Ofcom shortlists four 'highly effective' age assurance methods for UK under-16 social media ban, amid privacy concerns
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 30/10/2026 00:04; os links antigos trazem para cá.
Fontes: theregister.com ↗ digit.fyi ↗
Ofcom has published a rapid assessment naming four "highly effective age assurance" (HEAA) methods that platforms could use to confirm a user is 16 or over. The assessment comes ahead of Government and Parliament decisions on how the UK under-16 social media ban will work. The Government announced the ban in June (digit.fyi). The four methods are photo-ID matching, banking-based checks, digital ID services and facial age estimation with a 'challenge age'. Ofcom acknowledges that circumvention "cannot be entirely eliminated", that "many" adults will also have to verify, and that about 150,000 16-17-year-olds have no photo ID (theregister.com). Privacy group Big Brother Watch called the scheme a "national ID system by the back door", warning of mass passport sharing with foreign tech firms and the end of online anonymity (theregister.com). Ofcom says it will take "swift and firm action" against non-compliant companies once the ban takes effect (digit.fyi). This is a regulatory development, not a security incident.
Detalhes técnicos
- Photo ID matching: compares a passport or driving licence photo with a live image or selfie of the user. About 94% of UK people aged 16 and over hold one of these documents, but roughly 150,000 16- and 17-year-olds have neither (digit.fyi).
- Banking-based checks: use the age record or KYC data a bank holds, with the user's consent. About 90% of UK 16-17-year-olds have a bank account (digit.fyi, theregister.com).
- Digital ID services: reusable age attestation after a one-off photo ID verification (digit.fyi). These were reportedly circumvented soon after Online Safety Act (OSA) enforcement began (theregister.com).
- Facial age estimation with a 'challenge age': the margin of error at age 16 is a few years. Ofcom therefore recommends a second check, similar to 'Challenge 25' in retail (digit.fyi, theregister.com).
- Credit card, mobile network and email checks remain valid only for verifying adults (theregister.com). Some adults with existing accounts may not need to re-verify if the platform already holds reliable age information (digit.fyi).
- Anti-circumvention measures: easier user reporting of suspected underage accounts and age inference models (digit.fyi, theregister.com). A 12-month monitoring period follows enforcement (theregister.com).
- Prior research found that existing OSA age checks were largely ineffective, with some users defeating them using a drawn-on moustache (theregister.com).
- The standard is stricter than the "reasonable steps" test used in Australia (digit.fyi).
Remediação
No patch applies. Platforms operating in the UK should prepare to implement one or more of the four methods. They should expect draft Ofcom guidance and the first regulations by year-end (theregister.com). They should also assess the data protection exposure of collecting identity documents and biometric age-estimation data at scale (theregister.com). 16-17-year-olds without photo ID may need to obtain it (digit.fyi).
Relatos divergentes
- Method count: digit.fyi describes seven further Ofcom-approved methods that work only for users aged 18 and over. theregister.com says the four methods were narrowed from seven options under the OSA, which implies seven in total. The sources do not reconcile this, and the more recent source is theregister.com.
- Status and timing: digit.fyi describes the ban as announced by the Government in June and taking effect next year. theregister.com calls it "proposed" and points to first regulations by year-end. The final shape of the ban therefore remains subject to Government and Parliament decisions.
Linha do tempo
-
Ofcom shortlists four age-assurance methods for UK under-16 social media ban, raising ID and privacy concerns
ler a análise desta fonte ocultar
Ofcom has published a shortlist of four "highly effective age assurance" (HEAA) methods ahead of the UK's proposed under-16 social media ban, narrowed from the seven options set out under the Online Safety Act. The approved methods are photo-ID matching, banking checks, digital ID services and facial age estimation; credit card, mobile network and email checks remain valid only for verifying adults. Ofcom acknowledged that "many" adults will also have to verify, that around 150,000 UK 16-17-year-olds have no photo ID, and that circumvention "cannot be entirely eliminated". Privacy group Big Brother Watch called the scheme a "national ID system by the back door", warning of mass passport sharing with foreign tech firms and the end of online anonymity. Prior research showed existing OSA age checks were largely ineffective, with some users defeating them using a drawn-on moustache.
Technical Details
- Photo-ID matching: document data compared against a live selfie.
- Banking checks: leverages KYC data held by banks (≈90% of 16-17-year-olds have an account).
- Digital ID services: reusable third-party age attestation, previously circumvented soon after OSA enforcement.
- Facial age estimation: Ofcom admits a margin of error of several years and suggests pairing with a second method. Mitigations floated against circumvention include user reporting of suspected underage accounts and age inference models, with a 12-month monitoring period after enforcement.
Remediation
Platforms operating in the UK should prepare for draft Ofcom guidance and the first regulations expected by year-end, and assess the data protection exposure of collecting identity documents and biometric age-estimation data at scale.
-
Ofcom Sets Out Four 'Highly Effective' Age Assurance Methods for UK Under-16 Social Media Ban
ler a análise desta fonte ocultar
Ofcom has published a rapid assessment of how social media firms could reliably determine whether a user is 16 or over. The assessment comes ahead of Government and Parliament deciding how the UK's under-16 social media ban will work in practice. The Government announced the ban in June and said "highly effective age assurance" will be critical to it. This is a stricter test than the "reasonable steps" standard used in Australia. Ofcom says the risk of circumvention cannot be fully eliminated and it will take "swift and firm action" against non-compliant companies once the ban takes effect next year.
Technical Details
Ofcom qualified four methods as highly effective for age 16+ checks:
- Photo ID matching: compares a passport or driving licence photo with a live image of the user. About 94% of UK people aged 16 and over hold one of these documents, but roughly 150,000 16- and 17-year-olds have neither.
- Banking-based checks: use a financial institution's age record with the user's consent. About 90% of UK 16- to 17-year-olds hold a bank account.
- Digital ID services: let users prove their age digitally after a one-off photo ID verification.
- Facial age estimation with a 'challenge age': some technologies have a margin of error of a few years at age 16. Services should therefore add age verification as a second check, similar to 'Challenge 25' in retail.
Seven other Ofcom-approved methods work only for users aged 18 and over. Some adults with existing accounts may not need to re-verify if the platform already holds reliable age information. To limit circumvention, Ofcom says it has made it easier for users to report suspected underage accounts, and it also points to age inference models.
Remediation
Not applicable. This is a regulatory policy development, not a security incident. Platforms should prepare to implement one or more of the four methods, and 16- to 17-year-olds without photo ID may need to obtain it.