What happened
On 29 October 2026 Ofcom published a 34-page 'rapid assessment of highly effective age assurance at 16' (requested by the Secretary of State to support the planned under-16 social media ban). It names four methods it considers currently capable of being 'highly effective' at confirming a user is 16+: photo-ID matching, banking-based checks, reusable digital ID services, and facial age estimation (with a 'challenge age' backstop). It says age-inference, location and reporting signals are not acceptable standalone proof but can support circumvention detection. In a separate 48-page report the same day Ofcom said app stores could play a complementary role but should not bear the primary duty. The Information Commissioner's Office (Katie Searle) responded that age assurance 'must be implemented in a way that keeps people's personal information safe and allows them to exercise their information rights', and is separately assessing how age-assurance providers comply with data-protection law.
Why it matters
This effectively endorses AI-driven facial age estimation as a lawful, 'highly effective' basis for denying minors access to social media, and signals a joint Ofcom/ICO expectation that age checks be both 'highly effective' and data-minimised. It creates a clear regulatory trajectory for any platform deploying biometric age verification in the UK ahead of a ban that takes effect in March 2027, and sets the compliance bar for AI age-assurance vendors on retention, reuse of ID images and the ability to exercise data-subject rights.
Action needed
Platforms deploying (or being pushed toward) age assurance in the UK should map the four accepted methods, ensure facial age estimation uses appropriate thresholds and minimal data (avoid retention/reuse of ID images), and prepare to demonstrate data-minimisation and ICO rights compliance — the government plans first regulations before end-2026, with Ofcom guidance to follow.