United Kingdom
The Online Safety Act 2023 imposes two overlapping age assurance regimes enforced by Ofcom: Part 3 requires user-to-user and search services likely to be accessed by children to complete children's risk assessments and adopt safety measures, including highly effective age assurance for pornography and other primary priority content, under Ofcom's Protection of Children Codes of Practice in force since 25 July 2025, while Part 5 separately requires dedicated, non-user-generated pornography providers to use highly effective age verification or estimation since 17 January 2025. Ofcom opened dozens of Part 5 and Part 3 age assurance investigations through 2025 and issued its first age assurance fines, including GBP 1,000,000 against AVS Group Ltd in December 2025 and GBP 50,000 against the Undress.cc nudification site in November 2025. The Information Commissioner's Office's Age Appropriate Design Code (Children's Code), a statutory code under the Data Protection Act 2018 in force since 2 September 2020, sets 15 standards for privacy protective design of services likely to be accessed by children. There is no dedicated UK app store or device level age verification statute, only a duty on Ofcom under the Online Safety Act to report on app stores' role in children's online safety. On 15 June 2026 the government announced a social media ban for under-16s, to be made by regulations under section 214A of the Online Safety Act 2023, expected to be laid before Parliament by the end of 2026 and in force in spring 2027.
National jurisdiction. Reviewed 2026-07-16.
Ofcom Guidance on Highly Effective Age Assurance and Other Part 5 Duties
Ofcom's statutory guidance under section 82 of the Online Safety Act 2023 sets out what counts as highly effective age assurance for Part 5 pornography providers, naming photo ID matching, facial age estimation, credit card checks, open banking checks, and mobile network operator checks as capable methods, and stating that self declaration or a basic checkbox is not sufficient.
- Citation
- Statement: Age Assurance and Children's Access, Ofcom, published 16 January 2025
- Status
- In force
- Effective date
- 2025-01-17
- Applies to
- Private sector
- Verification methods
- gov id, facial estimation, transactional data, third party service, device signal
- Covered services
- Providers of regulated provider pornographic content under Part 5 of the Online Safety Act 2023.
- Enforcement body
- Ofcom
- Source
- Statement: Age Assurance and Children's Access, Ofcom, published 16 January 2025
Online Safety Act 2023, Part 5 (duties of providers of regulated provider pornographic content)
Requires providers that publish or display their own, non-user-generated pornographic content to ensure, using age verification or age estimation or both, that children cannot normally encounter that content. The method used must be highly effective at correctly determining whether a user is a child, and providers must keep written records and publish a public statement on the methods used. The duty in section 81 came into force on 17 January 2025.
- Citation
- Online Safety Act 2023, c. 50, ss. 79-82 (Part 5)
- Status
- In force
- Effective date
- 2025-01-17
- Applies to
- Private sector
- Age threshold
- 18
- Verification methods
- gov id, facial estimation, digital id, third party service, transactional data
- Covered services
- Internet services that publish or display their own pornographic content (not user-generated), with a UK user base or that target the UK market.
- Penalties
- Fines up to the greater of GBP 18,000,000 or 10 percent of qualifying worldwide revenue, plus daily penalties for continuing non-compliance and potential business disruption measures.
- Enforcement body
- Ofcom
- Private right of action
- no
- Litigation
- Ofcom investigation into Itai Tech Ltd (Undress.cc nudification site), Ofcom found the provider failed to use highly effective age assurance to prevent children encountering pornographic content and imposed a GBP 50,000 fine, plus a GBP 5,000 fine for failing to respond to a statutory information request, decision published 20 November 2025.
- Source
- Online Safety Act 2023, c. 50, ss. 79-82 (Part 5)
Age Appropriate Design Code (Children's Code)
Requires providers of information society services likely to be accessed by children in the UK to apply 15 standards of age appropriate design, such as privacy by default, data minimisation, and not using nudge techniques that weaken children's privacy protections, under a statutory code of practice issued by the Information Commissioner under the Data Protection Act 2018. The code came into force on 2 September 2020 with a 12 month transition period ending 2 September 2021, after which the Commissioner and courts must take it into account when assessing UK GDPR compliance.
- Citation
- Data Protection Act 2018, ss. 123-125; Age Appropriate Design Code of Practice, Information Commissioner's Office
- Status
- In force
- Effective date
- 2020-09-02
- Applies to
- Private sector
- Age threshold
- 18
- Verification methods
- self declaration, facial estimation, gov id
- Covered services
- Information society services, including apps, websites, connected toys and devices, and online games, likely to be accessed by children in the UK.
- Penalties
- Enforcement under UK GDPR: fines up to the greater of GBP 17,500,000 or 4 percent of global annual turnover for the most serious infringements.
- Enforcement body
- Information Commissioner's Office
- Private right of action
- no
- Source
- Data Protection Act 2018, ss. 123-125; Age Appropriate Design Code of Practice, Information Commissioner's Office
Ofcom Protection of Children Codes of Practice
Sets out the measures Ofcom expects user-to-user and search services likely to be accessed by children to adopt to comply with the Online Safety Act's children's safety duties, including age assurance, safer default settings and algorithms, and content moderation; providers that follow the Codes are treated as compliant. Ofcom published the final Codes on 24 April 2025; providers had to complete children's risk assessments by 24 July 2025 and have risk mitigation measures in place from 25 July 2025, after the Codes completed the required Parliamentary process.
- Citation
- Protection of Children Codes of Practice (illegal content and user-to-user/search services), Ofcom, April to July 2025
- Status
- In force
- Effective date
- 2025-07-25
- Applies to
- Private sector
- Verification methods
- facial estimation, gov id, third party service, device signal, self declaration
- Covered services
- User-to-user services and search services likely to be accessed by children in the UK.
- Penalties
- Fines up to the greater of GBP 18,000,000 or 10 percent of qualifying worldwide revenue; business disruption measures for serious or repeated breaches.
- Enforcement body
- Ofcom
- Source
- Protection of Children Codes of Practice (illegal content and user-to-user/search services), Ofcom, April to July 2025
Online Safety Act 2023, Part 3 (children's risk assessment and safety duties)
Requires providers of user-to-user services and search services likely to be accessed by children in the UK to carry out children's risk assessments and to use proportionate measures, including age verification or age estimation where appropriate, to prevent children encountering primary priority content harmful to children such as pornography, self harm, suicide, and eating disorder content. Sections 11 and 12 came into force on 10 January 2024.
- Citation
- Online Safety Act 2023, c. 50, ss. 11-12 (Part 3)
- Status
- In force
- Effective date
- 2024-01-10
- Applies to
- Private sector
- Age threshold
- 18
- Verification methods
- facial estimation, gov id, third party service, self declaration
- Covered services
- User-to-user services and search services likely to be accessed by children in the UK, with additional duties on Category 1 (large) platforms.
- Penalties
- Fines up to the greater of GBP 18,000,000 or 10 percent of qualifying worldwide revenue.
- Enforcement body
- Ofcom
- Litigation
- Ofcom confirmation decision against AVS Group Ltd, Ofcom found AVS Group's photo upload age check lacked liveness detection and could be circumvented by children, in breach of section 12, and imposed a GBP 1,000,000 fine plus a GBP 50,000 fine for failing to respond to a statutory information request, with a running penalty of GBP 1,000 per day for continuing non-compliance. Confirmation decision dated 3 December 2025.
- Source
- Online Safety Act 2023, c. 50, ss. 11-12 (Part 3)
Under-16 social media minimum age regulations (announced), Online Safety Act 2023 section 214A
On 15 June 2026 the government announced it will ban under-16s from social media platforms that allow content posting and use algorithmic recommendation feeds (naming Snapchat, TikTok, YouTube, Instagram, Facebook, and X), with messaging services excluded and narrow exemptions for education, e-commerce, and music streaming. The ban will be made by statutory instrument under section 214A of the Online Safety Act 2023 rather than a new bill, with regulations expected to be laid before Parliament by the end of 2026 and protections in force in spring 2027. The announcement followed the Growing Up in the Online World national consultation (2 March to 26 May 2026, over 116,000 responses), whose government response was published on 15 July 2026. Ofcom is to complete a rapid study on highly effective age assurance for under-16s in autumn 2026.
- Citation
- Regulations to be made under Online Safety Act 2023 s. 214A, as inserted by the Children's Wellbeing and Schools Act 2026
- Status
- Proposed
- Effective date
- Not yet effective
- Applies to
- Private sector
- Age threshold
- 16
- Covered services
- User-to-user social media platforms that allow content posting and use algorithmic recommendation feeds; messaging services excluded, with narrow exemptions for education, e-commerce, and music streaming services.
- Enforcement body
- Ofcom (expected, under the Online Safety Act 2023 framework)
- Source
- Regulations to be made under Online Safety Act 2023 s. 214A, as inserted by the Children's Wellbeing and Schools Act 2026
Reviewed 2026-07-16. Confidence: high. Fast-moving area, verify before relying. Not legal advice.