'The risks aren’t hypothetical': Ofcom reveals age-check plans for UK social media ban — but privacy experts aren't convinced

• Ofcom has assessed the best ways of enforcing age checks online
• The regulator also identifies methods that aren't effective
• Around 4 in 10 under-16s plan to try to get around the ban in the UK

Back in June, the UK government ruled that under-16s should be banned from social media platforms, with enforcement scheduled to start during the first half of 2027. Now the communications regulator Ofcom has set out the ways it expects tech companies to abide by the law.

In its new announcement (via the BBC), Ofcom highlights four "highly effective" methods for keeping under-16s out of apps and off sites they shouldn't be accessing — and they're all going to be familiar to anyone who's used age-gated services online in recent times.

The four methods are photo ID matching (using something like a passport or driving license), bank-based checks (Ofcom says 90% of UK 16-17 year-olds have a bank account), digital ID services (a third-party service like EasyID or Yoti), and facial age estimation via a webcam (which Ofcom says is best deployed as a secondary check).

This is a "rapid assessment" from Ofcom, and none of these approaches are confirmed yet — UK lawmakers will take the suggestions on board, and decide the best way to enforce the rules at a later date, most probably before the end of the year. All of these methods can be delivered "in a way that protects users' privacy" according to Ofcom.

Ultimately though, it will be down to tech companies to decide how to implement age checks that fulfil the requirements set down by the government. "Here are things that can work, they must preserve privacy, they must protect people's data, but it's on you to put in place what you think works for you," Ofcom CEO Dame Melanie Dawes told the BBC.

Challenges ahead

Ofcom also lists checks that it thinks are ineffective: self-declaration, general contractual agreements, and verifiable parental consent. The regulator also acknowledges that "the risk of circumvention cannot be entirely eliminated", but says that correctly implemented safeguards should "significantly reduce the likelihood" of unauthorized access.

In its rapid assessment announcement, Ofcom also encourages app stores to take more responsibility over age checks. Right now, self-declarations are most commonly used to unlock downloads for age-restricted content.

These are going to be tough rules to enforce, whatever the approach is: recent research from EE suggests that 42% of 11-15 year-olds are planning to try and get around whatever restrictions are put in place. This could be by switching to apps or platforms not covered by the new laws, including messaging services and gaming sites.

Last week Ofcom also admitted that the Online Safety Act introduced in July 2025 had so far made "no significant change" to the harmful content children had been exposed to online. The act was intended to ensure protection from content involving pornography, serious violence, suicide material, racism, misogyny, and bullying.

"This finding is concerning and shows that further progress is needed to protect children online," says Ofcom. The regulator also recommended adding material around body stigma and depression to the primary content categories that children should be protected from online.

Analysis: What do privacy experts think?

Ofcom's proposals are likely to spark some familiar privacy concerns — and security experts told us they aren't without foundation.

“The challenge isn’t simply checking someone’s age. It’s doing so without turning everyday internet use into an identity check," said Pieter Arntz, Senior Malware Intelligence Analyst at Malwarebytes. "Photo ID matching brings highly sensitive documents and facial images into the process, potentially creating another attractive target for criminals. The risks aren’t hypothetical: as I reported last year, a breach at a third-party support provider for Discord exposed government ID images belonging to around 70,000 users," he said.

Even if facial estimation techniques are more secure, there are are still downsides. "Facial age estimation can avoid uploading an identity document, but it still processes a sensitive image and makes an imperfect prediction," Pieter Arntz added. "Ofcom itself acknowledges that some technologies have a margin of error of a few years at 16, meaning people near the threshold may face an additional verification check," he said.

"My preference is double-blind verification: a provider confirms that you meet the age requirement but doesn’t learn which service you’re accessing, while the service receives proof of age without learning your identity. Proving you are old enough should not mean revealing who you are," he said.

Others feel the risks are more around teenagers finding workarounds.“The challenge for social media platforms is that teenagers don’t like to be told ‘no’. Many will conform, but tech-savvy young people are going to search for an open window on the ground floor," said Olli Krebs, SVP EMEA at the identity verification software provider Incode. "If the process is clunky, users of all ages will actively seek ways around it," he added.

Those workarounds could unintentionally make the problem worse. "The experience of countries such as Australia is that there will be a real risk of an increasingly technologically sophisticated population of young people will resort to a variety of circumvention techniques (primarily, but not exclusively VPNs) to access content hosted outside of the UK," said Will Richmond-Coggan, Partner specialising in Data and Privacy Disputes at Freeths.

"Such content is liable to be less well regulated generally, and to pose further risks of users gaining unsupervised access to progressively more dangerous and problematic content in relation to which the UK online safety legislation is largely powerless to take action," he added.

“None of this will be perfect. Young people will always push boundaries, and anyone promising a hundred per cent online safety is being unrealistic," concluded Olli Krebs from Incode. Exactly how successful it is depends very much on how the social media giants implement Ofcom's suggested age-check methods.

What you think of the social media ban, and Ofcom's new proposals? Let us know in the comments below.

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.