While some circumvention of forthcoming restrictions is inevitable, Ofcom has nevertheless identified four methods that could help prove whether a social media user is over 16
Correctly implementing HEAA should significantly reduce the number of children accessing restricted services
On 29 October 2026, in the UK, Ofcom published a rapid assessment of what highly effective age assurance (HEAA) looks like to determine whether someone is aged 16 or over. The aim of the assessment is to inform Parliament’s consideration of the Government’s forthcoming draft regulation on age restrictions for online services. The regulation is set to include a ban on under-16s using social media, restrictions on risky features (such as livestreaming and contact from strangers) and default settings for 16- and 17-year-olds. The Government has stated that it will use the same model for a social media ban as Australia, but with HEAA in place of Australia’s “reasonable steps” age-assurance standard to make it harder for children to bypass safeguards. Ofcom stated that no age assurance method is completely robust against circumvention by children; however, correctly implementing HEAA in full, including practical measures to tackle circumvention, should significantly reduce the likelihood of under-16s accessing restricted services or functions. Ofcom expects some children to attempt to get around age checks, for example by using virtual private networks (VPNs), and will publish a report on circumvention within 12 months of the restrictions coming into effect.
There are fewer effective age-assurance methods to prove a user is over 16 than 18
Ofcom’s assessment found that four methods are capable of meeting the criteria of technical accuracy, robustness, reliability and fairness for checking if a user is 16 or over, with a further three that can be used at 18:
HEAA methods at 16 and 18: Photo ID matching, banking information, digital identity services and facial age estimation (with a challenge age);
HEAA methods at 18 only: Credit card verification, mobile network operator checks and email estimation; and
Methods not considered highly effective at any age: Self-declaration, general contractual agreements and verifiable parental consent.
According to Ofcom, facial age estimation has a larger margin of error for ages close to the target age. This could result in significant numbers of under-16s gaining access to restricted services, or in 17-year-olds being wrongly denied access. Ofcom has therefore recommended that services implement a “challenge age” set according to the technology’s margin of error. For example, with a challenge age of 19, users estimated to be between 16 and 19 would need to complete an additional age check.
HEAA methods for 16-17-year-olds would likely require a photo ID at some point, raising accessibility concerns
Ofcom highlighted that accessibility issues are heightened for age assurance at 16, as there are fewer HEAA methods available for this age group. It also found that 16- and 17-year-olds are more likely than other age groups to need a photo ID, because:
The method itself requires one;
Photo ID is part of the underlying process for accessing another method, such as opening a bank account or using a digital identity service; or
A 16- or 17-year-old will most likely fall within the challenge age for facial age estimation and be asked to prove their age using a secondary method.
Passport ownership for this age group is around 89%, but (provisional) driving licence ownership is only 19% at 16 and 65% at 17, and roughly 150,000 16-17-year-olds hold neither. If the UK Government were to adopt the HEAA of this kind, it would go beyond Australia’s requirement for platforms to take “reasonable steps” to prevent under-16s from holding accounts. However, it would stop short of jurisdictions such as the EU, Greece and Turkey, which all have their own (and different) age assurance systems, such as the EU Digital Identity Wallet – see Figure.
