Ofcom says facial age estimation can support a UK social-media gate—but no check is bypass-proof
The regulator identified four methods capable of being highly effective at age 16. Its preliminary assessment is not implementation guidance and did not measure the ban's impact.
The short version
- What happened
- Ofcom identified photo-ID matching, digital identity, banking checks and facial age estimation as methods currently capable of being highly effective for deciding whether someone is at least 16.
- Who it affects
- A child may face a stronger barrier to a restricted platform, while an adult or older teenager may be asked to prove age because a model is uncertain. The privacy burden depends on which second check is offered.
- What remains unproven
- Preliminary regulatory assessment
Keep in mind
Preliminary regulatory assessment
No comparative field trial
No impact assessment
Commercial systems vary
Circumvention remains possible
Binding guidance not yet issued
Source analysis · 1 linked source. Primary analysed source date: 29 October 2026.
Read the full report · 4 min The evidence, methods, implications and limitations
Four possible gates, including an AI-based one
Facial age estimation is one of four methods Ofcom says can currently support a highly effective check that someone is at least 16, according to a 34-page rapid assessment published on 29 October. The others are photo-ID matching, digital identity services and banking-based checks. The assessment is intended to inform Parliament before detailed UK social-media restrictions are laid; it is not yet compliance guidance for platforms.
For facial estimation, Ofcom says some systems can be wrong by a few years around age 16. It therefore recommends a challenge-age approach: a service would set the automatic pass threshold above 16 and ask people in the uncertain range to use a second method. That can reduce the chance that a child is admitted, but it also means legitimate teenagers and adults may need identity evidence when the model is unsure.[1]
Accuracy is only one part of the test
Ofcom assessed methods against technical accuracy, robustness, reliability and fairness, while also considering accessibility, interoperability, privacy and data protection. For AI or machine-learning methods, it expects regular testing and monitoring, diverse training and evaluation data, and checks for discriminatory outcomes. Any method using a live face should include liveness detection to resist photographs, video or other spoofing attempts.
The review ran from June to October 2026 and drew on public evidence, engagement with age-assurance companies, service providers and international regulators, plus Ofcom's regulatory experience. It did not run a single comparative field trial across all four methods. One figure in the accompanying announcement—that an estimated 94% of people aged 16 and over have a passport or driving licence—also relies partly on a non-representative school survey of 8,459 16- and 17-year-olds.[1]
The distinction that matters
How a facial challenge-age check would work
A model estimate would not be the final answer for everyone near the boundary.
Clearly above
Estimate exceeds challenge age
Access can proceed
Uncertain range
Estimate sits near threshold
Request a second check
Possible bypass
Detect spoofing or conflicting signals
Apply mitigation and review
Privacy and bypass risks remain
Every route processes personal information. Ofcom says services must use a lawful, necessary and proportionate method, minimize the data collected and explain retention and reuse clearly. Facial estimation may avoid disclosing an exact identity, but it still involves a face image and a model output. Photo-ID or banking checks can be more decisive while asking people to share a stronger identity signal.
No method is completely resistant to circumvention, and behavioural age-inference models cannot be the main entrance gate because they require activity after a person joins a platform. Ofcom expects draft guidance and consultation after the Government lays regulations, and says it will report on circumvention within twelve months of the ban taking effect. The assessment would strengthen with independent error rates at age 16, demographic subgroup results, real-world bypass tests and evidence about exclusion, privacy and child-safety outcomes.[1]