The UK Online Safety Act was passed in 2023, before tools such as ChatGPT were released. Now the rules are being applied to a new category of service. This guide looks at how the UK Online Safety Act AI chatbots age checks fit together, based on an explainer that checked official pages in October 2026, and on wider reporting about the government's plans.

The short version: age checks are becoming a normal gate for AI tools in the UK, and each way of passing that gate hands over a different kind of personal data.

How the Online Safety Act Applies to AI Chatbots

The Online Safety Act was written mainly with social media, search and user-to-user services in mind. Reporting in February 2026 said the UK government pledged to bring AI chatbots under the Act, describing the move as closing a loophole. A government consultation on children's online safety was also reported to include the dangers posed by AI chatbots.

In practice, platforms with communication tools, user-generated content or adult material are expected to enforce "highly effective" age verification. Where a chatbot lets users interact with each other, share content, or produce adult material, those duties can come into play. A chatbot that only talks to one user is a grayer area, and that gap is what the policy debate is about.

The exact legal position can change as consultations conclude and Ofcom updates its guidance. Before relying on any summary, including this one, check Ofcom's own pages for what is currently in force.

Which Age Checks Ofcom Accepts and What Data They Collect

"Highly effective" is the key phrase. A simple tick box saying "I am over 18" does not meet it. Coverage of the rules describes secure verification methods including facial scans, photo ID checks and credit card verification. Each one involves a different privacy trade-off:

  • Facial age estimation: You take a selfie or short video, and software estimates your age. It collects biometric-style image data. The key question is whether the image is deleted immediately or retained, and whether a third-party provider handles it rather than the chatbot company.
  • Photo ID checks: You upload a passport or driving licence. This is generally the most sensitive option, because the document contains your name, date of birth, photo and document number. Even if only a yes or no result is passed on, the verification provider has seen the full document.
  • Credit card verification: A card check can imply an adult account holder. It links the check to payment details, which may be convenient but ties your identity to a financial record.

None of these is risk-free, and the safest choice depends on what you are comfortable sharing and with whom. The point that matters most is often not the method but the intermediary. Many platforms use outside age assurance companies, so you may be handing data to a firm you have never heard of. Look for clear statements on retention, deletion and whether the chatbot provider receives anything beyond a pass or fail.

Other platforms show how this plays out. Microsoft's Windows Age API pushes age signals to the operating system level, and Blizzard has published a Battle.net UK age verification guide for players. Chatbots are joining a growing list of services where proving your age is routine.

Where VPNs Fit Into Age Verification and Access

Whenever age checks arrive, VPN use becomes part of the conversation. A VPN changes the location your traffic appears to come from. That is why people link VPNs to access debates: if a service applies UK rules based on where you appear to be, a different apparent location might change what you see.

That is only part of the picture, and it should be described without overpromising. A VPN does not change who you are. If a service ties age checks to your account, device or payment method, a new IP address does not remove those checks. Providers can also choose to apply their age gates to everyone, not just UK visitors. And using a VPN to get around a service's rules may breach its terms of use, which is a separate risk from any legal question.

What a VPN can legitimately do is protect your connection from local network snooping and mask your IP address from the sites you visit. It does not protect the selfie, ID or card details you choose to submit during a check. Once you hand over that data, the VPN is not part of that transaction.

The bypass question also carries its own privacy lessons. Our report on the Bluesky age verification bypass shows how age assurance systems can have gaps, and why a workaround is not the same as a privacy guarantee.

What This Means For You

If you use AI chatbots from the UK, expect more prompts to prove your age, especially for services that allow adult content or user interaction. You will probably be asked to choose from a short list of methods, and you will often have a say in which one.

Before you verify, ask three things. Who actually runs the check, the chatbot company or a third party? What exactly is stored, and for how long? And do you need this service enough to share that data? For many people, a lower-risk option such as a service that does not require a check at all may be preferable to uploading an ID.

Parents and guardians should note that the stated aim of these rules is child protection. Understanding how checks work can help families decide which tools are appropriate.

Takeaways

  • Check Ofcom's official pages for what is currently in force, since the rules for chatbots are still developing.
  • Compare methods before choosing: facial estimation, ID upload and card checks each expose different data.
  • Find out whether a third-party provider handles your data and what its retention policy says.
  • Do not treat a VPN as a substitute for privacy in the verification step itself.

Understanding what each age check collects before you submit it is the most practical protection you have. For real-world examples of the trade-offs, read our coverage of the Texas court's 90-day deadline forcing Discord age checks and the Bluesky bypass report above. Both show how quickly age assurance rules can reshape what users are asked to share.