UK Online Safety Act Sees "Unprecedented Scale" of Age Checks Amidst Persistent Loopholes and Regulatory Investigations

Close to a year after the enactment of the UK’s age assurance law, the Online Safety Act, Ofcom, the UK’s communications regulator, has released a comprehensive report detailing its initial progress and identifying significant areas for improvement. The landmark legislation, which became law in late 2024 with key provisions coming into effect in July 2025, mandates robust age verification measures for online platforms hosting content "restricted to adults." This broad definition encompasses not only explicit pornography but also a wide array of non-explicit content and services deemed potentially harmful or inappropriate for minors, such as certain social media groups or dating applications. Ofcom’s findings indicate a substantial increase in the deployment of age checks across various digital sectors, marking an "unprecedented scale" of implementation. However, the report also highlights critical shortcomings, particularly concerning the discoverability of unverified adult content through search engines and the ineffectiveness of certain age verification methods on dating platforms, prompting further investigations and calls for stronger compliance.

The Genesis of the Online Safety Act: A Legislative Imperative

The Online Safety Act (OSA) represents a pivotal moment in the UK’s approach to regulating the digital sphere, driven by growing concerns over online harms, particularly those affecting children. The journey to its enactment was protracted and complex, involving years of debate, multiple drafts, and intense scrutiny from lawmakers, tech companies, and civil society groups. Initially conceived as a means to tackle illegal content and protect freedom of speech, its scope broadened considerably to include a duty of care for platforms to protect users, especially children, from legal but harmful content.

Central to the Act’s provisions for child safety is the requirement for "robust age checks" on sites that host adult-restricted content. This was a direct response to evidence suggesting widespread access by minors to pornography and other age-inappropriate material. Prior to the OSA, age verification was largely voluntary or inconsistently applied, leading to a patchwork of ineffective measures. The Act aims to standardize and enforce these protections, making the UK a global leader in online safety regulation. Its implementation phase, which began in July 2025, marked the official commencement of these new duties for online service providers, with Ofcom designated as the primary regulator responsible for overseeing compliance and enforcement. The Act grants Ofcom significant powers, including the ability to levy substantial fines, up to £18 million or 10% of a company’s global annual turnover, whichever is greater, for serious breaches.

Ofcom’s Initial Assessment: Progress on an "Unprecedented Scale"

Ofcom’s report, covering the period between July 2025 and January 2026, paints a picture of significant, albeit incomplete, progress. The regulator found that age checks are now being deployed across a diverse range of sectors, including pornography, social media, dating apps, and gaming platforms, at a scale previously unseen. This widespread adoption is a direct consequence of the OSA’s stringent requirements and Ofcom’s active engagement with the industry.

A key metric highlighted in the report is the notable increase in children encountering effective age checks. Between July 2025, when the law’s age assurance provisions began to be enforced, and January 2026, the proportion of children "being asked to prove their age who encountered highly effective age checks" rose from 25 percent to 43 percent. This near doubling in six months indicates a tangible shift in how online services are approaching their responsibilities under the Act.

The sheer volume of verification attempts further underscores this transformation. Ofcom reported that between July and December last year, a staggering 69 million age checks were completed across a sample of 32 services. This represents an astonishing 23-fold increase compared to the preceding six-month period, demonstrating the profound impact the OSA has had on operational practices within the digital industry. Such figures suggest a concerted effort by platforms to implement the required systems, often involving significant technical investment and changes to user onboarding processes.

Furthermore, Ofcom’s "Children’s Passive Online Monitoring study" provided insights into children’s actual online behavior. The study revealed that eight percent of children aged 8 to 14 who participated had visited pornographic providers. Encouragingly, half of these children only reached sites that had age checks in place. The report also noted the fleeting nature of many of these visits, with the majority (87 percent) lasting less than 30 seconds, and 65 percent concluding in under 10 seconds. While any exposure to age-inappropriate content remains a concern, the presence of age checks on a significant proportion of these sites, coupled with the brevity of interaction, suggests that the barriers introduced by the OSA are beginning to have an impact on casual or accidental access.

Persistent Gaps and Emerging Challenges

Despite the encouraging progress, Ofcom’s report is equally candid about the significant shortcomings that persist, indicating that the journey towards a truly safe online environment for children is far from complete. The regulator found that while all of the UK’s top 10 porn sites, and 64 out of the top 100 most popular porn sites in the country, had installed age assurance measures or geo-blocked UK users as of last month, "too many porn sites still don’t have age checks in place." This glaring omission leaves a substantial loophole, allowing minors to bypass restrictions on a considerable number of adult content providers. In response to these continuing failures, Ofcom has initiated a robust enforcement drive, opening 23 investigations into providers of 88 adult services found to be non-compliant. These investigations could lead to severe penalties, reinforcing the regulator’s commitment to ensuring universal adherence to the Act.

A critical vulnerability identified in the report is the role of search engines in the discoverability of unverified adult content. Ofcom’s analysis showed that a third (33 percent) of Google Search results on the first page for relevant queries led to porn sites without age checks or geo-blocking. The situation was even more pronounced for Bing, where 54 percent of first-page results linked to non-compliant porn sites. While Ofcom stated that Google and Bing are collaborating with the regulator "to tackle the discoverability of porn sites without age checks via their services," the current iteration of the Online Safety Act does not explicitly require search providers to implement age assurance themselves to prevent minors from accessing such content. This regulatory gap represents a significant challenge, as children can easily circumvent direct website age checks by simply finding alternative, unregulated sources through search.

Beyond adult content, the report also highlighted issues within other regulated sectors. It revealed that over 10 percent of 15 to 17-year-olds accessed three popular dating apps in December 2025, despite age checks being in place. This statistic underscores the need for these services to significantly enhance the effectiveness of their age verification mechanisms, as current methods are clearly insufficient to prevent underage access to platforms designed for adult interactions.

Finally, the report cast doubt on the reliability of "age-inference methods," which attempt to estimate a user’s age based on their online behavior, demographic data, or other indirect signals. Ofcom’s message to social media companies was unequivocal: "those which use age inference models to comply with their child protection duties should switch to other methods listed in our guidance as highly effective without delay." This strong recommendation signals a move away from less reliable, probabilistic methods towards more robust, verifiable forms of age assurance, such as document-based verification or biometric checks.

The Technical and Ethical Landscape of Age Verification

The debate over age verification methods is complex, balancing effectiveness, user privacy, and technical feasibility. "Highly effective age checks," as defined by Ofcom, typically involve methods that provide a high degree of confidence in a user’s age. These might include third-party verification services that cross-reference user data with official records (e.g., electoral roll, credit card data, government IDs), document upload and verification (e.g., passport or driving license scans), or robust facial recognition technology. Each of these methods comes with its own set of challenges, from user experience friction to potential data privacy concerns.

In contrast, "age-inference methods" often rely on algorithms analyzing user behavior, self-declared age (which can be easily falsified), or social media data. While less intrusive, they are demonstrably less accurate, as highlighted by Ofcom’s report. The regulator’s call for a shift away from these methods reflects a growing consensus that for content potentially harmful to children, a higher standard of proof is required.

The implementation of robust age verification at scale presents significant technical hurdles for online platforms. It requires integrating with third-party verification providers, developing secure data handling protocols, and ensuring a seamless user experience that doesn’t deter legitimate adult users. For smaller platforms or start-ups, the cost and complexity of implementing such systems can be prohibitive, potentially leading to market consolidation or reduced innovation.

Ethical considerations are also paramount. Collecting and processing sensitive personal data for age verification raises significant privacy concerns. Users need assurances that their data is stored securely, used only for its intended purpose, and not exploited for other commercial interests. Balancing the imperative of child protection with the fundamental right to privacy is a tightrope walk for both regulators and industry. The potential for discrimination based on access to verifiable identity documents or biometric data is another area of ongoing scrutiny.

Broader Implications for UK Online Regulation

The findings of Ofcom’s report have significant implications for the broader landscape of UK online regulation, particularly concerning the government’s ambitions to further restrict children’s access to social media. The UK government is currently planning to introduce a social media ban for children under 16, and has also recently announced a social media curfew for teenagers aged 16 and 17. The success of these proposed measures will heavily depend on the effectiveness of the age assurance methods employed, drawing directly from the lessons learned during the implementation of the Online Safety Act.

A recent study on Australia’s social media ban for minors, cited by Ofcom, found it largely ineffective. A key reason for this failure was the reliance on age estimation methods that did not require younger users to undergo additional, more rigorous checks. This international precedent serves as a cautionary tale for the UK, reinforcing Ofcom’s stance against unreliable age-inference models.

Looking ahead, Ofcom has committed to further action to solidify age protection online. By the end of October, the regulator will deliver a comprehensive assessment to Parliament detailing what "highly effective age checks" will entail to determine if someone is over 16. This guidance will be crucial for the successful implementation of the proposed social media restrictions. Additionally, Ofcom plans to publish a report on app-store-level age verification by January 2027. This initiative aims to explore how age checks can be integrated at the point of app download, providing another layer of protection before children even access individual applications.

Industry and Advocacy Reactions

The industry’s reaction to Ofcom’s report is likely to be mixed. Larger tech companies, with more resources, may express commitment to ongoing compliance, while privately grappling with the technical and financial implications of stricter age verification demands. Smaller platforms and adult content providers may voice concerns about the disproportionate burden of compliance, potentially leading to further geo-blocking of UK users or withdrawal from the market.

Child safety advocacy groups will likely welcome the progress reported by Ofcom, particularly the increased deployment of age checks and the regulator’s enforcement actions. However, they will also undoubtedly press for faster action on the identified loopholes, especially regarding search engine discoverability and the ineffectiveness of age checks on dating apps. Digital rights organizations, while supporting child protection, will continue to emphasize the importance of privacy safeguards and the avoidance of overreaching surveillance in the implementation of age verification technologies. Government ministers are expected to leverage the report’s positive findings to underscore their commitment to making the UK the safest place in the world to be online, while also acknowledging the need for continuous improvement and rigorous enforcement.

Looking Ahead: The Evolving Digital Frontier

Ofcom’s first progress report on the Online Safety Act’s age assurance provisions offers a nuanced view: significant strides have been made in a relatively short period, but substantial challenges remain. The internet’s global nature, the rapid evolution of technology, and the persistent ingenuity of those seeking to bypass restrictions mean that online safety is an ever-evolving battle. The regulator’s proactive stance, including investigations and calls for more robust verification methods, signals a determined effort to enforce the Act’s provisions.

The future success of the Online Safety Act, and indeed the broader UK strategy for online child protection, hinges on continuous adaptation, technological innovation in age verification, and a collaborative effort between government, regulators, industry, and civil society. Striking the right balance between protecting vulnerable users and preserving the open nature of the internet, while safeguarding individual privacy, will remain the defining challenge as the UK navigates the complexities of the digital frontier.