UK age verification that satisfies Ofcom without a passport archive
The under-16 social media ban lands in Spring 2027, but enforcement is already real: the ICO fined Reddit £14.47M in March 2026. Meet Online Safety Act expectations with highly effective age assurance, minimal data on your servers, and an audit trail regulators can inspect.
Spring 2027
First regulations under the under-16 social media framework.
Ofcom age-assurance study due October 2026
Draft regulations before Parliament late 2026
First enforcement target: Spring 2027
UK age verification in 2026
What changed
Under-16s will be blocked from mainstream social media from Spring 2027. Wider rules restrict livestreaming and stranger contact across gaming and other services.
Who must act
Major social platforms first, then any UK-facing service with UGC, forums, sign-ups, or community features children could reach.
Regulator pressure
Ofcom fines up to £18 million or 10% of global turnover. ICO has already fined Reddit £14.47M for weak age-assurance failures.
Recommended approach
Highly effective age assurance with minimal data: verify once, light reverification on return, store only signed threshold plus Audit ID.
UK age assurance scope ladder
The ban targets major social platforms first, but harmful functions such as livestreaming and stranger contact extend to forums, gaming, and many WordPress stacks with community features.
Major social platforms
TikTok, Instagram, Snapchat, Facebook, X, YouTube (under-16s)
Forums & UGC communities
Open comments, reviews, member sign-ups, user profiles
Gaming & live features
Livestreaming, voice chat, stranger contact, in-game social layers
WordPress & SMB sites
Forums plugins, membership areas, restricted checkout, community stacks
The UK age assurance timeline
Major platforms already face an April 2026 deadline. The under-16 framework follows through late 2026 and into Spring 2027 enforcement.
- 30 Apr 202630 Apr 2026
Major platform deadline
Meta, TikTok, YouTube, Snap, Roblox, and X must show Ofcom and the ICO how they enforce age restrictions.
- Oct 2026Oct 2026
Ofcom age-assurance study
Regulator reports on methods that are accurate, robust, reliable, and fair for proving users are over 16.
- Late 2026Late 2026
Draft regulations
Secondary legislation under the Children's Wellbeing and Schools Act expected before Parliament.
- Spring 2027Spring 2027
Enforcement begins
First regulations under the under-16 social media framework expected in force.
Self-declaration is no longer enough
The ICO has already fined platforms for weak age checks. Regulators want methods that are accurate, robust, reliable, and fair, not a birth-year field with no verification step behind it.
Birth year only
Users enter any date with no verification step
Shared family accounts bypass individual checks
No audit trail regulators can inspect
ICO fines already issued for this pattern in 2026
Effective age assurance
ID + liveness or accredited digital identity at first gate
Signed 16+ or 18+ threshold returned to your platform
Light face reverification for returning users, not re-upload
Audit ID stored per verification event for Ofcom review
£18M
or 10% of global turnover, whichever is higher
Ofcom enforcement is not theoretical. The ICO fined Reddit £14.47 million in March 2026 for age-assurance failures. Building a passport archive on your servers does not reduce regulatory risk; it adds a GDPR breach surface on top of the fine exposure.
UK guides and cross-border context
Ship Ofcom-ready age assurance before Spring 2027
Test the flow on sign-up, forum access, or member areas. Verify once, re-prove with a light face check on return. Signed threshold and Audit ID only.
UK age verification FAQ
The government announced on 15 June 2026 that first regulations could be in force in Spring 2027. Ofcom must report on effective age-assurance methods by October 2026, with draft regulations expected before Parliament by late 2026.
Major user-to-user social platforms such as TikTok, Instagram, Snapchat, Facebook, and X are in scope first. YouTube is included for under-16s. Wider rules also restrict livestreaming and stranger contact across gaming and other online services. Forums, community sites, and WordPress stacks with UGC may fall in scope depending on risk.
Ofcom can fine in-scope services up to £18 million or 10% of global annual turnover, whichever is higher. The ICO has already issued multi-million-pound fines for weak age checks, including a £14.47 million penalty against Reddit in March 2026.
Not every blog is treated like a social network. You are more likely in scope if your UK-facing service allows user-generated content, sign-ups, forums, comments, or community features that children could reach. Confirm your risk profile against Ofcom guidance rather than assuming exemption because you run WordPress.
Yes. A privacy-first pattern verifies once with ID and liveness, then uses light face reverification on return visits or partner sites. Your platform receives a signed age threshold such as 16+ or 18+ and an Audit ID, not passport images or a biometric archive.