Online Safety Act age checks have changed how millions of people in the UK use the internet. Since July 2025, websites and apps that host pornography or certain other harmful content have had to confirm that users are adults before letting them in. That has meant selfie scans, ID uploads and bank checks on sites that used to ask nothing more than a tick in a box.
The rules are meant to protect children. They have also raised hard questions about privacy, data security and whether determined teenagers simply use a VPN. This guide explains what the law requires, how the checks work, what happens to your data, and how to stay safe, with a look at similar laws in the United States.
Table of Contents
What is the Online Safety Act?
The Online Safety Act became law in October 2023. It places legal duties on online services that let users share content or interact with each other, such as social media, video sites, forums and messaging platforms, as well as search engines and pornography sites.
The regulator is Ofcom, which also oversees broadcasting and telecoms. Ofcom writes the detailed codes of practice that tell companies what they must do, and it has the power to investigate and fine them.
The Act has been introduced in phases. Duties to tackle illegal content, such as child sexual abuse material and terrorism, came first. Duties to protect children from harmful content followed, and the age checks that most people have noticed took effect on 25 July 2025.
Which sites need Online Safety Act age checks?
The strictest requirements apply to services that allow pornography. Those sites must use what Ofcom calls “highly effective age assurance” to stop under-18s from accessing it.
The same standard applies to services that allow content encouraging self-harm, suicide or eating disorders, which the law treats as especially harmful to children. Other harmful content, such as bullying, dangerous stunts and violent material, must be managed with age-appropriate protections.
In practice, the rules reached well beyond adult websites. Several large social platforms introduced age checks for some features or content in the UK, because their services can include material covered by the rules. Users have reported checks on some forums, messaging and social media apps, and even music streaming services for certain content.
How the age checks work
Ofcom does not require one particular method. It lists several approaches that can count as highly effective when done properly:
- Facial age estimation, where software analyses a selfie or short video to estimate your age
- Photo ID matching, where you upload a passport or driving licence and a selfie to confirm it is you
- Open banking, where you allow a service to confirm with your bank that you are over 18
- Credit card checks, since card issuers must confirm that cardholders are adults
- Mobile network checks, using the age verification your phone provider already holds
- Digital identity services and wallets that store verified age details
- Email-based age estimation, which looks at where your email address has been used
What is not allowed is self-declaration. Asking users to type in a date of birth or tick a box saying they are over 18 no longer counts.
What happens to your data?
This is the biggest concern for many adults. Handing a passport scan or a selfie to a website, or to a company you have never heard of that the site uses for checks, feels risky.
UK data protection law still applies. Age check providers and the sites that use them must collect only what they need, keep it secure and delete it when it is no longer required. Many providers say they delete images immediately after a check and pass only a yes or no answer back to the website. The Information Commissioner’s Office oversees how personal data is handled.
The risks are real, though. In 2025, a breach at a third-party company that handled age and identity checks for a popular chat platform exposed images of users’ ID documents. Incidents like this show why it matters which method you choose and which company you trust.
How to choose the safest check
If a site offers more than one option, some methods reveal less about you than others. Facial age estimation usually does not require your name or documents, and reputable providers say they do not store the image. Checks through your mobile network or bank confirm only that you are over 18, using information those companies already hold.
Uploading a full passport or driving licence reveals the most, including your name, date of birth, address in some cases, and document number. Use that option only if you trust the provider and nothing less intrusive is available.
As a rule, be suspicious of any site that asks for more than it needs, or that is not clear about which company carries out its checks.
Why VPN downloads soared
When the age checks began, VPN apps shot to the top of the UK app store charts. A virtual private network routes your internet traffic through a server in another country, which can make it look as if you are browsing from outside the UK and avoid the checks.
Using a VPN is legal in the UK, and many people use one for privacy, work or security. Ofcom has said platforms should not promote VPNs as a way around the rules, and critics of the law point to the surge in downloads as evidence that the checks are easy to bypass.
For parents, it is a reminder that technical barriers alone are not enough. Conversations with children about what they see online, and device-level parental controls, remain important.
The penalties for breaking the rules
Ofcom can fine companies up to £18 million or 10% of their qualifying worldwide revenue, whichever is greater. For the largest tech companies, that could run into billions of pounds.
In serious cases, Ofcom can ask the courts to order payment providers, advertisers and internet service providers to stop working with a site, effectively blocking it in the UK. Senior managers can also face criminal liability in some circumstances, such as failing to comply with information requests.
Ofcom has opened investigations into a number of services since the rules came in, including smaller sites that it says failed to put proper checks in place.
Why the law is controversial
Supporters, including many children’s charities and parents’ groups, argue the law is overdue. Children can stumble across violent and sexual content within minutes of going online, and before the Act, many sites did nothing to stop them. They see age checks as the online version of rules that already apply in shops, cinemas and pubs.
Critics raise several concerns. Privacy campaigners warn that normalising ID checks creates new stores of sensitive data that could be hacked or misused. Free speech groups argue that some platforms are over-blocking lawful content to avoid fines. Others say the checks are easily avoided and push people towards less regulated corners of the internet.
A public petition calling for the Act to be repealed gathered more than half a million signatures in 2025. The government responded that it had no plans to repeal the law.
How the UK compares with the United States
The United States does not have a national equivalent, but many states have passed their own age verification laws for adult websites. In June 2025, the US Supreme Court upheld a Texas law requiring age verification for pornography sites, ruling that it did not violate the First Amendment.
Some major adult sites have responded to state laws by blocking users in those states rather than introducing checks. American debates mirror British ones: protecting children on one side, privacy and free expression on the other.
Australia has gone further in a different direction, passing a law to stop children under 16 from having accounts on major social media platforms. Around the world, governments are trying different approaches to the same problem.
A timeline of the law
The Online Safety Act took years to arrive. Its roots go back to a government white paper on online harms published in 2019, which proposed a new legal duty of care for tech companies. A draft bill followed, and the Online Safety Bill was introduced to Parliament in 2022, where it went through long debates and many amendments.
The bill received Royal Assent in October 2023. Ofcom then spent more than a year consulting on detailed codes of practice. Duties to tackle illegal content came into force in March 2025, and the child protection duties, including the age checks described in this guide, followed on 25 July 2025.
Further duties, especially for the largest platforms, are still being phased in, so the rules will keep developing over the next few years.
How accurate are selfie age checks?
Facial age estimation does not identify you. It guesses your age from your features, and like any guess, it can be wrong by a few years in either direction. Accuracy varies with lighting, camera quality and, according to some independent testing, with age, sex and skin tone.
To reduce the risk of letting children through, many services set a buffer. Rather than accepting anyone estimated to be 18, they may require an estimated age of 20 or 25, similar to the Challenge 25 policy in shops that sell alcohol. Adults who look young may therefore fail a selfie check and be asked to use another method.
Independent testing and certification of age check providers is growing, and Ofcom expects services to be able to show that the methods they use are reliable.
What to do if an age check fails
If you are an adult and a selfie check says you look too young, try again in good, even lighting, facing the camera directly without glasses or a hat. If it still fails, most services offer a second method, such as a bank check, a credit card check or a check through your mobile network.
If a service offers no alternative and keeps rejecting you, contact its support team. You can also complain to the service directly about how its age checks work, and if you believe your personal data has been mishandled, you can raise it with the Information Commissioner’s Office.
The effect on smaller websites
Large platforms have teams of lawyers and engineers to handle new regulations. Smaller websites often do not. In the run-up to the new duties, some small community forums and hobby sites announced that they would close or block UK users, citing the cost and complexity of complying.
Ofcom has said the rules are meant to be proportionate, and that small, low-risk services face lighter requirements than big platforms. Critics argue that the uncertainty alone is enough to push volunteers who run small sites to give up. Supporters respond that any site that hosts user content has a responsibility to keep children safe, whatever its size.
How this balance works out in practice will become clearer as Ofcom’s enforcement decisions build up over the next few years.
What parents should know
Age checks on adult sites are only one layer of protection. Most children’s online experience happens on social media, games and messaging apps, where the Act also requires companies to reduce harmful content and make their services safer for young users.
Parents can still do a lot at home:
- Set up parental controls on phones, tablets, games consoles and home broadband
- Use child accounts on app stores and streaming services
- Keep devices out of bedrooms at night, especially for younger children
- Talk regularly about what your children see online and who they talk to
- Make sure children know they can tell you if something upsets them, without losing their phone
Our opinion piece on cell phone bans in schools looks at the wider debate about children and smartphones.
Staying safe when a site asks for ID
Scammers follow the news. Since age checks became common, fake verification pages have appeared, asking people to upload ID or card details. Before you share anything:
- Check the web address carefully and make sure you are on the real site
- Be wary of age check requests that arrive by email, text or social media message
- Never pay a fee to “verify your age”
- Prefer checks that confirm age without collecting documents
Our guides on how to spot a scam text and what passkeys are explain more ways to protect your accounts and personal data.
What comes next
Ofcom is continuing to roll out new codes and duties, including rules for the largest platforms on transparency and user controls. It has also consulted on further measures to protect children, such as stopping strangers from contacting them and limiting features like livestreaming for young users.
The technology will keep changing too. Digital identity wallets, which let people prove their age without sharing documents each time, could make checks less intrusive if they become widely used.
What the law does not do
The Online Safety Act is often misunderstood. It does not ban under-18s from social media, and it does not require every website to check the age of every visitor. The strictest age checks apply to services that allow pornography or content that promotes self-harm, suicide or eating disorders, while other services must assess and reduce risks to children in proportion to what they host.
The Act also includes powers that could, in principle, require messaging services to detect certain illegal content. Those powers have been among the most controversial parts of the law, because of fears they could weaken encrypted messaging. The government has said it would only use them when suitable technology exists. For now, the everyday changes most people notice are the age checks described in this guide and new safety settings on apps used by children.
Online Safety Act age checks: common questions
When did the age checks start?
The main requirements took effect on 25 July 2025.
Is ticking a box to say I am over 18 still allowed?
No. Self-declaration does not meet Ofcom’s standard for highly effective age assurance.
Do I have to upload my passport?
Not always. Many sites offer alternatives such as facial age estimation, bank checks or mobile network checks.
Is using a VPN illegal in the UK?
No. Using a VPN is legal, although platforms should not promote them as a way to avoid age checks.
Who enforces the Online Safety Act?
Ofcom, the UK’s communications regulator.
If a site asks you to prove your age, choose the method that shares the least about you, and double-check that the page is genuine. For more technology coverage, see our technology section.
