Social media companies have failed to enforce their minimum age requirements: Ofcom

In tandem with publishing its Use of Age Assurance Report 2026, UK regulator Ofcom has issued a statement that does a good job of summing up the current state of age assurance: as regulations take hold, more and more sites are complying by implementing biometric age checks – but social media platforms are still trying their best to avoid doing so.

Ofcom claims “significant progress” has been made since the Online Safety Act’s rules for online porn operators came into effect in July 2025. “Age checks are now being deployed at an unprecedented scale across the pornography, social media, dating and gaming sectors. Many services are taking steps to ensure these checks are highly effective in practice, in line with Ofcom’s industry guidance,” says the report, which is based on evidence from the first six months of the protection of children duties being in force.

The percentage of kids who encountered highly effective age checks increased from 25 to 43 percent between July 2025 and January 2026. While a minority of online children attempt to access pornography (8 percent), the presence of age checks “acts as an effective deterrent.” Circumvention, often associated with virtual private networks (VPNs) and cited as a problem with biometric age assurance tech, has been addressed with the recent announcement that the onus is now on on platforms to “take robust steps to detect and prevent attempts by underage users to circumvent age assurance measures.”

The UK is no longer considering a ban on VPNs, which the government says have legitimate privacy and security uses.

Age checks help to prevent children from accessing online porn

Ofcom gives credit to the porn industry: “all of the UK’s top 10 and the majority of the top 100 porn sites now have age checks in place.” That’s significant, in that it offers a picture of what compliance in good faith looks like.

Aylo, owner of Pornhub and its associated network of adult content properties, has been clear that it would strongly prefer not to implement a system that has proven, in the short term, to choke traffic to its sites. In some cases, it has opted to withdraw from markets that have imposed age assurance laws.

Meanwhile, its campaign to hold Ofcom to its promise of a level regulatory playing field – the same rules for porn sites big and small – appears to have worked, at least to an extent. The regulator says “too many porn sites still don’t have age checks in place,” but it is working to fix that, dictating that “all porn services without age checks must introduce them without delay, in line with our guidance.”

“So far, we have opened 23 investigations into the providers of 88 adult services. We will continue to take action against services which flout the law and put children at risk, using the full extent of our enforcement powers.”

Social media firms still trying to find a loophole

Big Porn has decided to follow the rules or pull out: fair play on either front. It thus offers solid evidence that its representatives speak in good faith when they say they don’t want kids on their sites.

Big Social, on the other hand, is applying a different playbook. Many – and notably the big ones attached to massive Silicon Valley companies – have deployed internally developed machine learning systems, which they frame as “age inference,” thereby checking the box for highly effective age assurance.

These systems algorithmically monitor a user’s account activity to guess at their age. The UK Information Commissioner’s Office (ICO) classifies them as “profiling” systems that do not meet the standard for highly effective checks. They also provide an excuse for Meta and Google to collect more user data to feed to their AI projects.

Ofcom’s statement raises “serious doubts whether age inference methods currently used by some popular social media sites and apps are fit for purpose.”

“Evidence in our report reinforces our long-standing, serious doubts about the effectiveness of some of these models,” it says. “Age inference cannot be appropriate for the purposes of the ban or minimum age enforcement – because it can only be used after the child has signed up and used the service for enough time for the inference to be made.”

Last week, Ofcom launched an investigation into TikTok’s compliance, specifically targeting its would-be age inference system. Now, it says its message to social media companies is clear: “those which use age inference models to comply with their child protection duties should switch to other methods listed in our guidance as highly effective without delay. If they don’t, they must be able to prove using reliable and compelling evidence to Ofcom that their current method is highly effective.”

“When implemented properly, highly effective age checks work, and they will be vital in underpinning future social media restrictions for under 16s. Ofcom expects further innovation from app stores, operating systems and at device-level, ensuring the whole industry plays a part in improving protections for children.”

Dating sites, search engines need work on age assurance

Social sites are not alone in their noncompliance. Ofcom also calls out online dating services as an industry that needs to tighten its protections.

“Despite having age checks in place to prevent children’s access, over one in ten 15 to 17-year-olds were continuing to visit and spend time on three of the most used dating apps in December 2025,” Ofcom says. “This suggested that their age assurance methods needed to be improved and more closely aligned with our guidance.”

The regulator does concede that many dating services have made improvements to their age assurance processes following engagement with Ofcom. But, it says, “we expect them to continue to make further changes, in line with our guidance, including by introducing a ‘challenge age’ and ‘liveness detection’.”

Also in the crosshairs are search engines, where kids are able to easily find porn sites without age checks. Ofcom says it is working with Google and Bing on practical solutions.

App stores must step up; due diligence necessary

Regardless of the sector, Ofcom appears to be moving in the direction of measurable performance data and attendant certifications, as it refines its definition of highly effective age checks at the request of the UK Technology Secretary.

“Building on our existing guidance, Ofcom will deliver to Parliament by the end of October a rapid assessment of what highly effective age checks look like in practice to determine whether someone is over 16,” the regulator says. “This will help inform parliamentary debate ahead of potential age restrictions coming into force in 2027.”

Ofcom Chief Executive Dame Melanie Dawes says that age checks are “a cornerstone of the UK’s online safety laws.”

“When implemented properly, our evidence shows that age checks are helping to create a safer life online for children in the UK.”

“But the job is not done and tech companies need to go further. Too many services have no or inadequate age checks in place, which is not good enough.”

“As the UK prepares for further new social media restrictions at 16, the age check landscape is already shifting towards a stronger, whole-of-system approach, which is important to avoid any single point of failure. We want to see continued innovation from the wider tech industry to strengthen protections for children – including from operating systems and at an app store and device-level.”

In its statement, Ofcom emphasizes that businesses must conduct regular due diligence on any third-party age assurance vendors – which implies the need for testing and certification to play a central role in establishing the ecosystem.

The internet is becoming more age aware

The regulator will publish a statutory report about the role of app-store level protections by January 2027. In the meantime, it continues to shape what it calls “a generational shift towards a more age-aware internet.”

“Age checks are increasingly shaping children’s online experiences, with more children reporting that they encounter them. Circumvention appears low, although some activity may not be captured due to reporting bias. Many services have implemented age checks in line with our highly effective age assurance guidance (our HEAA guidance), using methods and taking steps to ensure that their age assurance is highly effective in practice.”

All in all, the report is an even mix of “keep calm and carry on” and a more scolding approach, which aims to put the fear in social media sites. Whether they comply, and how easily, is likely to be the biggest question facing the age assurance sector in the near future.

Article Topics

age verification  |  Ofcom  |  regulation  |  social media  |  UK age verification