April 30, 2026 deadline
Ofcom and the ICO expect a concrete, defensible plan from major social and video platforms by April 30, 2026. Ofcom will report publicly in May 2026 and has said it will take enforcement action where responses are inadequate.
UK regulators have drawn a hard line. By April 30, 2026, major social and video platforms must demonstrate to Ofcom and the Information Commissioner's Office (ICO) how they are enforcing age restrictions and implementing stronger age assurance. Meta (Facebook and Instagram), TikTok, YouTube, Snapchat, Roblox, and X are in scope. This is not a consultation; it is a deadline. Ofcom has said it will take enforcement action if responses are inadequate and will report publicly in May 2026.
What Ofcom and the ICO want to see
Regulators want platforms to move beyond self-declaration. The ICO has written to the same companies calling for "modern, viable" age checks, including facial age estimation or digital ID, so that under-13s cannot access services not designed for them. Ofcom’s own research shows how wide the gap is: most 10–12 year olds already have social profiles, and many 8–12 year olds still reach sites that are supposed to be off-limits. Saying “we will block children” is not enough on its own; platforms need to show how they do it.
Enforcement is already real (Reddit and MediaLab fines)
The ICO has fined Reddit £14.47 million and Imgur owner MediaLab £247,590 for age-assurance failures.
£14.47M
ICO fine imposed on Reddit for age-assurance failures (March 2026)
Those fines underline that weak age checks are now a direct regulatory and financial risk, not only a PR problem. If you sell into the UK market, you need a concrete plan before 30 April: which technology you use, how it limits data, and how it keeps under-age users out. A privacy-first age verification service can cover that pattern with first-time ID and liveness, then a signed 18+ result and a unique Audit ID for regulators, without document or face storage on your side or the provider’s. That is enough to meet Ofcom and ICO expectations without building a honeypot of identity data.
