This morning Ofcom published its assessment of how social media firms could check that their users are 16 or over when the under-16s ban comes into force next year. It names four methods it considers capable of being “highly effective”: photo ID matching, banking checks, digital ID services and facial age estimation.
Most of the coverage has focused on the children, and whether determined teenagers will find a way round. Ofcom has been candid that they will, and that the risk of circumvention can’t be removed entirely. That debate matters, but I think the bigger story for anyone who works in data protection or information security is the adults. If the checks are going to work, a great many grown-ups are going to have to prove their age too, and that means a great deal of identity data moving to places it has never been before.
What Ofcom has actually said
The four methods work in quite different ways. Photo ID matching compares a passport or driving licence with a live image of the person taking the check. Banking checks, with the user’s consent, confirm age using information a bank already holds. Digital ID services let someone prove their age through an identity provider, potentially without showing a document every time. Facial age estimation analyses a face and estimates an age.
Ofcom accepts that facial age estimation can be out by several years around the age of 16, so where the technology can’t be confident a second check will be needed. In practice that pushes a lot of people towards photo ID. Ofcom estimates that around 150,000 16 and 17 year olds have neither a passport nor a driving licence, and it has said those teenagers would probably need to get one.
The regulator doesn’t have a firm figure for how many adults will need to prove they are over 16, only that it will be a large number of accounts. The Government is due to set out the detailed rules before the end of this year, and the ban is expected to take effect in 2027.
Dame Melanie Dawes, Ofcom’s Chief Executive, said the methods “must preserve privacy, they must protect people’s data”, but that it is for the platforms to decide what works for them. That is a reasonable position for a regulator to take. It also means the security of all this data will depend on decisions made by dozens of different companies and, more to the point, by their suppliers.
Most of this data won’t sit with the platform
Social media firms don’t generally build age verification themselves. They buy it in from specialist age assurance providers, and those providers have their own suppliers for cloud hosting, document checking, customer support and appeals. Every link in that chain may touch the data, and every link is a possible point of failure.
We already have a good example of how this goes wrong. In 2025 Discord disclosed that a third-party customer service provider had been breached, and that around 70,000 users may have had images of their government ID exposed. Those images were held because the vendor used them to review age-related appeals. Discord’s own systems were not the ones breached.
The detail that matters is where the images were. They weren’t sitting in the main verification process, which is the part everyone designs carefully and describes in the privacy notice. They were sitting in the exceptions process: the appeals, the manual reviews and the support tickets that handle everyone the automated check couldn’t deal with.
Ofcom’s own assessment tells us there will be plenty of exceptions under the UK ban. Facial estimation will be unsure about people close to 16. Some teenagers won’t have ID. Some adults will be wrongly flagged as under age and will want to appeal, and they will be motivated to send whatever it takes to get their account back. The exceptions route is where copies of documents tend to collect, and it is usually the least well guarded part of the system.
Banking checks and digital ID raise different questions
On paper, banking checks look like the most privacy-friendly option, because the platform can receive a simple yes or no without ever seeing a document. I can see the appeal of that from a data minimisation point of view. The questions I would want answered are about the other direction of travel. Does the bank learn which platforms its customers are signing up to? Is that recorded, who can see the record, and how long is it kept?
Digital ID services raise a similar point at a larger scale. A reusable credential is convenient, but a provider that sits behind age checks on many different platforms ends up holding a record that is far more valuable than any single check. Privacy groups have already described the approach as national ID cards by the back door. Whatever your view of the ban itself, concentration of identity data in a small number of providers is a security question as well as a political one, and it deserves to be treated as one.
Why I haven’t verified my own LinkedIn identity
This is close to home for me. I have chosen not to verify my identity on LinkedIn. Verification there is carried out by a third party, Persona, which asks for passport and biometric data. I have no particular criticism of Persona. As an information security practitioner, though, I look at third-party data sharing in terms of how many copies of something sensitive exist and who holds them, and a verification badge wasn’t worth adding another copy of my passport to that list.
That was a choice I was free to make. Once the ban is in force, many adults won’t have that choice if they want to keep using the services their family, friends and work rely on.
What organisations should take from this
This isn’t only a problem for social media firms. Plenty of organisations ask people to prove who they are or how old they are, from right to work checks and tenant referencing to online sales of age-restricted products. Many of them have handed the checking to a supplier, and many have never looked closely at what that supplier does with the documents.
If you are in that position, start by finding out who actually carries out the check, and which of their suppliers can see the data. Then ask specifically about the exceptions route. Where do images go when the automated check fails, who reviews them, and how long are they kept? “Deleted after verification” is a common promise, so ask how that applies to appeals and support tickets, and what evidence you could see if you needed it.
It is also worth asking whether you need the document at all. If all you need to know is that someone is over 16 or over 18, a confirmation is far less risky to hold than a copy of their passport. Your data processing agreement should cover retention, sub-processors and how quickly the supplier must tell you about a breach, and a data protection impact assessment is the natural place to work all of this through, particularly where facial images are involved.
Responsibility will move down the supply chain
Ofcom has been clear that the platforms are responsible for getting this right. In practice that responsibility will be passed down the supply chain to verification providers and their subcontractors, many of whom the public will never have heard of. The people asked to hand over their passports will have no say in which of those companies ends up holding a copy.
The age checks may well keep a good number of under-16s off social media, but the identity data collected to make them work will need protecting long after the headlines have moved on, and the parts of the process that deal with appeals and exceptions are where I would expect the problems to show up first.
