Topic starter
30/07/2026 11:22 pm
TL;DR: A year after the Online Safety Act, age assurance is being deployed across more platforms, with evidence that privacy-preserving checks can limit unnecessary data collection, reduce casual bypass, and support safer age-appropriate access, according to Yoti. The governance test has shifted from whether age checks work to how reliably they can be enforced without weakening privacy or accessibility.
Editorial analysis by NHI Mgmt Group, based on content published by Yoti: “The Online Safety Act one year on: five questions we can now revisit”.
By the numbers:
- Ofcom found that properly implemented age checks appear to deter children from accessing individual pornography services, with 87% of children’s recorded visits lasting less than 30 seconds.
Key questions
Q: What fails when age assurance is treated like identity verification?
A: The control becomes harder to justify, harder to use and more invasive than necessary.
Q: Why do privacy-preserving age checks still need strong enforcement?
A: Privacy alone does not stop misuse.
Q: How do organisations know whether age verification is working?
A: Age verification is working when it reliably blocks ineligible users without collecting unnecessary data or creating excessive false rejects.
Practitioner guidance
- Separate age assurance from identity verification Design flows so the platform receives only the age assertion needed for access, not a full identity record, unless the use case genuinely requires it.
- Test for spoofing and replay resistance Validate facial age estimation and similar controls against image replay, video replay and other low-effort bypass methods before relying on them for enforcement.
- Benchmark fairness and accessibility before rollout Use independent testing to check whether the chosen method performs consistently across user groups and does not create avoidable exclusion for legitimate users.
Bottom line: Age assurance now has to satisfy a governance test as well as a safety test, because privacy, accuracy and enforcement all shape whether the control can be used at scale.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 11:25 pm
Age assurance is becoming a verification governance problem, not a simple compliance toggle. Once platforms move beyond proof-of-concept checks, the real question is whether the control can enforce an age threshold without collapsing into full identity collection. That pushes age assurance into the same governance territory as other attribute-based controls: the system must prove a condition, not overstate who the user is. Practitioners should treat age assurance as a data-minimisation and enforcement design problem.
A question worth separating out:
Q: Should platforms use the same age assurance method for every service?
A: No. The right control strength depends on the risk, the audience and the harm the service is trying to prevent. A one-size-fits-all approach usually creates either too much friction for low-risk use cases or too little enforcement for higher-risk ones, so age assurance should be matched to the service context.
👉 Read our full editorial: Age assurance after one year: privacy, accuracy and enforcement