As preparation for the UK’s planned social media ban, Ofcom has set out four ways social media platforms could check whether users are aged 16 or over. The government and Parliament will decide how the ban works in practice.

Ofcom is the regulator for the communications services in the UK. The BBC reports that Ofcom identified four ways to check someone’s age that it considers “highly effective.”

Here’s what those checks would involve:

• Photo ID matching: Comparing a live image of you with the photo on an identity document, such as your passport, and checking the age information on that document.
• Bank-based checks: Using age information your bank already holds about you, with your consent.
• Facial age estimation: Using technology to estimate your age from your face. Ofcom says this technology has improved recently.
• Digital ID services: Using a digital identity service to prove your age, rather than presenting a physical document.

Let’s think through what those checks could mean.

Challenges

The challenge isn’t simply checking someone’s age. It’s doing so without turning everyday internet use into an identity check.

Photo ID matching brings highly sensitive documents and facial images into the process, which raises questions about how that information is handled and protected. The risks aren’t hypothetical: as I reported last year, a breach at a third-party support provider for Discord exposed government ID images belonging to around 70,000 users.

Banking-based checks can be more privacy-preserving if they return only confirmation that someone meets the age threshold, rather than exposing financial information. But the important questions are what information each party receives, what gets retained, and whether the check can be linked to someone’s activity.

Facial age estimation can avoid uploading an identity document, but it still processes a sensitive image and makes an imperfect prediction. Ofcom acknowledges that some technologies can be wrong by a few years around age 16, so people near the threshold may face an additional verification check.

I would expect these checks to stop some underage access but not eliminate it.

Previous restrictions have been followed by workarounds, including increased VPN use, borrowed credentials, and migration to services outside the restrictions. The danger is treating a successful age gate as proof that children are now safe, when it might push them into less regulated spaces.

The effectiveness depends on how the checks are implemented. A VPN may help someone avoid a check triggered by their apparent location; it won’t, by itself, bypass an identity or facial check that is still required.

Similarly, Ofcom says matching a live image to an ID is intended to make it harder to borrow someone else’s document. We shouldn’t assume every workaround defeats every method. But Ofcom accepts that some motivated children will get through. The meaningful test is how much harm these measures prevent, weighed against the privacy risks and barriers they introduce— not whether every user has completed a check.

My personal preference is double-blind verification: a provider confirms that you meet the age requirement without learning which service you’re accessing, while the service receives proof of age without learning your identity. Proving you’re old enough shouldn’t mean revealing who you are.

---

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

Ofcom has opened a formal probe into whether Meta properly assessed safety risks before launching Instagram Instants under the UK Online Safety Act.

The post Meta Faces First Ofcom Probe Under Online Safety Act Over Instagram Instants appeared first on TechRepublic.

Ofcom has opened an investigation into Aylo, the service provider of Pornhub, over its Pornhub age checks, examining whether the platform has met its legal obligations to prevent children from accessing pornographic content under the UK Online Safety Act.

The investigation focuses on a new age assurance process introduced by Pornhub in May 2026 for some users. The process relies on signals from Apple indicating that UK users attempting to access Pornhub may have completed Apple’s own age checks.

Under the Online Safety Act, responsibility for ensuring that age assurance is highly effective rests with the service provider, regardless of where in the process an age check takes place.

Ofcom Questions Pornhub’s Age Assurance Process

Ofcom said it is concerned that Aylo may not have carried out sufficient due diligence and testing before introducing the new process. The regulator is examining whether the system is sufficiently effective in preventing children from encountering pornography.

The investigation will assess whether Aylo complied with two key requirements under the Online Safety Act: using highly effective age assurance to prevent children from seeing pornography and completing a suitable and sufficient assessment of children’s access to the service.

Ofcom will also examine how Aylo implemented the process and whether the necessary due diligence was completed before deployment. The investigation will not determine how Apple operates its own age checks.

George Lusty, Ofcom’s Director of Enforcement, said online age checks are an important protection against children encountering inappropriate or harmful material and that technology companies are expected to ensure such systems are highly effective before deployment.

Ofcom Sets Out Investigation Process for Pornhub Age Checks

Ofcom said its investigation will begin with gathering and analysing evidence to determine whether a breach has occurred. If the regulator finds evidence of a compliance failure, it can issue a provisional decision to the company.

[caption id="attachment_114372" align="aligncenter" width="600"] Image Source: Ofcom[/caption]

Aylo would then have an opportunity to respond to Ofcom’s findings before a final decision is made.

If Ofcom determines that a company has broken the law, it can require the platform to take specific steps to comply with its obligations or address harm caused by the breach. The regulator can also impose fines of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.

Ofcom Expands Enforcement Against Intimate Image Abuse

The investigation comes alongside a separate Ofcom enforcement programme targeting the spread of illegal intimate images, including explicit AI-generated deepfakes.

Ofcom has said platforms should have automated hash matching technology in place by September 30 to detect and prevent the sharing of illegal intimate images. Platforms without hash matching must demonstrate that other systems and processes are equally effective at curbing the spread of non-consensual intimate images, or NCII.

Companies that fail to meet their legal duties could face fines of up to 10% of their global annual revenue.

Ofcom has partnered with SWGfL, which operates the StopNCII.org database and Revenge Porn Helpline, to share information and expertise on tackling intimate image abuse online.

The regulator is also seeking evidence from academics, survivor and victim support groups, and other stakeholders about how women’s and girls’ experiences online have changed.

Ofcom said the evidence will contribute to a report on industry progress in reducing online harms to women and girls. The regulator will also consider whether formal recommendations to the UK government are needed if industry action falls short.

The two enforcement efforts highlight Ofcom’s broader focus on requiring online services to put effective safeguards in place before harmful content or access risks materialise.