Age Assurance at 16: Ofcom’s Privacy and Access Test

Written by Safegram Editorial Team

Age assurance can help establish whether someone meets an age threshold without making a full identity document available to every service. But a successful technology test is not the same as an accessible, privacy-respecting user journey. Ofcom’s assessment of 29 October 2026 identifies four methods capable of being highly effective at 16 and highlights the people who may struggle to use them. [1][2]

Key takeaways

Ofcom identifies photo-ID matching, banking information, digital identity services and facial age estimation as potentially highly effective at 16. [1][2]
Its estimate of around 150,000 UK 16- and 17-year-olds without a passport or driving licence is not a count of rejected users. [1]
A proportionate check needs clear information, alternatives where appropriate and a way to correct a mistaken result. Identity and age checks do not replace wider safety measures. [2][3]

Four methods, different trade-offs

Photo-ID matching compares a document with the person presenting it. Banking-based checks use age information held by a financial institution with the user’s consent. Digital identity services can let a person verify once and present an age credential again. Facial age estimation infers age from a face rather than reading an established date of birth. [1]

Each has constraints. Someone needs access to suitable documents or records, and some routes depend on earlier identity checks. Facial estimates can be uncertain close to a threshold. Ofcom describes a “challenge age” approach: seek stronger evidence when the estimate is too close, rather than treating it as an infallible answer. A particular supplier or implementation is not automatically approved merely because it uses one of these methods. [1][2]

The assessment considers accuracy, robustness, reliability and fairness, alongside accessibility and interoperability. Those criteria are useful together: a system that rejects eligible people unfairly has not solved the access problem simply because it detects many underage users. [2]

Hands examine a plain identification card beside a phone.

Hands examine a plain identification card beside a phone. AI-generated editorial illustration; not a photograph of a named event or research participant.

What the 150,000 estimate does—and does not—show

Ofcom cites evidence suggesting around 150,000 UK 16- and 17-year-olds hold neither a passport nor a driving licence. Its note attributes the estimate to CitizenCard evidence drawn from a non-representative survey of 8,459 respondents in that age range. It indicates a possible access barrier; it is not a population census, a measured rejection rate or a prediction that every one of these teenagers will be excluded. [1]

Ofcom also notes alternative proof-of-age cards, including some free PASS-accredited options. Their existence matters, but a designer should still test the actual path a person can complete. “Another document exists” does not establish that every user already has it or can obtain it immediately. [1]

Imagine, illustratively, a person who has just turned 16, looks younger to an estimator and has no suitable ID to hand. A useful service explains why the first result was inconclusive, offers a permitted alternative and provides a route to challenge mistakes. Asking everyone for more data just because some users need a fallback creates a different privacy risk. This example is not a measured outcome on any named platform.

Two young adults compare information on a phone in a café.

Two young adults compare information on a phone in a café. AI-generated editorial illustration; not a photograph of a named event or research participant.

An age answer need not become an identity dossier

The UK Information Commissioner’s Office says age assurance should be necessary and proportionate to the risks. In some situations, recording whether a threshold is met can be sufficient; collecting an official document may be excessive when a less intrusive method is appropriate. Age-check information should not be repurposed incompatibly. [3]

The EU’s age-verification solution is designed around a related distinction: proving an age threshold without revealing other personal information to the requesting service. The Commission says its blueprint became feature-ready on 15 April 2026 and can be adapted by member states and market participants. Technical readiness is not the same as universal deployment or a guarantee about every implementation. [4]

For users, the practical questions are who receives the document or face image, what the requesting app learns, how long data is kept and how an error can be challenged. A familiar-looking verification badge does not answer these questions on its own.

Keep the jurisdictions separate

Ofcom’s October assessment informs the UK’s announced under-16 social-media restriction. The regulator said detailed regulations were intended before the end of 2026, followed by consultation on guidance. The assessment is not itself the final regulations. [1][2]

It must not be described as an Irish or EU-wide rule. The Commission separately describes an EU KIDS Act proposal and its age-verification work. A proposal is not an enacted common age ban. In the United States, federal COPPA concerns children’s personal information, primarily under 13; the FTC’s February 2026 age-verification policy statement sets conditions for a specific enforcement approach. It is not the UK model exported to the US. [4][5]

An adult reviews a phone and laptop at a desk.

An adult reviews a phone and laptop at a desk. AI-generated editorial illustration; not a photograph of a named event or research participant.

The gate is only the beginning

Safegram’s emphasis on trust and user control makes the distinction relevant to its own design choices. An identity signal should never be offered as evidence that age estimation is error-free, appeals are fair or the feed is safe. Those outcomes need to be evaluated separately, on Safegram as on any other service.

A serious assessment should examine mistaken acceptance and rejection, access to alternatives, retention of sensitive data and what happens after onboarding. Reporting tools, contact controls and safer recommendations remain important after someone passes the gate. No age-check method is completely resistant to circumvention, Ofcom cautions. [2]

Before sharing an ID or face image, read the explanation of purpose, retention and alternatives. For Safegram’s platform information, visit safegram.com (https://safegram.com/). This is editorial analysis, not a certification of any age-check supplier or individual legal advice.

Frequently asked questions

What is age assurance?

An umbrella term for approaches that estimate or establish a user’s age or whether a threshold is met. Verification and estimation are different methods within it. [2][3]

Which methods did Ofcom identify at 16?

Photo-ID matching, banking information, digital identity services and facial age estimation, subject to effective implementation. [1][2]

Must every user upload a passport?

No universal conclusion follows from the assessment. Available routes and fallback evidence differ; some eligible users may nevertheless need suitable photo ID. [1][2]

Have 150,000 teenagers already been excluded?

No. The cited estimate concerns UK 16- and 17-year-olds without a passport or driving licence and comes from a non-representative survey. It is not a count of exclusions. [1]

Can an age check protect privacy?

It can be designed to minimise data and disclose only a threshold result where appropriate. The actual provider, retention and implementation still need scrutiny. [3][4]

Does the UK assessment create a rule for Ireland or the US?

No. UK proposals, EU initiatives and US children’s privacy rules have different legal scopes. The Ofcom assessment itself is not final legislation. [1][4][5]