‘Risks are not hypothetical’: Ofcom reveals age verification plans for UK social media ban, but privacy experts unconvinced
follow us
Add us as a preferred source on Google
- Ofcom has assessed the best ways to enforce age checks online
- The regulator also identifies methods that are not effective
- Around 4 in 10 under-16s plan to try to circumvent the UK ban
In June, the UK government ruled that under-16s should be banned from accessing social media platforms, with enforcement scheduled to begin during the first half of 2027. Now, communications regulator Ofcom has set out the ways in which it expects tech companies to comply with the law.
The challenge is not simply checking someone’s age. It does this without turning everyday Internet use into an identity check.
Pieter Arntz, Malwarebytes
In its new advert (via the BBC), Ofcom highlights four “highly effective” methods of keeping under-16s out of apps and sites they shouldn’t be accessing – and they will all be familiar to anyone who has used age-restricted online services in recent times.
The four methods are comparing photo ID (using something like a passport or driving licence), bank checks (Ofcom says 90% of 16-17 year olds in the UK have a bank account), digital ID services (a third-party service such as EasyID or Yoti) and facial age estimation via webcam (which Ofcom says is best implemented as secondary verification).
Latest videos ofTechnologyRadar
This is a “rapid assessment” from Ofcom, and neither of these approaches is confirmed yet – UK lawmakers will take the suggestions into account and decide how best to enforce the rules at a later date, most likely before the end of the year. All of these methods can be implemented “in a way that protects users’ privacy,” according to Ofcom.
Ultimately, however, it will be up to technology companies to decide how to implement age controls that meet the requirements set by the government. “There are things here that may work, they must preserve privacy, they must protect people’s data, but it is up to you to implement what you think works for you,” Dame Melanie Dawes, chief executive of Ofcom, told the BBC.
Challenges ahead
Ofcom also lists controls it considers ineffective: self-declaration, general contractual agreements and verifiable parental consent. The regulator also recognizes that “the risk of circumvention cannot be completely eliminated” but says properly implemented safeguards should “significantly reduce the likelihood” of unauthorized access.
In its rapid assessment announcement, Ofcom also encourages app stores to take greater responsibility for age checks. Right now, self-declarations are most commonly used to unlock downloads of age-restricted content.
The challenge for social media platforms is that teens don’t like to be told “no.”
Olli Krebs, Senior Vice President EMEA at Incode
They will be difficult rules to enforce, whatever the approach: recent EE research suggests that 42% of children aged 11 to 15 plan to try to get around any restrictions that are put in place. This could be achieved by switching to apps or platforms not covered by the new laws, including messaging services and gaming sites.
Last week, Ofcom also admitted that the Online Safety Act introduced in July 2025 had so far made “no significant change” to the harmful content children had been exposed to online. The law aimed to ensure protection against content involving pornography, serious violence, suicidal material, racism, misogyny and bullying.
“This finding is worrying and shows that more progress is needed to protect children online,” Ofcom says. The regulator also recommended adding material about body stigma and depression to the main categories of content that children should be protected from online.
Analysis: What do privacy experts think?
Ofcom’s proposals are likely to raise some familiar privacy concerns, and security experts told us they are not unfounded.
“The challenge is not simply verifying someone’s age. It’s doing it without turning everyday Internet use into identity verification,” said Pieter Arntz, senior malware intelligence analyst at Malwarebytes. “ID photo matching brings highly sensitive documents and facial images into the process, potentially creating another attractive target for criminals. The risks are not hypothetical: as I reported last year, a breach at a third-party support provider for Discord exposed government ID images belonging to around 70,000 users,” he said.
Even if facial estimation techniques are safer, there are still disadvantages. “Facial age estimation can avoid carrying an ID, but it still processes a sensitive image and makes an imperfect prediction,” adds Pieter Arntz. “Ofcom itself recognizes that some technologies have a margin of error of a few years at 16, meaning people close to the threshold may face an additional verification check,” he said.
“My preference is double-blind verification: a provider confirms that you meet the age requirement but does not know what service you are accessing, while the service receives proof of age without knowing your identity. Proving that you are old enough should not mean revealing who you are,” he said.
Others feel the risks are more about teens finding alternative solutions.“The challenge for social media platforms is that teens don’t like to be told “no.” “Many will adapt, but tech-savvy young people will look for an open window on the ground floor,” said Olli Krebs, senior vice president for EMEA at identity verification software provider Incode. “If the process is complicated, users of all ages will actively look for ways around it,” he added.
Those solutions could inadvertently make the problem worse. “The experience of countries like Australia is that there will be a real risk of an increasingly technologically sophisticated population of young people resorting to a variety of circumvention techniques (mainly, but not exclusively, VPNs) to access content hosted outside the UK,” said Will Richmond-Coggan, partner specializing in data and privacy disputes at Freeths.
“This type of content is likely to be less regulated overall and poses greater risks of users gaining unsupervised access to increasingly dangerous and problematic content that UK online safety legislation is largely unable to take action on,” he added.
“None of this will be perfect. Young people will always push boundaries and anyone promising 100% online security is unrealistic,” concluded Incode’s Olli Krebs. Exact success depends largely on how the social media giants implement Ofcom’s suggested age verification methods.
What do you think of the social media ban and Ofcom’s new proposals? Let us know in the comments below.
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment