Two months after writing to six of the biggest social platforms, the UK's data protection regulator says the response has fallen short. The Information Commissioner's Office (ICO) reports that none of them has introduced new, viable and privacy-friendly age assurance. The finding puts privacy-friendly age verification UK policy back in the spotlight, and it raises practical questions about what data these checks collect and why VPNs keep coming up in the conversation.

The details in the source report are limited, so this article sticks to what has been confirmed and explains the wider context for readers.

What the ICO Found After Its March Letters

In March, the ICO wrote to Facebook, TikTok, Instagram, YouTube, Snapchat and X. The letters asked each company for an urgent review of how it checks the ages of its users. Two months later, the regulator said that none of the six had introduced new, viable and privacy-friendly age assurance.

The wording matters. The ICO did not say age checks are impossible, and it did not say the platforms have no checks at all. Its criticism is that no new approach has appeared that is both workable and respectful of users' privacy. Those two requirements are often treated as a trade-off, but the regulator appears to expect companies to deliver both.

What Gambling Sites Already Showed About Age Checks

The article that prompted this story makes a pointed comparison: gambling sites had been running age checks for six years before Ofcom asked other services to do the same. That is a useful reference point. It shows that age verification at scale is not a brand new problem, and that at least one heavily regulated sector has operated with it for years.

There are limits to the comparison. A gambling account involves payments, a legal duty to know the customer, and a clear point of sign-up. Social platforms are built around easy onboarding, huge user bases and, in many cases, users who browse without ever creating an account. Still, the gap between six years of experience in one sector and the ICO's two-month finding for six major platforms is the core of the story.

For background on how regulators are now assessing this technology, see our coverage of Ofcom's 2026 age assurance report and the privacy gaps it flags.

What Data Age Verification Can Collect

Not every age check works the same way, and the data involved can differ a lot. Depending on the method a service chooses, a check may involve:

  • Document uploads: a passport or driving licence, which contains your name, date of birth and photo.
  • Facial age estimation: a selfie or short video analysed to guess your age range.
  • Third-party checks: an outside provider confirms your age and passes a result back to the service.
  • Account and device signals: information the platform already holds about you, used to infer age.

The privacy question is less about whether you are asked and more about what happens next. Is the image or document deleted after the check? Does the platform see your identity, or only a yes or no result? Is the data shared with other companies? Those details determine whether an approach could fairly be called privacy-friendly, and they are exactly where the ICO's expectations come in.

Where VPNs Fit Into the Age-Check Debate

VPNs enter this debate because they change your apparent location. A service that applies age checks based on UK rules may treat a connection from elsewhere differently, which is why VPN use is often discussed as a way people try to avoid checks. That is a policy argument, not a privacy solution, and it should not be confused with one.

A VPN encrypts traffic between your device and the VPN server and hides your IP address from the sites you visit. It does not change what a platform knows about your account, and it does not remove data you have already submitted to an age check. If you hand over a document or a selfie, a VPN does nothing to limit how that information is stored or used. Reading the platform's own data practices matters far more.

What This Means For You

For most UK users, the ICO's finding means age checks on major social platforms are still evolving, and the methods you are asked to use may change. Here is what to keep in mind:

  • The regulator expects age assurance to be both effective and privacy-friendly, so you are entitled to ask what a service does with your data.
  • Different methods carry different risks. A one-off yes or no result shared by a third party exposes less than a stored copy of your ID.
  • A VPN protects your connection, not the information you voluntarily submit during a check.
  • Parents and guardians should not assume that a platform's current checks are strong, given the ICO's assessment.

Key Takeaways

The ICO's message is clear: six major platforms were asked to improve, and two months on, none has delivered new, viable and privacy-friendly age assurance. Gambling sites show that age checks are possible, but the real test for privacy-friendly age verification UK users can trust is how little data is collected and how quickly it is deleted.

Before you submit anything to an age check, look at what the platform asks for, who processes it, and how long it keeps it. If a request seems excessive, pause and look for a less invasive option. To go deeper on where current systems fall short, read our piece on the privacy gaps in Ofcom's 2026 age assurance report.