Ofcom, the UK's communications regulator, has opened a formal investigation into TikTok over concerns that its age-inference system may not meet the standards required under the Online Safety Act (OSA). At the center of the inquiry is TikTok biometric age verification technology, specifically whether the platform's methods for estimating a user's age from facial scans and other signals are effective enough to keep children away from content and features meant only for adults.

The investigation is still in its early stages, but it marks one of the first times a UK regulator has directly questioned the reliability of biometric age-estimation software at a major platform. For readers who follow online safety regulation, this builds on Ofcom's earlier scrutiny of TikTok's compliance practices, detailed in our coverage of the Ofcom TikTok age verification probe, which first flagged concerns about how the platform handles underage accounts in the UK.

What Ofcom's Investigation Into TikTok Covers

Ofcom's inquiry focuses narrowly on whether TikTok has implemented "effective" biometric age assurance tools, a requirement under the OSA for platforms that host content potentially harmful to minors. The regulator is examining whether TikTok's UK operations are meeting their legal duties, or whether the age-inference system in place is letting underage users slip through or misclassifying adults.

This is not simply a question of whether TikTok has an age-check system. It has one. The question is whether that system actually works as intended, and whether TikTok can demonstrate it does. Ofcom has the authority to demand internal data, testing records, and technical documentation from TikTok to assess this, and the investigation could result in enforcement action if the regulator finds shortcomings.

How Age Inference Systems Collect and Process Biometric Data

Age-inference tools like the one under scrutiny typically work by analyzing a selfie or short video clip and estimating a user's age based on facial characteristics, using a machine learning model trained on large datasets of faces with known ages. The system usually outputs a probability score rather than an exact age, and platforms use that score to flag accounts that might belong to underage users for further review or restriction.

This process involves processing biometric data, one of the most sensitive categories of personal information under UK and EU data protection law. Even when a platform states that images are deleted immediately after the estimate is generated, the underlying scan still requires capturing a live facial image and running it through proprietary software. Users generally have limited visibility into how long that data is retained, how the model was trained, or how accurate it actually is across different ages, skin tones, and lighting conditions.

The Privacy Trade-Offs of Age Verification Under the Online Safety Act

The OSA was designed to protect children online, and few would argue against that goal. But the law's implementation is pushing platforms toward biometric verification methods that carry their own privacy costs. Facial scanning, ID uploads, and other assurance methods mean that both minors and adults may need to hand over sensitive personal data just to access a social media app.

This creates a genuine trade-off. Effective age assurance can reduce children's exposure to inappropriate content, but it also expands the amount of biometric and identity data that platforms, and potentially third-party verification vendors, collect and store. If that data is mishandled, breached, or retained longer than necessary, the consequences could extend well beyond the original safety goal. Ofcom's investigation into TikTok is, in part, a test of whether regulators can hold platforms accountable not just for having an age-check system, but for building one that respects data minimization principles while still functioning reliably.

What This Means For You

If you use TikTok in the UK, you may already have encountered an age-check prompt, or you may see one soon depending on how this investigation unfolds. It is worth understanding that a VPN cannot help you avoid or bypass biometric age verification. These checks are built into TikTok's account systems and tied to your account and device, not your network location, so rerouting your traffic through a different server will not change what the app asks of you.

What a VPN can do is limit other forms of tracking while you use the platform, such as masking your IP address from advertisers or reducing exposure on public Wi-Fi. It is a separate layer of privacy protection, not a workaround for age assurance requirements.

Actionable Takeaways

Before submitting any biometric data to an app, check what the platform's privacy policy says about retention and deletion timelines. Look for whether age verification is handled in-house or by a third-party vendor, since that changes who has access to your data. If you are a parent, review your child's account settings and understand which verification method TikTok is requesting. And keep an eye on how Ofcom's investigation into TikTok progresses, since its findings could shape how every major platform handles biometric age checks in the UK going forward.