Technology & Digital UK-wide

Age verification for online services

How to implement age verification to comply with the Online Safety Act and ICO Children's Code. Covers verification methods, pornography requirements, privacy considerations, and gaming/gambling rules.

Guide summary

You must check the age of users if your online service shows adult content, sells age-restricted products, or is likely to be used by children. Use a strong method – like checking a passport or using credit card details – not just a 'tick box'. You could be fined up to 10% of your global turnover if you do not comply.

  • Use robust age checks for pornography – 'I am 18' is not enough
  • Fines can be up to 10% of your worldwide turnover
  • Collect only the data you need for age checks
  • Do not keep ID documents longer than needed
  • Set high privacy settings for children by default
  • Switch off geolocation for child users by default
  • Check gambling customers' age before they deposit money
  • Design your service as if children might use it
  • Run a Data Protection Impact Assessment if needed
  • Consider privacy-safe methods like zero-knowledge proofs
On this page

Related guides in Digital & Technology

Tech Sector Compliance Overview

Comprehensive guide to regulatory compliance for technology businesses - UK GDPR, data protection, online safety, cybersecurity, and sector-specific …

The Online Safety Act 2023 requires online services to implement age verification or age assurance to protect children from harmful content. Ofcom regulates online content while the ICO oversees data protection aspects.

This guide covers when age verification is required and how to implement it compliantly.

Online Safety Act requirements

When do you need age verification?

Definitely required for:

  • Pornography websites and platforms
  • Services with content harmful to children
  • Age-restricted products (such as alcohol and gambling)

May be required depending on:

  • Type and volume of user-generated content
  • Risk assessment findings
  • Whether service is likely to be accessed by children

Age verification methods

Choosing the right method

Consider these factors:

  • Risk level - higher-risk content needs more robust verification
  • User experience - balance security with usability
  • Privacy - minimise data collection
  • Cost - different methods have different costs
  • Accessibility - methods must work for users with disabilities

Pornography-specific requirements

What pornography sites must do

Self-declaration is NOT acceptable. You must implement robust verification such as:

  • Government ID document verification
  • Credit card verification
  • Open banking verification
  • Third-party age verification services

Penalty: up to 10% of qualifying worldwide revenue, plus possible ISP blocking.

ICO Children's Code

Implementing age-appropriate design

If your service is likely to be accessed by children:

  1. Set privacy settings to high by default for children
  2. Minimise data collection from children
  3. Switch off geolocation by default
  4. Do not use nudge techniques encouraging data sharing
  5. Provide clear, age-appropriate privacy information

Best practice: Assume children may access your service and design accordingly.

Privacy and data protection

Privacy-preserving verification

Age verification does not need to identify users. Consider:

  • Zero-knowledge proofs - verify age without revealing identity
  • Attribute-based credentials - prove "over 18" without sharing birthdate
  • Facial age estimation - estimates age without storing images
  • One-time verification tokens - verify once, use token for future access

Main principle: Verify only what you need to know.

Gaming and gambling

Gambling operator obligations

Remote gambling:

  • Verify age before first deposit
  • Verify age before free-to-play gambling
  • Use reliable verification methods

In-person gambling:

  • Implement Challenge 21 or Challenge 25 policies
  • Train staff on age verification
  • Maintain refusal records

Implementation checklist

  1. Risk assessment - identify what harmful content your service may host
  2. Method selection - choose verification method appropriate to risk
  3. Privacy compliance - ensure UK GDPR compliance, conduct DPIA if needed
  4. User journey - design clear verification process
  5. Testing - test verification effectiveness and accessibility
  6. Documentation - document your approach for regulators
  7. Monitoring - review effectiveness and update as needed