Legal Implications of the UK’s Online Safety Act on Age Verification for Online Service Providers

The UK’s Online Safety Act brings in new rules for age verification on certain online services. If your service provides pornography or other harmful content, you’ll need to implement ‘age assurance’ to prevent children from accessing it. In this article, we’ll go over the specific rules you need to follow if your service is affected by these changes in the UK.

What are services required to do, and by when?

The Online Safety Act is a new set of laws designed to protect both children and adults online in the UK. It implements a range of rules affecting online service providers, including age verification requirements. The Act’s age verification rules apply to services hosting pornographic content or other types of harmful material. If your service falls into this category, you must:

• implement age verification or age estimation (or both) to ensure that children (users under 18 years of age) cannot normally access regulated pornographic content; and
• ensure the age verification and/or age estimation methods are highly effective at determining whether the user is a child.

Services publishing their own pornographic content, including certain Generative AI tools, must start implementing robust age checks immediately. Meanwhile, services that allow user-generated pornographic content must have age checks fully implemented by July 2025.

What does highly effective age assurance mean?

Highly effective age assurance is a cornerstone of the Online Safety Act. Ofcom, the regulator for online safety in the UK, has published guidance to help understand what this concept entails:

• age-checking methods deployed must be technically accurate, robust, reliable, and fair to be considered highly effective;
• methods such as self-declaration of age and online payments that don’t require a person to be 18 are not highly effective;
• pornographic content must not be visible to users before or during the process of completing an age check, nor should services host or permit content that directs or encourages users to attempt to circumvent an age assurance process; and
• sites and apps must consider the interests of all users when implementing age assurance – affording strong protection to children while respecting privacy rights and ensuring that adults can still access legal pornography.

While Ofcom has not set numerical thresholds for highly effective age assurance (e.g., 99% accuracy), such thresholds may be introduced in the future. This will depend on further developments in testing methodologies, industry standards and independent research.

Methods of age assurance

A range of age assurance methods may be appropriate, with some considered more effective than others. Examples of methods that meet the criteria for “highly effective” age assurance include:

How can we help?

If you need legal advice on ensuring compliance with the Online Safety Act or need help navigating the age assurance requirements for your service, our experienced team is here to assist.