Ofcom has published its final guidance on age assurance under the Online Safety Act 2023. It says that robust age checks are a cornerstone of the OSA. It requires services which allow pornography or certain other types of harmful content to introduce “age assurance” to ensure that children are not normally able to encounter it. Age assurance methods – which include age verification, age estimation or a combination of both – must be “highly effective” at correctly determining whether a particular user is a child.
The Ofcom guidance sets out how it expects age assurance to be implemented in practice for it to be considered highly effective. Its approach is designed to be flexible, tech-neutral and future-proof. It expects its approach to be applied consistently across all parts of the online safety regime over time.
It also aims to ensure that privacy rights are protected and that adults can still access legal pornography.
The OSA divides online services into different categories with distinct routes to implement age checks. However, all online services have to start taking action from 16 January 2025:
Requirement to carry out a children’s access assessment.
All user-to-user and search services must carry out a children’s access assessment to establish if their service, or part of their service, is likely to be accessed by children. From 16 January, these services have three months to complete their children’s access assessments, in line with the Ofcom guidance, with a final deadline of 16 April. Unless they are already using highly effective age assurance and can provide evidence of this, Ofcom anticipates that most of these services will need to conclude that they are likely to be accessed by children under the OSA. Services that fall into this category must comply with the children’s risk assessment duties and the children’s safety duties.
Measures to protect children on social media and other user-to-user services.
Ofcom will publish its Protection of Children Codes and children’s risk assessment guidance in April 2025. This means that services that are likely to be accessed by children will need to conduct a children’s risk assessment by July 2025, that is, within three months. Following this, they will need to implement measures to protect children on their services, in line with Ofcom’s Protection of Children Codes to address the risks of harm identified. These measures may include introducing age checks to determine which of their users are under-18 and protect them from harmful content.
Services that allow pornography must introduce processes to check the age of users
All services which allow pornography must have highly effective age assurance processes in place by July 2025 at the latest to protect children from encountering it. The Act imposes different deadlines on different types of providers. Services that publish their own pornographic content including certain generative AI tools, must begin taking steps immediately to introduce robust age checks, in line with Ofcom’s published guidance. Services that allow user-generated pornographic content must have fully implemented age checks by July.
What does highly effective age assurance mean?
In summary, Ofcom’s final position on age assurance:
- confirms that any age-checking methods deployed by services must be technically accurate, robust, reliable and fair to be considered highly effective;
- sets out a non-exhaustive list of methods that Ofcom considers are capable of being highly effective. They include: open banking, photo ID matching, facial age estimation, mobile network operator age checks, credit card checks, digital identity services and email-based age estimation;
- confirms that methods including self-declaration of age and online payments which don’t require a person to be 18 are not highly effective;
- stipulates that pornographic content must not be visible to users before, or during, the process of completing an age check. Nor should services host or permit content that directs or encourages users to attempt to circumvent an age assurance process; and
- sets expectations that sites and apps consider the interests of all users when implementing age assurance – affording strong protection to children, while taking care that privacy rights are respected and adults can still access legal pornography.
Ofcom has decided not to introduce numerical thresholds for highly effective age assurance at this stage (eg 99% accuracy), but it acknowledges that numerical thresholds may complement its four criteria in the future, pending further developments in testing methodologies, industry standards, and independent research.
Enforcement programme launched
Ofcom expects all services to take a proactive approach to compliance and meet their respective implementation deadlines. Ofcom is opening an age assurance enforcement programme, focusing its attention first on Part 5 services that display or publish their own pornographic content. It will contact a range of adult services – large and small – to advise them of their new obligations. Ofcom says that it will not hesitate to take action and launch investigations against services that do not engage or ultimately comply.
