- 18 Nov 2026 UK Have your directors and PSCs verified with Companies House?
- 1 Dec 2026 AU Will your onboarding accept private-sector Digital IDs?
- 10 Dec 2026 AU Does your privacy policy explain your automated KYC decisions?
- End 2026 EU Is your ID verification ready for EUDI Wallets?
- 1 Jan 2027 US Can your age checks keep up state by state?
- 1 Apr 2027 JP Is your eKYC ready for the IC-chip mandate?
- 10 Jul 2027 EU Is your CDD flow ready for the AMLR?
- 1 Jan 2028 US Are your adviser clients ready for FinCEN’s AML rule?
- 31 Mar 2029 AU Is your initial CDD on the new AUSTRAC model?
- Now AU Tranche 2 is live. Is your AML/CTF program running?
Age verification in the UK: the Online Safety Act and highly effective age assurance
Since 25 July 2025, online services that let children reach harmful content must use age checks Ofcom calls highly effective. The duty falls on platforms. Accountants, lawyers and other firms doing KYC are not in scope.
- The Online Safety Act 2023 requires services that allow pornography to use highly effective age assurance so children are not normally able to encounter it.
- Sites that publish their own pornographic content (Part 5 services) have had this duty since 17 January 2025; user-to-user and search services had to act on Ofcom's Protection of Children Codes from 25 July 2025.
- Ofcom lists photo-ID matching, facial age estimation, open banking, mobile network checks, credit card checks, digital identity services and email-based age estimation as methods capable of being highly effective. Self-declaration is not.
- Fines can reach £18 million or 10% of qualifying worldwide revenue, whichever is greater.
What it is
The Online Safety Act 2023 received Royal Assent on 26 October 2023. It puts duties on online services to protect users, and children in particular, from illegal and harmful content. Ofcom is the regulator and writes the codes and guidance that say how to comply.
Age assurance is the umbrella term for age verification and age estimation. Section 12 of the Act requires in-scope services to use highly effective age verification or age estimation, or both, to prevent children encountering the most harmful content. Section 81 sets the same standard for services that publish their own pornography.
Ofcom's approach is technology neutral. It sets four criteria an age assurance process must meet in practice: technically accurate, able to withstand the ways children are likely to get around it, reliable, and fair.
Who it applies to
The Act applies to search services and to services that let users post content or interact with each other, including services based outside the UK that have UK links. The age assurance duties bind the platform. They do not bind the regulated professional firms that StackGo usually works with.
- Services that publish their own pornographic content (Part 5 services)
- User-to-user and search services that allow pornography or other content harmful to children
- User-to-user and search services likely to be accessed by children, which must assess and address risks to children
- Age assurance providers indirectly, because platforms rely on their checks
An accounting, legal, conveyancing or real estate firm verifying a client's identity for AML purposes is not doing age assurance under this Act. The indirect relevance is that the same technologies (photo-ID matching, facial analysis, digital identity) now serve both purposes, and Ofcom's criteria are a useful benchmark for judging any automated identity or age check.
What in-scope services have to do
These duties sit with the platform. They are listed here so firms can tell age assurance apart from the customer due diligence they owe under AML law.
- Assess whether children can access the service
All user-to-user and search services in scope had to complete a children's access assessment by 16 April 2025. Services likely to be accessed by children then had to complete a children's risk assessment by 24 July 2025.
One-off, then reviewed - Use highly effective age assurance where required
Services that allow pornography must use highly effective age verification or age estimation so children are not normally able to encounter it. The check must happen at the point of entry, or before any such content is visible.
Platform duty - Meet Ofcom's four criteria
The process must be technically accurate, hold up in real use, be reliable and be fair. Where it relies on AI or machine learning, Ofcom expects testing for reproducible results and for bias across the population.
Design and testing - Protect users' data while checking age
Ofcom says every age assurance method processes personal data and should follow data protection by design. Compliance with both regimes is mandatory. See the UK GDPR hub.
Ongoing
What firms get wrong
Age verification and identity verification use similar tools, which confuses who has to do what.
The Act's age assurance duties apply to user-to-user, search and pornography services. A professional firm's client identity checks come from AML law, such as the Money Laundering Regulations, and are a separate obligation.
Ofcom's guidance says that wherever the age assurance happens, and whoever runs it, the regulated service must make sure it is highly effective. In September 2026 Ofcom opened an investigation into whether one platform did enough due diligence before relying on age signals from a device maker.
Ofcom's list is non-exhaustive and is not a guarantee. A listed method only counts if the service's implementation meets all four criteria in practice.
What happens when
- In force
Part 5 services that publish their own pornography must use highly effective age assurance Source
- In force
Deadline for children's access assessments by user-to-user and search services Source
- In force
Deadline for children's risk assessments by services likely to be accessed by children Source
- In force
Protection of Children Codes apply; services allowing pornography must have highly effective age assurance in place Source
- In force
Ofcom publishes an updated version of its guidance on highly effective age assurance Source
Related guides
Questions people ask
Is age verification required in the UK?
For some online services, yes. Since 25 July 2025, services that allow pornography must use highly effective age assurance, and services likely to be accessed by children must act on Ofcom's Protection of Children Codes. Most businesses outside those categories have no age assurance duty under the Act.
What age verification methods does Ofcom accept?
Ofcom lists open banking, photo-ID matching, facial age estimation, mobile network operator checks, credit card checks, digital identity services and email-based age estimation as capable of being highly effective. Self-declaration, debit card payments and terms of service that ban children do not qualify.
What are the penalties for not using age checks?
Ofcom can fine a company up to £18 million or 10% of qualifying worldwide revenue, whichever is greater, and in extreme cases ask a court to cut off payment, advertising and internet services. Ofcom has already fined providers, including an £80,000 penalty confirmed in June 2026.
Does the Online Safety Act apply to accountants or lawyers?
Not for their client onboarding. Their identity checks come from AML law. See Money Laundering Regulations and HMRC AML supervision.
Is age assurance the same as identity verification?
No. Age assurance answers whether someone is over a set age, and may estimate age without identifying the person. Identity verification confirms who someone is. See types of identity verification.
Primary sources
Checked 5 Nov 2026. We review this page every 90 days and when the rules change.
Where StackGo fits
StackGo does not offer age assurance and is not a solution for Online Safety Act compliance. IdentityCheck is built for the AML identity checks that regulated professional firms owe their clients, which is a different obligation.
- Biometric identity verification for AML customer due diligence: a photo of a government ID document plus a live selfie with liveness, covering 12,500 document types from 230+ countries and territories
- It does not do age assurance or age estimation
- It is not certified under the UK digital verification services trust framework
- It does not accept the UK digital ID or other digital identity credentials today
Ready to make onboarding minutes, not hours?
Start free and run your first check today, or book a demo and we will walk you through it.