UK Online Safety Act: Ofcom Reports Unprecedented Age Verification Progress Amidst Persistent Challenges

Close to a year after the enactment of the UK’s landmark age assurance legislation, the Online Safety Act, Ofcom, the nation’s communications regulator, has issued a comprehensive report detailing its initial progress and identifying critical areas where improvements are still urgently needed. The report underscores a significant increase in the deployment of age checks across various online sectors, marking a substantial step forward in protecting children online, even as it highlights persistent vulnerabilities, particularly concerning the discoverability of adult content through search engines and the efficacy of certain age verification methods.

The Online Safety Act: A Landmark Legislative Framework

The Online Safety Act, which received Royal Assent in October 2023, represents a pivotal moment in global internet governance. Envisioned as a comprehensive framework to make the UK "the safest place in the world to be online," the Act places significant legal duties on online platforms to protect users, especially children, from illegal and harmful content. A cornerstone of this legislation is the requirement for robust age checks on sites hosting content "restricted to adults." This encompasses a broad spectrum of material, ranging from explicit pornography to non-explicit content that is deemed inappropriate for minors, such as forums discussing topics like smoking cessation, which might inadvertently expose younger users to adult themes.

Before the Online Safety Act, the UK had made previous attempts at statutory age verification, most notably through the Digital Economy Act 2017. However, the implementation of that legislation faced significant hurdles and was ultimately abandoned due to concerns over privacy, technical feasibility, and cross-border enforcement. The Online Safety Act, therefore, sought to learn from these past challenges, empowering Ofcom with unprecedented regulatory authority to enforce compliance, including the power to issue substantial fines, block access to non-compliant sites, and hold senior managers accountable. This robust enforcement mechanism is designed to ensure that tech companies prioritize child safety in their product design and content moderation strategies.

Ofcom’s Initial Findings: A Surge in Age Assurance Deployment

Ofcom’s report paints a picture of substantial, albeit incomplete, progress. The regulator has observed an "unprecedented scale" of age check deployment across diverse online environments, including pornography sites, social media platforms, dating apps, and gaming services. This widespread adoption reflects the industry’s response to the new regulatory landscape and the threat of severe penalties for non-compliance.

Quantifiable progress is evident in several key metrics:

• Increased Effectiveness: Between July 2025, when the law’s age verification provisions began to take effect, and January 2026, the proportion of children encountering "highly effective age checks" when attempting to access age-restricted content significantly increased from 25 percent to 43 percent. This nearly doubling of effective checks within a six-month period indicates a rapid, albeit still insufficient, uptake of robust verification technologies.
• Volume of Checks: A massive surge in the sheer volume of age checks performed further illustrates the impact of the Act. Between July and December of the previous year (presumably 2025, given the context), a sample of 32 services recorded the completion of 69 million age checks. This represents a staggering 23-fold increase compared to the preceding six months, demonstrating the extensive rollout of these new safeguards across numerous platforms.
• Pornography Site Compliance: The report specifically highlights efforts within the pornography sector, a primary target for age verification mandates. As of the previous month (January 2026), all of the UK’s top 10 pornography sites and 64 out of the top 100 most popular pornography sites in the country had implemented age assurance mechanisms. Furthermore, 10 sites had resorted to geo-blocking UK users entirely rather than implementing the required checks, a measure that, while limiting access, still contributes to preventing minors from viewing the content.

Ofcom’s Children’s Passive Online Monitoring study provided further insights into children’s exposure to adult content. It found that eight percent of children aged 8 to 14 who participated in the study had visited pornographic providers. Encouragingly, half of these children only reached sites that had age checks in place. Moreover, the majority of these visits were brief, with 87 percent lasting under 30 seconds and 65 percent for less than 10 seconds, suggesting that many interactions might be accidental or quickly abandoned upon encountering age gates or realizing the content.

Persistent Challenges and Shortcomings

Despite the notable progress, Ofcom’s report is clear that significant gaps remain. The regulator unequivocally stated that "too many porn sites still don’t have age checks in place," leading to the initiation of 23 investigations into providers of 88 adult services. These investigations underscore Ofcom’s commitment to rigorous enforcement and its zero-tolerance approach to non-compliance.

The report also brought to light several critical shortcomings:

• Discoverability via Search Engines: A major vulnerability identified is the ease with which children can still find age-restricted content without checks through popular search engines. The report revealed that a concerning one-third (33 percent) of Google Search results on the first page for certain queries led to porn sites without age checks or geo-blocking. This figure was even higher for Bing, with 54 percent of first-page results similarly lacking safeguards. This highlights a significant blind spot in the current regulatory framework, as the Online Safety Act does not currently mandate search providers to implement age assurance specifically to prevent minors from viewing pornography discovered through their services. While Ofcom stated that Google and Bing are cooperating to "tackle the discoverability of porn sites without age checks via their services," this remains a complex area requiring ongoing attention.
• Dating App Access: The report also raised concerns regarding dating applications, noting that over 10 percent of 15 to 17-year-olds accessed three popular dating apps in December 2025, despite age checks being in place. This indicates that while checks exist, their effectiveness in preventing determined minors from gaining access needs to be significantly enhanced. Platforms must ensure their age verification processes are robust enough to deter and detect underage users.
• Ineffectiveness of Age-Inference Methods: A critical finding of the report is the casting of doubt on the reliability of "age-inference methods." These methods attempt to estimate a user’s age based on their online behavior, patterns, and data, rather than requiring explicit proof of age. Ofcom’s message to social media companies was unequivocal: "Our message to social media companies is clear: those which use age inference models to comply with their child protection duties should switch to other methods listed in our guidance as highly effective without delay." This stern warning emphasizes a shift towards more robust, verifiable age assurance technologies, moving away from methods that are prone to inaccuracies and circumvention.

Broader Implications and Future Regulatory Landscape

The findings of this report carry significant implications for the broader online safety landscape in the UK and potentially internationally. The UK government’s ambitious plans to ban social media for children under 16, as well as the recently announced social media curfew for teenagers aged 16 and 17, will heavily rely on effective age assurance mechanisms. The report’s skepticism regarding age-inference methods is particularly pertinent here, as such bans could be rendered ineffective if platforms continue to rely on easily bypassed age estimation techniques. A recent study on Australia’s social media ban, for instance, suggested its ineffectiveness partly due to age estimations not requiring additional verification for younger users.

The challenge of implementing truly effective age verification without infringing on user privacy or creating significant barriers to legitimate access remains a global debate. Privacy advocates often raise concerns about the collection and storage of sensitive personal data required for robust age checks, such as government-issued IDs or biometric information. However, child safety advocates argue that these measures are necessary to fulfill the duty of care towards minors. Ofcom’s guidance will undoubtedly attempt to strike a balance, advocating for methods that are both effective and privacy-preserving.

Official Responses and Stakeholder Reactions

The UK government, through relevant departments such as the Department for Science, Innovation and Technology, is likely to welcome the progress highlighted by Ofcom while acknowledging the need for further action. Ministers have consistently emphasized the government’s commitment to making the internet safer for children, and this report provides an important benchmark.

Tech companies, particularly those under investigation or those relying on age-inference models, face increased pressure. While many have expressed commitment to child safety, the technical and financial investment required for highly effective age verification can be substantial. Their collaboration with Ofcom, as seen with Google and Bing, will be crucial in addressing the identified shortcomings.

Child safety organizations, such as the National Society for the Prevention of Cruelty to Children (NSPCC) and the Internet Watch Foundation (IWF), are expected to commend the progress but also reiterate the urgent need to close the remaining gaps. They will likely advocate for stronger enforcement against non-compliant sites and for all platforms to adopt the most robust age verification technologies available. The IWF, for example, has long campaigned for mandatory age verification to tackle child sexual abuse material, and this report reinforces the necessity of such measures.

The Path Forward: Ofcom’s Next Steps

Ofcom is not resting on its laurels. The regulator has outlined clear next steps to refine and strengthen the age assurance framework:

• Defining "Highly Effective Age Checks": By the end of October, Ofcom will deliver an assessment to Parliament detailing what constitutes "highly effective age checks" for determining if someone is over 16. This guidance will be critical for platforms subject to the broader social media ban for under-16s, providing clear standards for compliance.
• App-Store Level Age Verification: Looking further ahead, Ofcom is set to publish a comprehensive report on app-store-level age verification by January 2027. This will explore the feasibility and effectiveness of implementing age checks at the point of downloading applications, adding another layer of protection for minors.

The UK’s journey towards a safer online environment for children is complex and evolving. Ofcom’s latest report demonstrates significant strides in the implementation of age verification under the Online Safety Act, showcasing an unprecedented industry response. However, it also serves as a stark reminder of the persistent challenges, particularly concerning the discoverability of adult content through search engines, the need for more robust age checks on dating apps, and the inadequacy of age-inference models. The regulator’s ongoing investigations and future guidance signal a determined effort to ensure that the promise of the Online Safety Act translates into tangible protection for every child online. The success of this ambitious legislative endeavor will ultimately depend on continuous innovation, unwavering regulatory enforcement, and a collaborative commitment from all stakeholders in the digital ecosystem.