Age verification for online services

Online Safety Act requirements

When do you need age verification?

Definitely required for:

• Pornography websites and platforms
• Services with content harmful to children
• Age-restricted products (alcohol, gambling, etc.)

May be required depending on:

• Type and volume of user-generated content
• Risk assessment findings
• Whether service is likely to be accessed by children

Age verification methods

Choosing the right method

Consider these factors:

• Risk level: Higher-risk content needs more robust verification
• User experience: Balance security with usability
• Privacy: Minimise data collection
• Cost: Different methods have different costs
• Accessibility: Methods must work for users with disabilities

Pornography-specific requirements

What pornography sites must do

Self-declaration is NOT acceptable. You must implement robust verification such as:

• Government ID document verification
• Credit card verification
• Open banking verification
• Third-party age verification services

Penalty: Up to 10% of qualifying worldwide revenue, plus possible ISP blocking.

ICO Children's Code

Implementing age-appropriate design

If your service is likely to be accessed by children:

1. Set privacy settings to high by default for children
2. Minimise data collection from children
3. Switch off geolocation by default
4. Don't use nudge techniques encouraging data sharing
5. Provide clear, age-appropriate privacy information

Best practice: Assume children may access your service and design accordingly.

Privacy and data protection

Privacy-preserving verification

Age verification doesn't need to identify users. Consider:

• Zero-knowledge proofs: Verify age without revealing identity
• Attribute-based credentials: Prove "over 18" without sharing birthdate
• Facial age estimation: Estimates age without storing images
• One-time verification tokens: Verify once, use token for future access

Key principle: Verify only what you need to know.

Gaming and gambling

Gambling operator obligations

Remote gambling:

• Verify age before first deposit
• Verify age before free-to-play gambling
• Use reliable verification methods

In-person gambling:

• Implement Challenge 21 or Challenge 25 policies
• Train staff on age verification
• Maintain refusal records

Implementation checklist

1. Risk assessment: Identify what harmful content your service may host
2. Method selection: Choose verification method appropriate to risk
3. Privacy compliance: Ensure UK GDPR compliance, conduct DPIA if needed
4. User journey: Design clear verification process
5. Testing: Test verification effectiveness and accessibility
6. Documentation: Document your approach for regulators
7. Monitoring: Review effectiveness and update as needed