As preparation for the UK’s planned social media ban, Ofcom has set out four ways social media platforms could check whether users are aged 16 or over. The government and Parliament will decide how the ban works in practice.
Ofcom is the regulator for the communications services in the UK. The BBC reports that Ofcom identified four ways to check someone’s age that it considers “highly effective.”
Here’s what those checks would involve:
- Photo ID matching: Comparing a live image of you with the photo on an identity document, such as your passport, and checking the age information on that document.
- Bank-based checks: Using age information your bank already holds about you, with your consent.
- Facial age estimation: Using technology to estimate your age from your face. Ofcom says this technology has improved recently.
- Digital ID services: Using a digital identity service to prove your age, rather than presenting a physical document.
Let’s think through what those checks could mean.
Challenges
The challenge isn’t simply checking someone’s age. It’s doing so without turning everyday internet use into an identity check.
Photo ID matching brings highly sensitive documents and facial images into the process, which raises questions about how that information is handled and protected. The risks aren’t hypothetical: as I reported last year, a breach at a third-party support provider for Discord exposed government ID images belonging to around 70,000 users.
Banking-based checks can be more privacy-preserving if they return only confirmation that someone meets the age threshold, rather than exposing financial information. But the important questions are what information each party receives, what gets retained, and whether the check can be linked to someone’s activity.
Facial age estimation can avoid uploading an identity document, but it still processes a sensitive image and makes an imperfect prediction. Ofcom acknowledges that some technologies can be wrong by a few years around age 16, so people near the threshold may face an additional verification check.
I would expect these checks to stop some underage access but not eliminate it.
Previous restrictions have been followed by workarounds, including increased VPN use, borrowed credentials, and migration to services outside the restrictions. The danger is treating a successful age gate as proof that children are now safe, when it might push them into less regulated spaces.
The effectiveness depends on how the checks are implemented. A VPN may help someone avoid a check triggered by their apparent location; it won’t, by itself, bypass an identity or facial check that is still required.
Similarly, Ofcom says matching a live image to an ID is intended to make it harder to borrow someone else’s document. We shouldn’t assume every workaround defeats every method. But Ofcom accepts that some motivated children will get through. The meaningful test is how much harm these measures prevent, weighed against the privacy risks and barriers they introduce— not whether every user has completed a check.
My personal preference is double-blind verification: a provider confirms that you meet the age requirement without learning which service you’re accessing, while the service receives proof of age without learning your identity. Proving you’re old enough shouldn’t mean revealing who you are.
Scammers don’t need to hack you. They just need you to click once.
Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.
