Key takeaways
- Ofcom’s rapid assessment, published this week, names four age assurance methods capable of determining someone is 16 or over: photo ID matching, digital ID services, banking-based checks, and facial age estimation. Photo ID sits underneath all four, as the method or the backstop.
- Around 150,000 UK 16- and 17-year-olds hold no passport or driving licence, facial age estimation errs by a few years at 16, and the only way to keep under-16s out is to check everyone, adults included.
- Bill C-34 gives Canada the right process, a mandatory Privacy Commissioner consultation and standards set by the future Digital Safety Commission, but the government plans to enforce the under-16 ban before the Commission exists. The UK asked its regulator to do the homework first. Ottawa is grading before the assignment is set.
The UK’s regulator just published the assessment Ottawa skipped, and the headline number is not the one age-assurance vendors put in their pitch decks. Four methods can verify that someone is 16, says Ofcom, and every one of them eventually asks for a photo ID.
The four methods, and the backstop they share
| Method | How it works | The catch |
|---|---|---|
| Photo ID matching | Document photo compared with a live selfie | 94% of UK 16-and-overs hold a passport or driving licence; around 150,000 16- and 17-year-olds hold neither |
| Digital ID services | Verify once with a photo ID, then reuse the credential | Still needs the photo ID for the first check |
| Banking-based checks | Age pulled from the bank’s records, with consent | 90% of 16- and 17-year-olds have an account; ID was needed to open it |
| Facial age estimation | Software estimates age from a face scan | Margin of error of a few years at 16, so low estimates get challenged |
Ofcom’s wording is worth reading twice: photo ID is “either required as part of our recommended methods, or likely to be part of a second check.” Facial age estimation gets a challenge-age protocol borrowed from the alcohol shelf, the Challenge 25 logic, because an estimator that misses by a few years at 16 will read a 15-year-old as 17.
The numbers nobody put in the pitch deck
Those 150,000 teenagers without documents are the start of the problem, not the end. Around one in ten 16- and 17-year-olds has no bank account to check against. And the check is not confined to teenagers: the only way to keep under-16s out is to age-verify everyone, so adults would be asked to hand identity documents, face scans, or financial data to verification vendors.
Then the circumvention problem, which Ofcom does not sugarcoat. No method is completely tamper-proof, and circumvention will rise once the ban lands; Ofcom’s own research found a quarter of children had used a VPN in the previous six months. The mitigations Ofcom names carry their own warning label: easy user reporting, location tracking to spot VPN use, and behavioural age-inference models. the ICO, the UK’s privacy regulator, says inference “should not be used to make up for a weak or non-existent age gate.” One regulator tells platforms to build the safety net; the other tells them not to lean on it. Nobody has resolved that tension.
Canada is running the sequence backwards
Bill C-34, the Safe Social Media Act, actually contains the process the UK followed: a mandatory consultation with the Privacy Commissioner, and standards set by the future Digital Safety Commission, with the criteria named up front, limit collection to age-verification purposes, destroy the data afterwards, and do not curb expression unreasonably.
But the government’s stated plan brings the under-16 ban into force before the Commission exists. The consultation the bill requires, the standards the bill requires, and the Commission that writes both would all arrive after the ban they are supposed to govern. The Charter statement tabled on October 19 defends the age-check requirement by pointing at section 27(2)‘s collection and destruction conditions. That is a legal defence, not a technical assessment. Ofcom’s report is what a technical assessment looks like.
I have followed this bill for months, and the pattern is getting hard to miss: every substantive question gets answered after the obligation takes effect.
What belongs in your vendor file now
If you run a service that will count as a “regulated service” under C-34, Ofcom’s criteria are the best public template until the Commission writes its own. Five questions, this week:
- Error rate at the relevant age band, not headline accuracy. Ofcom’s line is “a margin of error of a few years at 16.” Ask for the distribution, not the mean.
- Where does the document go? C-34 names collection limits and destruction as criteria. Get the vendor’s destruction schedule into the contract, not the brochure.
- What triggers the challenge protocol, and how often do estimation failures convert to document checks? If the vendor cannot describe its own backstop, it has not read the Ofcom report.
- How is circumvention monitored? Ofcom expects reporting and detection tooling. Ask what the vendor measures and what it sends back to you.
- Start the privacy impact assessment now. The ICO’s warning on inference is on the record; set your position before a regulator sets it for you.
Actionable takeaway: Pull the Ofcom rapid assessment and hand it to whoever owns your age-assurance vendor file. If the vendor cannot name its error rate at the relevant age band and its document-destruction schedule, it will not survive the Commission’s standards either. The UK did the homework before the exam. Canada still can, if the ban waits for the Commission. And with Bill S-209 just sent to committee carrying a second set of age-verification rules, the exam may have two papers.