Nearly a year after the UK's Online Safety Act began requiring robust age checks on adult content sites, Ofcom, the country's communications regulator, has published a progress report assessing how the rules are working in practice. The findings mark one of the first official looks at how age verification law is reshaping the online experience for millions of UK users, and they raise as many privacy questions as they answer.
What the Online Safety Act Actually Requires
The Online Safety Act was designed to keep children away from content deemed "restricted to adults," a category that goes well beyond pornography. It also covers certain social media features, dating platforms, and gaming services where age-inappropriate content or contact could occur. Under the law, companies operating in these spaces must implement age assurance measures that Ofcom considers "highly effective," rather than relying on simple self-declared birthdates or checkbox confirmations.
Ofcom's report describes this as a significant, wide-reaching rollout across sectors that previously had little to no meaningful age-gating in the UK. That expansion is notable because it means a growing number of services now ask users to prove they are adults before granting access, often through document uploads, facial age estimation, or third-party verification services.
Why Privacy Advocates Are Watching Closely
The core tension in Ofcom's report is one that regulators, companies, and privacy advocates have wrestled with since the law was first proposed: age verification only works if platforms collect some form of identifying or biometric data, and that data has to go somewhere. Whether it is a scanned ID, a selfie used for facial age estimation, or a payment card checked against an age database, each method creates a new record tied to a real person's adult content habits or account activity.
This is not a hypothetical concern. Ofcom has already opened investigations into how at least one major platform verifies age. The regulator is formally examining TikTok's biometric age-inference tool over concerns that the system may not meet the standards the Online Safety Act demands, and a related child safety probe into TikTok's verification practices is also underway. These cases illustrate a broader pattern: even when platforms implement age checks, the effectiveness and privacy safeguards of those systems vary widely and are not always transparent to the people using them.
Ofcom's one-year report does not resolve this tension. It documents that age checks are now widespread, but widespread adoption is not the same as privacy-protective adoption. A user asked to upload a passport scan to access an adult website is trusting that the company, and any third-party verification vendor involved, will store, secure, and eventually delete that data responsibly. The Online Safety Act sets requirements for effectiveness, but users still have limited visibility into how their verification data is actually handled behind the scenes.
The Bigger Picture: A Global Pattern
The UK is far from alone in pursuing this kind of regulation. Age verification requirements are spreading across multiple countries, each with its own approach to enforcement, technology standards, and privacy protections. For readers trying to understand how the UK's approach compares internationally, our guide to age verification laws worldwide breaks down the different models regulators are using and what they mean for everyday internet users.
That global context matters because it shows the privacy tradeoffs in Ofcom's report are not unique to the UK. Wherever age verification laws take hold, the same basic question follows: how much personal data should someone have to hand over just to prove they are old enough to see certain content, and who is accountable if that data is mishandled.
What This Means For You
If you use adult content sites, dating apps, or social platforms in the UK, you have likely already encountered new age-check prompts over the past year, and Ofcom's report confirms this rollout is now happening at scale. Before completing any age verification process, it is worth checking what method a site uses (document upload, facial estimation, or a third-party verification service) and reading how long that data is retained. Our guide to the privacy risks of digital age checks walks through what to look for and how to limit your exposure when a verification step is unavoidable.
It also helps to remember that not every age-check implementation is equally trustworthy. Ofcom's ongoing scrutiny of major platforms shows regulators themselves are still testing whether specific systems meet the legal bar for effectiveness and data handling.
Takeaways for UK Internet Users
Ofcom's first-year report on the Online Safety Act confirms that age verification law in the UK is now a fixture of daily browsing rather than a temporary adjustment. Before entering personal information into any age-check system, consider whether the request is proportionate, review the platform's data retention policy if one is published, and stay alert to news of regulatory investigations, since those often reveal which verification methods fall short of privacy expectations. As enforcement matures, staying informed will be the simplest way to protect both your access and your data.
