Key takeaways
The Online Safety Act 2023 requires websites hosting pornographic content to implement robust age verification so children cannot access it. Ofcom is the regulator responsible for enforcing this requirement.
Self-declaration ('I am 18') does not meet the requirement. Ofcom requires technically robust methods such as credit card checks, mobile network age verification or photo ID services.
Ofcom issued its first fine for failure to comply with age verification requirements in June 2026, fining a pornography website for not having adequate age checks in place.
Social media platforms face separate age assurance obligations under Ofcom's implementation of government restrictions on under-16s announced in June 2026.
Age verification requirements are intended to protect children from accessing harmful content online while allowing adults to access legal content freely.
Reviewed: June 2026Key facts
|
What the law requires
Under the Online Safety Act 2023, any service that hosts pornographic content and is accessible to UK users must implement robust age verification to ensure children cannot access it. This requirement covers both UK-based websites and international sites accessible from the UK.
The requirement is for age verification that is technically robust -- meaning it provides a genuine assurance of age rather than relying on the user's self-report. Ofcom has set out in its codes of practice what types of age verification meet this standard.
What counts as robust age verification
| Method | Meets Ofcom standard? | Notes |
|---|---|---|
| Self-declaration ('I am 18+') | No | Provides no genuine age assurance |
| Credit card check | Yes | Implies cardholder is an adult |
| Mobile network age check | Yes | Networks can verify account holder's age |
| Photo ID verification service | Yes | Requires upload and check of ID document |
| Open banking age check | Yes | Bank verifies account holder's age |
| Facial age estimation | Potentially | Must meet accuracy standards set by Ofcom |
| Age-verified digital identity | Yes | If issued by a compliant identity provider |
The June 2026 enforcement action
In June 2026, Ofcom took its first enforcement action under the Online Safety Act's age verification requirements -- fining a pornography website for failing to have effective age checks in place. The fine established that Ofcom is actively monitoring compliance and willing to impose financial penalties for non-compliance.
Ofcom has indicated that enforcement activity will continue across the sector. Sites that host pornographic content and are accessible to UK users are expected to implement compliant age verification systems promptly.
Age assurance for social media -- under-16 restrictions
Separately from the pornographic content age verification requirement, the government announced in June 2026 restrictions on social media access for under-16s. Ofcom is responsible for implementing these restrictions, which will require social media platforms to implement age assurance measures to prevent under-16s from accessing their services.
The specific technical requirements for social media age assurance are being developed by Ofcom as part of its codes of practice under the Online Safety Act. This is a distinct requirement from the pornographic content age verification -- it covers mainstream social media platforms rather than adult content sites.
Privacy considerations
Age verification raises privacy concerns because it typically requires users to share personal data (ID documents, bank details or mobile account information) with third-party verification services. Ofcom's requirements must be read alongside data protection rules under the UK GDPR and the Data Protection Act 2018. Age verification services must handle personal data securely and in accordance with UK data protection law.
Ofcom acknowledges the privacy trade-off and has indicated that the design of age verification systems should minimise the personal data collected and retained. Anonymous age verification tokens (which confirm age without identifying the specific user) are the preferred approach where technically feasible.
Related guides
Disclaimer: This guide is for informational purposes only. Kael Tripton Ltd is not regulated by the FCA and does not provide financial advice. Telecoms information is sourced from Ofcom, the UK communications regulator. Always verify current information at ofcom.org.uk.
Frequently asked questions
What is age verification under the Online Safety Act?
The Online Safety Act 2023 requires websites hosting pornographic content to implement technically robust age verification to prevent children from accessing it. Acceptable methods include credit card checks, mobile network age verification and photo ID services. Self-declaration does not meet the requirement. Ofcom is the regulator.
Has Ofcom fined any websites for not having age verification?
Yes. In June 2026, Ofcom imposed its first fine under the Online Safety Act's age verification requirements on a pornography website for failing to have effective age checks in place. This established that Ofcom is actively enforcing compliance.
What happens if a website does not implement age verification?
Ofcom can impose fines of up to 10% of global annual turnover. It can also apply to court for service restriction orders that could block non-compliant websites from being accessible in the UK. Ofcom's June 2026 fine was the first enforcement action in this area.
Does age verification apply to social media?
Separate age assurance requirements apply to social media under government restrictions for under-16s announced in June 2026. Ofcom is implementing these through its codes of practice. The requirement is distinct from the pornographic content age verification -- it covers mainstream social platforms rather than adult content sites.
What happens to my data when I use age verification?
Age verification services must comply with UK data protection law (UK GDPR and the Data Protection Act 2018). Ofcom's preferred approach is anonymous age verification tokens that confirm age without identifying the specific user, minimising the personal data shared. Check the privacy policy of the age verification service used by any specific website.
Does age verification apply to international websites?
Yes. The Online Safety Act applies to services that host pornographic content and are accessible to UK users, regardless of where the service is based. International websites that are used by UK users are in scope.
How is age verification different from age assurance?
Age verification typically provides binary confirmation that a user is above or below a specific age, often by checking an ID document or financial account. Age assurance is a broader term covering various technical approaches to confirming likely age, including statistical models and behavioural signals. Ofcom uses both terms in its guidance, with the specific method required depending on the nature of the risk.
What is the minimum age requirement under the Online Safety Act?
For pornographic content, the relevant threshold is 18. For social media age assurance measures relating to the government's June 2026 announcement, the threshold is 16. Different types of content and services have different age thresholds under the Act.
