face scan, a VPN does nothing about that.

What this does not fix

Age-verification methods are designed to answer one question: is this person old enough? They are not a general guarantee of online safety, and nothing here claims otherwise. A platform can verify someone's age correctly and still have other problems with harmful content, scams, or data handling.

It's also worth being realistic about verification providers themselves. A breach at a third-party support provider used by Discord reportedly exposed government ID images belonging to around 70,000 users last year. That breach wasn't related to age-check proposals, but it's a useful reminder that any system asking for ID documents or facial images is only as trustworthy as the company storing them, not just the platform you think you're dealing with.

There's a version of age verification that would avoid a lot of this: a setup where a provider confirms you're old enough without learning which service you're accessing, and the service gets proof of your age without learning who you are. Whether UK platforms end up building anything like that is still an open question. For now, the sensible approach is the same as with any form you're asked to fill in: know who's asking, know what they're keeping, and don't hand over more than the check requires.