What age verification methods is Ofcom proposing for the UK under-16 ban?

Ofcom has outlined three options: facial age estimation, banking checks, and digital ID. These methods would confirm that a user is old enough to have an account.

How does facial age estimation work as an age check?

Facial age estimation involves software analyzing a face, typically via a face scan or selfie, to estimate whether a person is above or below an age threshold. The sensitive input is biometric, though the method does not need to know your name.

Which verification method is most directly linked to identity?

Digital ID is the most directly identity-linked option, as it ties age confirmation to a verified identity. This raises questions about how often and where that identity is presented, and whether a single credential becomes a common key across many services.

Why do VPNs come up in the age verification debate?

VPNs often come up whenever age rules tighten because they change your apparent location. The article notes this connection but does not provide further details on their role.

Ofcom Outlines Age Check Options for UK Under-16 Ban

Q: What kind of data trail does a banking check create?

Banking checks link your social media access to a financial relationship, and even if a platform only receives a yes-or-no answer, a bank or intermediary may know a check was requested. This creates a different kind of identity link tied to a regulated financial record.

Ofcom social media age verification proposals are taking shape ahead of the UK's planned under-16 ban, and the options on the table are facial age estimation, banking checks and digital ID. According to reporting from Sigmalive English, these are the methods outlined as ways for platforms to confirm that a user is old enough to have an account.

The source summary is brief, so it is worth being clear about what is known and what is not. The three methods have been named. Details such as which platforms must use which method, how long data is kept, and when enforcement begins are not set out in the material we have, so we will not guess at them. What we can do is explain what each type of check generally involves and why the privacy picture differs for each.

What Ofcom is proposing for under-16 age checks

The proposals ahead of the UK's under-16 ban centre on three routes to proving age:

Facial age estimation, where software analyses a face to estimate whether a person is above or below an age threshold.
Banking checks, which rely on financial account information to confirm a user is an adult or above a certain age.
Digital ID, where a government-linked or otherwise verified digital identity is used to confirm age.

The common thread is that a social media account, which many people have used with little more than an email address, would become connected to some form of real-world verification. That shift is the core privacy question, regardless of which method a platform chooses.

What each method means for your data

Each option creates a different kind of data trail. The differences matter more than the headline that "age checks are coming."

Facial age estimation involves a face scan or selfie. The sensitive input here is biometric: an image of your face. Whether that image is deleted immediately or retained depends on how a given provider and platform handle it, which is a question users should look for in privacy notices. The upside is that estimation, by its nature, does not need to know your name.

Banking checks link your social media access to a financial relationship. Even if a platform only receives a yes-or-no answer, a bank or intermediary may know a check was requested. That is a different kind of identity link, tied to a regulated financial record rather than a face.

Digital ID is the most directly identity-linked option. It ties age confirmation to a verified identity, which can be convenient but raises questions about how often and where that identity is presented, and whether a single credential becomes a common key across many services.

None of these is automatically safe or unsafe. The practical privacy test is the same in each case: what is collected, who receives it, how long it is kept, and whether the platform learns only your age status or something more.

Where VPNs fit in the age verification debate

VPNs often come up whenever age rules tighten, because they change your apparent location. But it is important to be realistic about their limits.

A VPN can hide your IP address from the sites you visit and encrypt traffic between your device and the VPN server. It does not change who you are. If a platform asks you to complete a face scan, a banking check or a digital ID step when you sign in or open an account, the check is tied to you, not to your network location. Connecting through a different country does not remove the account-level requirement if the service applies it to UK users based on other signals, or to everyone.

There is also a privacy point that cuts the other way. A VPN does not protect data you hand over voluntarily. If you submit a selfie or ID to a verification provider, the VPN is not part of that exchange in any meaningful privacy sense. Readers should also be aware that platform terms may restrict circumventing location-based rules, so using a VPN to evade a check could put an account at risk. We cannot say from the source how Ofcom or platforms will treat VPN use, so treat that as an open question.

How other countries are handling the same trade-offs

The UK is not alone in weighing child safety against identity exposure. Malaysia, as it moves toward full implementation of its Online Safety Act 2025, has opened a similar debate over how to verify the age of social media users. Our report on Malaysia's MyKad age checks and the privacy backlash shows how tying age confirmation to a national identity document can draw concern about data and surveillance.

The comparison is useful because it shows the same trade-off from a different angle: the stronger the identity link, the more reliable the check may be, and the larger the potential data trail.

What This Means For You

If you live in the UK, expect age checks to become a more routine part of using social media as the under-16 ban approaches. You will probably have some say in how you verify, depending on what each platform offers, so it helps to decide in advance which trade-off you are most comfortable with.

Parents and young people should also expect the checks to reach beyond a single app. A method you choose for one service may be requested again elsewhere.

Actionable takeaways

Read the verification notice before you submit a face scan, bank details or digital ID. Look for retention periods and whether a third party performs the check.
Prefer the method that shares the least. If a service only needs to know you are over a threshold, favour the option that returns just that answer.
Do not rely on a VPN as a workaround. It protects your connection, not your identity, and may breach platform terms.
Keep software and accounts secure, since verified accounts become more valuable targets.
Weigh the privacy costs of each method and compare how Malaysia's approach has played out in our piece on MyKad-based age checks.

Ofcom social media age verification is still developing, and the details will matter. Staying informed about what each check collects is the best way to protect your privacy while the rules settle.