UK Age Checks Expand Beyond Porn Sites Under Safety Act

A Law Built for Porn Sites Now Covers Much More

When the UK's Online Safety Act 2023 first made headlines, most people assumed it was about one thing: keeping children away from pornography websites. That was the starting point, but as legal commentator John Carr explains, the law's reach is considerably broader. The Act requires a range of online services, not just adult content platforms, to use what regulators call 'highly effective' age assurance mechanisms.

That phrase, 'highly effective,' is doing a lot of work. It sets a legal bar that platforms must clear, and it's pushing companies toward verification methods that go well beyond a simple checkbox asking whether a user is over 18. Understanding what counts as 'highly effective' and which sites now fall under this requirement matters for anyone who uses the internet in the UK, because the compliance choices companies make directly affect how much personal data they collect and how long they keep it.

What 'Highly Effective' Age Assurance Actually Requires

Under the Online Safety Act, age assurance isn't limited to a single method. Platforms can choose from a menu of approaches, including document-based ID checks, facial age estimation, credit card verification, or third-party verification services. The common thread is that regulators expect these tools to produce a reliable, defensible result, not just a self-declared age that anyone can lie about.

The expansion of this requirement to 'other kinds of sites and services' beyond pornography is the part that deserves more attention. As covered in vpn.social's broader look at how age verification laws are spreading across the UK, EU, and US in 2026, this isn't a UK-only trend. Regulators in multiple jurisdictions are converging on similar frameworks, meaning platforms that operate internationally are increasingly building age-check infrastructure that could become a global default rather than a UK-specific carve-out.

For a full breakdown of how these requirements differ by country and what technologies underpin them, vpn.social's guide to age verification laws worldwide is a useful reference point for readers trying to keep track of a fast-moving regulatory picture.

The Privacy Trade-Off Nobody Asked For

Here's the tension at the heart of this policy. Age assurance, by design, requires platforms to learn something sensitive about you: your age, and often your identity, biometric data, or payment details used to infer it. Even when providers promise not to store this data long-term, the verification process itself creates a moment of exposure, a record of who accessed what, when, and how.

This is not a hypothetical concern. Enforcement actions are already surfacing problems. Ofcom's investigation into TikTok's age checks shows regulators actively scrutinizing whether platforms' verification systems are working as intended, and where they might be falling short. Meanwhile, Bluesky's age verification bypass demonstrated that even well-intentioned compliance efforts can leave privacy gaps that undermine the whole point of the exercise.

And predictably, many users, including minors the law is meant to protect, are simply routing around these checks. UK government research has found that a notable share of children use VPNs specifically to dodge the age verification systems put in place under the Online Safety Act. That statistic underscores a real limitation of the current approach: mandating age checks doesn't guarantee compliance, it often just shifts behavior toward workarounds.

What This Means For You

If you use online services based in or accessible from the UK, expect to encounter age assurance prompts on a growing number of platforms, not just adult sites. Before you hand over an ID scan, a selfie for facial estimation, or payment details, it's worth asking a few questions: What data is being collected? How long is it retained? Is the verification handled by the platform directly or outsourced to a third party you've never heard of?

You don't have to accept every verification request at face value. Look for platforms that use privacy-preserving methods, such as age estimation that doesn't store raw biometric data, or third-party attestation services that confirm you're old enough without revealing your exact identity to the platform itself. If a service's age-check process feels excessive relative to its content, that's a reasonable signal to be cautious.

Key Takeaways

The UK Online Safety Act's age assurance requirements are broader than most people realize, extending well past pornography sites into other categories of online services. As this regulatory model spreads internationally, users should stay informed about which sites require age verification, understand what data these checks actually collect, and favor privacy-conscious verification methods where they exist. Read the terms before you verify, ask what happens to your data afterward, and remember that regulatory compliance and genuine privacy protection aren't always the same thing.