Ofcom-permitted age checks, compared — what each method hands over, and to whom
Six age verification methods that pass Ofcom's bar, side by side: what leaves your device, who holds it, and how long. With a decision tree by threat model.
The United Kingdom's Online Safety Act 2023 made age verification mandatory for sites that host pornography or content about suicide, self-harm, and eating disorders. The compliance deadline was 25 July 2025. Ofcom, the regulator, published a list of methods it considers acceptable. The list is broad: open banking, photo ID matching, facial age estimation, mobile network operator checks, credit card checks, digital identity services, email-based age estimation.
Each method asks you to hand over different data, to different parties, for different durations. The Act itself doesn't set privacy standards. Under section 12, it only says the checks must be "highly effective." Data handling is governed by the UK General Data Protection Regulation (UK GDPR) and not much else. So the privacy properties of each method depend almost entirely on how the individual verification vendor chose to build its system.
This guide walks through six of the main methods you're likely to encounter on UK-facing sites and apps as of June 2026. For each, it covers what data leaves your device, who holds it, how long it's kept, and whether the method creates a persistent identifier that links your activity across sites.
It ends with a decision tree, organised by threat model rather than convenience. If your threat model is "I don't want to be inconvenienced," you're reading the wrong site.
How did we get here?
The OSA repealed the Digital Economy Act 2017's failed age verification mandate and replaced it with a broader duty. Under section 12 of the Act, services that allow "primary priority content that is harmful to children" (pornography, suicide promotion, self-harm instruction, eating disorder content) must prevent children from accessing it. Ofcom published its age assurance guidance in January 2025 and set the July 2025 enforcement deadline.
In practice the law has done more than affect porn sites. Social media platforms that allow adult content (notably Reddit and Bluesky) have all introduced age verification for UK users. Reddit contracted with Persona, a San Francisco identity verification company. Bluesky went with Kids Web Services (KWS), a subsidiary of Epic Games. Dating apps including Tinder, Bumble, Grindr, Hinge, and Feeld have also introduced checks.
The methods below are the ones Ofcom explicitly lists as acceptable. The seventh, email-based age estimation, is excluded from the comparison because it's trivially circumvented (anyone can create a Gmail account with a fake birth year) and isn't widely deployed as a standalone method.
Photo-ID upload
You take a photo of a government-issued identity document (passport, driving licence, national ID card) and upload it through the verification interface. The vendor pulls your date of birth from it. Many vendors also ask for a selfie to confirm the document belongs to you.
That hands over a lot. Your full name, date of birth, document number, a photograph of you, and the document image itself. With a liveness check, a biometric face scan goes too. The vendor often grabs device metadata along the way: IP address, browser fingerprint, operating system.
The party holding all this isn't the site you're trying to access. It's a third-party verification vendor. Persona, Yoti, Verifymy, and Jumio are the most common providers serving UK sites as of June 2026. Reddit, for example, uses Persona. Reddit has stated it does not receive the uploaded photo, only a verification status and the birthdate you provide.
Retention varies. Persona's policy for its Reddit integration says it "promises not to retain the photo for longer than 7 days." Yoti has previously said it deletes verification images after the check completes. These are contractual promises, not statutory limits. The vendor's privacy policy is the only binding document. And those policies change. Persona's February 2026 code leak, analysed by security researchers, revealed the platform is capable of running 269 individual verification checks across 14 categories, including government watchlist screening and device fingerprinting. Persona responded that no single customer uses all 269 checks.
Cross-site linkability is high. If the same vendor is used across multiple sites and you verify with the same document, the vendor holds a persistent identity: your name, document number, and face. Some vendors offer "reusable" verification (Persona calls it "Reusable Personas"), meaning you verify once and re-use the credential across sites. Convenient. Also a single point of linkage.
This is the highest-risk method on the list. Government ID documents are the crown jewels of personal data. A breach at a verification vendor exposes your name, face, document number, and (if stored) the document image. The document number alone is durable. It doesn't change when you get a replacement passport.
Who this is for: users who have no other option, or who are comfortable with a third party holding their identity documents. Anyone with a digital ID wallet should use that instead. Same document verification, better privacy architecture.
Open banking
You authorise the verification vendor to access your bank account data through the UK's open banking framework. The vendor checks the account holder details, specifically your date of birth, and confirms you're over 18. No transaction history is shared. The check only needs to confirm the account holder is an adult.
What leaves your device is narrow: your name, date of birth, and account holder status. The verification vendor sees which bank you use. Your bank knows you authorised a verification check (it logs the authorisation) but doesn't see which site you were trying to access.
The verification vendor acts as a third-party provider (TPP) under open banking regulations, supervised by the Financial Conduct Authority (FCA). Your bank holds the source data. The site you're accessing gets only the verification result ("over 18, confirmed") and possibly your name.
Retention is governed by the vendor's privacy policy. Under the FCA-regulated Payment Services Regulations 2017, open banking consent requires re-authorisation. The vendor can only re-access your data if you re-authorise. The verification result (the fact that you proved you're over 18) may be stored longer.
Cross-site linkability is moderate. The vendor knows your name and bank. If the same vendor is used by multiple sites, it can link your verification across them. But the identifier is weaker than a document number. Names change. People have multiple bank accounts. The vendor doesn't hold a biometric template.
The privacy risk is moderate overall. You're not handing over a document scan. You're giving a regulated financial third party access to one field (your date of birth) from your bank account. The FCA's oversight of open banking providers gives a regulatory backstop that doesn't exist for photo-ID vendors. The main remaining risk is that the verification vendor's database, if breached, links your name, bank, and the sites you've verified on.
Who this is for: UK residents with a UK bank account. Not available to visitors, expats without UK accounts, or anyone whose bank doesn't support open banking. Works well for domestic users who want to avoid handing over ID documents.
Credit card check
You enter your credit card details. The site, or its verification vendor, runs a small authorisation (typically £0 or a nominal amount that's refunded) to confirm the card is valid and the cardholder is over 18. Under UK law, credit cards cannot be issued to anyone under 18, so valid card = confirmed adult.
What leaves your device: your credit card number, expiry date, CVV, and cardholder name. The authorisation request goes through the card network (Visa, Mastercard) to your issuing bank. The bank confirms the card is valid. The site or vendor gets the authorisation result.
The card networks and your issuing bank already hold this data. The new party is the site or verification vendor, which now has your card number, expiry, and name. Some implementations use a tokenisation layer to avoid exposing the raw card number to the site. This varies.
Retention is unclear. For the authorisation itself, the card network logs the transaction. For the verification vendor, retention depends on the privacy policy. PCI DSS Requirement 3 limits storage of card data by merchants, but the verification result ("this person used card ending in 1234") isn't covered by PCI DSS.
Cross-site linkability is high. Your credit card number is unique to you. If you use the same card on two different sites, and the verification vendor (or the card network) correlates the transactions, your activity is linked. The card number is a durable identifier. It survives card replacements when the replacement is for the same account.
The privacy risk is high. You're handing your payment instrument to a site that may have no other business relationship with you. The card number is a persistent identifier. If the site stores it, a breach exposes your payment details. You're also revealing your bank and card type to the verification system.
Who this is for: users who have a credit card, don't want to share ID documents, and are comfortable with the site knowing their card details. Not available to anyone who doesn't hold a UK credit card. Debit cards are also accepted by some implementations, but the legal basis for debit cards is weaker. Many UK banks issue debit cards from age 11 upwards.
Mobile network operator age check
The verification vendor queries your mobile network operator (MNO, that's EE, Vodafone, Three, or O2) to confirm the account holder is over 18. The check uses the mobile number you provide. The MNO checks its records and returns a yes/no. No personal data is sent back to the site.
What leaves your device: your phone number. The MNO already knows your name, date of birth, and address from the account registration. The verification vendor and the site you're accessing receive only the phone number and the verification result ("over 18, confirmed").
Your MNO holds the source data. The verification vendor holds your phone number and the verification result. The site holds your phone number and the result.
Retention sits with the verification vendor's policy. The MNO already holds your account data independently. It's not creating new data. The site now has your phone number permanently, tied to your account.
Cross-site linkability is high. Your phone number is a durable, unique identifier. If you verify with the same phone number across multiple sites, and the verification vendor or the sites share data (or get breached), your activity is trivially linkable. Phone numbers are harder to change than credit cards.
Privacy risk is medium-high. You're not exposing identity documents or payment details. You are giving every site you verify on a permanent, globally unique identifier. Your phone number is the key that links your social media accounts, messaging apps, and now your adult content consumption. In the UK, phone numbers are linked to real-name registration through SIM card purchase, so the phone number is effectively a government-verified identity.
Who this is for: users who want a fast verification method and are comfortable with sites knowing their phone number. Not available to visitors with foreign SIMs unless the verification vendor supports cross-border MNO checks. Most don't.
Digital ID wallet
You verify your identity once with a digital ID provider, typically by uploading a government ID document and completing a liveness check. The provider issues you a reusable digital credential. When a site asks for age verification, you present the credential. The site receives confirmation that you're over 18, not your underlying data. The UK government's GOV.UK One Login and the private-sector Yoti ID are the two main examples in the UK market as of June 2026.
During initial enrolment, your ID document, face scan, and personal details go to the provider. The credential is stored on your device or in the provider's cloud. During verification, only the age confirmation is shared with the site. The site does not see your name, document, or face.
The digital ID provider holds your verified identity data. The site holds only the verification result ("over 18, confirmed"). If the architecture is well-designed (device-based credential, selective disclosure), the provider doesn't even know which sites you've verified on.
Retention is split. The ID provider holds your credential data indefinitely. You can re-use it. The sites you verify on hold only the confirmation result. Whether the provider logs your verification events depends on the architecture. The privacy properties of each digital ID wallet differ. Check the provider's privacy policy for their logging practices. GOV.UK One Login's privacy notice is the place to look for the current logging policy.
Cross-site linkability is low to none, if the architecture is done right. A well-designed digital ID wallet uses selective disclosure: the site asks "is this person over 18?" and the wallet answers "yes" without revealing any identifier. No persistent token is shared across sites. The provider doesn't see the sites you're visiting. This is the closest any method gets to the "show a bouncer your ID at the door" analogy. The bouncer sees the ID but doesn't keep a copy.
Privacy risk is low. The architecture is privacy-preserving by design. The main risk is the provider itself. A breach at the ID provider exposes your enrolment data (ID document, face scan). But the provider doesn't hold a log of your browsing activity. Secondary risk is that the credential is held on your phone, which can be seized. Use a strong device passcode.
Who this is for: the best option for privacy-conscious UK residents. Requires initial enrolment, which means uploading ID documents once. After that, verification is fast and leaves no trail. The trade-off is trusting a single provider with your identity documents. Not available to visitors without UK-issued ID.
AI facial age estimation
You point your camera at your face. The software analyses your facial features (bone structure, skin texture, wrinkle patterns) and estimates your age. No identity document is required. The software doesn't try to recognise you. It's estimating age, not matching to a known identity.
What leaves your device: a video or image of your face, captured through your device camera. The software may also require a "liveness" check (blinking, turning your head) to confirm you're a real person and not a photo. Device metadata (IP address, browser fingerprint) may be collected too.
The age estimation vendor holds the data. Yoti and Incode are the main providers serving UK sites as of June 2026. The site you're accessing receives only the age estimate result ("over 18, estimated age 34") and possibly the face image if the vendor's architecture sends it.
Retention varies. The vendor's privacy policy governs. Some vendors claim to delete the face image immediately after processing. Others retain it for training data or audit purposes. Yoti has stated it deletes images after the age estimation is complete. The vendor's policy is the only protection. There's no statutory requirement to delete.
Cross-site linkability is medium to high. The face image itself is a biometric. Even if the vendor claims it doesn't create a biometric template, the image can be used to create one later. If the same vendor is used across multiple sites, and the vendor retains images or templates, your face links your verification across sites. The National Institute of Standards and Technology (NIST) runs an ongoing evaluation of age estimation algorithms. Its 2024 report found accuracy varies by demographic, with algorithms performing worse on women and people with darker skin tones. The full NIST report is available here. Accuracy also drops sharply at the 16 threshold, which is the cutoff the spring 2027 social media ban will use.
Privacy risk is medium. You're not handing over a document. You are handing over your face. The privacy properties depend on the vendor's architecture and retention policy. If the vendor deletes the image after processing and doesn't create a biometric template, the risk is low. If it retains the image or creates a template, the risk is comparable to photo-ID verification. Your face is as durable an identifier as your passport number.
Who this is for: users who want to avoid sharing identity documents and don't have a digital ID wallet. Works for visitors to the UK. The software doesn't require UK-issued documents. The trade-off is trusting a private company with your biometric data.
Comparison table
| Method | Data shared | Who holds it | Retention | Cross-site linkability |
|---|---|---|---|---|
| Photo-ID upload | Name, DOB, document number, photo, face scan | Verification vendor | Days to indefinite (vendor policy) | High (document number, face) |
| Open banking | Name, DOB, bank name | Verification vendor + bank | Consent-based; result may persist | Medium (name + bank) |
| Credit card check | Card number, expiry, CVV, name | Vendor/site + card network | Vendor policy; transaction logged by network | High (card number) |
| Mobile network operator | Phone number | Vendor + site + MNO | Result persists; phone number tied to account | High (phone number) |
| Digital ID wallet | During enrolment: ID + face. During verification: only "over 18" | ID provider | Credential data held indefinitely; sites get only confirmation | Low (selective disclosure) |
| AI facial age estimation | Face image/video | Age estimation vendor | Vendor policy (claimed: immediate deletion) | Medium (face biometric) |
Decision tree: which method for which threat model?
Start at the top. Answer the question at each branch. The path leads to the method that best matches your threat model.
Decision tree by threat model
Read the decision tree as plain text
1. Are you a UK resident with a UK bank account and a UK-issued ID document?
Yes → Go to 2. No → Go to 5.
2. Is your threat model "I don't want any site to know my real identity"?
Yes → Go to 3. No → Any method will work. The digital ID wallet gives the best privacy for the least friction.
3. Is your threat model "I don't want any single entity to hold a permanent link between my identity and my browsing"?
Yes → Digital ID wallet with selective disclosure. Verify once with the provider. Present only the age confirmation to sites. The provider doesn't see which sites you visit. The sites don't see who you are. No → Go to 4.
4. Is your threat model "I want to minimise the data I hand over, and I'm willing to accept some linkage risk"?
Use open banking if your bank supports it. You're giving a regulated financial provider access to your date of birth. Not your face, not your document number. The site gets a yes/no. The vendor knows your name and bank. If you're uncomfortable with that, use the mobile network operator check. The trade-off is that the site now has your phone number.
5. Are you a visitor to the UK without UK-issued ID or a UK bank account?
Yes → Go to 6. No → Go to 2.
6. Does the site you're trying to access offer AI facial age estimation?
Yes → Use it. It's the only method available to you that doesn't require a UK-issued credential. The privacy risk depends on the vendor. Check the vendor's privacy policy for image retention. If the vendor deletes images after processing, this is the best option. If it retains them, weigh the risk against the need to access the site. No → Photo-ID upload with your home country's passport or ID card. You're handing over your document to a third-party vendor. The privacy properties are the same as for UK users. High risk, high linkage.
What the law doesn't cover
- coreOne verified user
- r1Name + DOB exposed
- r2Document number — survives passport renewal
- r3Face biometric — survives everything
The OSA mandates that age checks be "highly effective". It doesn't mandate that they be private. The data protection backstop is the UK GDPR, which requires data minimisation, purpose limitation, and storage limitation. Enforcement is reactive. It happens after a breach or a complaint, not before.
The Act also doesn't prevent a verification vendor from being acquired, and the acquiring company from inheriting the database. KWS's privacy policy, as reviewed by data compliance lawyer Simon McGarr, explicitly states that personal data may be transferred in a "merger, acquisition, or sale of assets." Persona's policy includes similar language.
The Open Rights Group and Big Brother Watch have both opposed the Act on privacy and free-expression grounds, warning it would "seriously threaten the rights to freedom of speech and privacy." Big Brother Watch director Silkie Carlo told the BBC: "We must avoid anything like a digital ID system for the internet that would both eradicate privacy online and fail to keep children safe." Ofcom's guidance doesn't address the risk that verification databases create a new category of sensitive data: records of which adults visited which age-restricted sites.
What you can do, regardless of method
Use a VPN. If you're accessing a UK site from outside the UK, the site may not prompt you for age verification. If you're inside the UK and want to avoid the checks entirely, route your traffic through a non-UK endpoint. The Act applies to services "with links to the UK." If the site doesn't think you're in the UK, the duty doesn't trigger. This is a blunt instrument and may itself be the next target. The case for VPN-specific duties is already on Ofcom's desk.
Use a dedicated email address for verification. If the method requires an email (many do), create one that isn't linked to your real identity.
Read the privacy policy. Before you hand over data, find out which vendor the site is using. Search for the vendor's privacy policy. Look for the retention period and the data-sharing section. If the policy is vague or the vendor is unknown, use a different method or a different site.
Check the vendor's ownership. Persona is backed by Founders Fund, the venture firm founded by Peter Thiel, who also co-founded Palantir. KWS is owned by Epic Games. The ownership structure tells you who has a financial interest in the data, and what happens to it if the company is sold.
Turn off verification after you're done. Persona states it deletes verification data "as soon as we can" after the check is complete. This won't undo the data the site already has, but it limits future exposure.
Glossary
Age assurance: Ofcom's umbrella term covering age verification (confirming a specific age) and age estimation (estimating an age range). The Act requires age assurance.
KYC (Know Your Customer): Identity verification rules originally designed for financial services to prevent money laundering and fraud. Many age verification vendors are KYC vendors that repurposed their infrastructure.
Liveness check: A test to confirm the person being verified is a real, live human and not a photo, video, or mask. Usually involves blinking, turning your head, or reading a random sequence.
Selective disclosure: A privacy technique where you prove a specific attribute ("I'm over 18") without revealing the underlying data (your exact date of birth). Digital ID wallets use this.
UK GDPR: The United Kingdom's version of the General Data Protection Regulation, which governs how personal data is collected, stored, and processed. Applies to age verification vendors operating in the UK.
Open banking: A UK regulatory framework that requires banks to let customers share their financial data with authorised third-party providers through standardised APIs. Used for age verification by checking the account holder's date of birth.
MNO (Mobile Network Operator): The company that provides your mobile phone service. In the UK, the main operators are EE, Vodafone, Three, and O2. MNOs hold account holder data including name, date of birth, and address, collected through identity verification requirements at the point of SIM card purchase.
Last reviewed 17 June 2026. The age verification environment changes as vendors are acquired, privacy policies are updated, and Ofcom issues new guidance. If you're reading this after December 2026, check the vendor privacy policies directly. The retention periods and ownership structures described here may have changed.
How exposed are you? Take the Tracking Audit (≈5 min) →