UK Age Verification Law: Online Safety Act Compliance Guide

What the Online Safety Act requires

The Online Safety Act 2023 received Royal Assent on 26 October 2023 and gives Ofcom the power to require online services to protect children from pornography and other harmful content. The duty that matters for age verification is straightforward in principle and demanding in practice: any in-scope service must prevent children from encountering pornographic content, and it must be able to show that its method of doing so is highly effective, not just present.

Two categories carry the duty on different timelines. Part 5 covers services that publish their own pornographic content, and that duty has applied since 17 January 2025. Part 3 covers user-to-user platforms and search services, which had to complete a children’s access assessment by 16 April 2025 and then put proportionate measures, including age assurance, in place from 25 July 2025.

Key dates and enforcement timeline

Ofcom moved from guidance to active enforcement quickly. The pattern below is drawn from Ofcom’s own published enforcement decisions and industry bulletins [VERIFY current figures against Ofcom’s live enforcement register before publishing, as amounts and case counts continue to update weekly].

Two things stand out in the pattern. First, Ofcom treats a failure to respond to its information requests as a separate offence from the underlying age-assurance failure, and fines both. Second, penalties scale with persistence and portfolio size: a single-service operator that corrected its systems after a provisional decision paid less than a multi-site operator with an ongoing breach. Cooperation measurably reduces the bill.

What counts as “highly effective” age assurance

Ofcom’s guidance rules out self-declaration, simple tick-box birth-year entry and unverified payment card checks as standalone methods. Accepted approaches generally fall into a few groups:

• Facial age estimation, which returns a confidence-based age result from a live selfie without storing a biometric template
• Photo ID verification, matching a government-issued document to the user attempting access
• Open banking or card-based checks that confirm the account holder is over 18 through a regulated financial provider
• Reusable digital identity and age tokens that let a verified user prove their age across multiple services without repeating the full check each time
• A waterfall approach that starts with a low-friction method such as age estimation and escalates to document or biometric checks only for borderline results

The waterfall pattern is now the industry default because it balances the accuracy regulators demand with the drop-off businesses want to avoid. Shufti’s own implementation follows this model: age estimation first, stronger verification only when the estimate is inconclusive, and no retention of biometric templates once a result is returned.

Penalties and enforcement powers

Ofcom can fine a non-compliant service up to £18 million or 10% of qualifying global revenue, whichever is greater. Beyond fines, Ofcom can apply to the courts for business disruption measures: orders requiring payment providers, advertisers or UK internet service providers to withdraw support from a non-compliant platform, effectively blocking it from the UK market. Enforcement so far has clustered around adult content and file-sharing services, and Ofcom has confirmed it is also assessing major social platforms and generative AI tools capable of producing sexual content, so the enforcement pool is widening rather than narrowing.

How to implement compliance

1. Run or refresh your children’s access assessment and keep a written record; this is the document Ofcom asks for first.
2. Choose an age assurance method proportionate to your risk level; a waterfall of estimation plus document fallback suits most consumer platforms.
3. Remove any standalone self-declaration or birth-year gate; these no longer meet the highly effective standard on their own.
4. Log pass rates, false positive and false negative rates, and verification time; Ofcom’s investigations have repeatedly asked for this evidence.
5. Respond to any Ofcom information request within the stated deadline; every enforcement case to date has included a separate, and often costly, penalty for late or missing responses.
6. Review your privacy documentation so users understand what data is collected, why, and how long it is retained.