In March the Information Commissioner’s Office wrote to Facebook, TikTok, Instagram, YouTube, Snapchat and X asking for urgent reviews of how they check their users’ ages. Two months later the regulator said none of them had introduced new, viable and privacy-friendly age assurance, and that it was ready to use formal investigations and sanctions.
More than a year into the Online Safety Act’s child-protection duties, one regulated consumer sector in Britain has already settled the question platforms are still arguing over. Since May 2019, a licensed online gambling site has not been allowed to take a deposit from a customer whose age it has not confirmed.
A six-year head start
Before that change, operators had 72 hours after an account was opened to carry out age verification, which left a window in which an underage customer could deposit and play. The Gambling Commission closed it with rules that took effect on 7 May 2019. Operators must now verify age before a customer can deposit funds, play free-to-play versions of gambling games, or gamble with their own money or a bonus. Name, address and date of birth have to be confirmed as a minimum.
The Commission did not prescribe a method. Many operators run new customers against third-party databases first and ask for documents only when the automated check fails. Typing in a date of birth is not enough on its own. The same checks also run against GamStop, the national self-exclusion scheme, so one verification step does two jobs at once.
Age as a product setting
The newer rules go further than keeping children out. They treat young adults differently. In 2025 the government put limits on online slot stakes into law: a cap of £5 per spin took effect for adults on 9 April, and a lower cap for younger players followed on 21 May.
The result is a two-tier adult market: online slots are capped at £2 a spin for players aged 18 to 24 and £5 for everyone older, limits that a summary of the rules for UK online casinos lists alongside the requirement to verify identity before any deposit is accepted.
That design only works because age is already verified when the account is opened. The limit applies to each game cycle, so the platform needs a confirmed date of birth on file before the first spin, not a self-declared one. For a social network, the equivalent would be switching features on or off by verified age band rather than relying on a single gate at sign-up.
What platforms can borrow
Ofcom’s guidance on highly effective age assurance lists the methods it will accept, among them photo-ID matching, facial age estimation, mobile network operator checks and digital identity services. Self-declaration is ruled out. In the services the regulator has examined, the two most common choices are facial estimation and photo-ID matching.
Estimation tools are getting better. In January Yoti said its single-selfie age estimation had become the first to qualify for Level 3 testing by the lab iBeta. Gambling’s model rests on matching records rather than estimating from a face, which suits a business that already has to hold verified identity data under anti-money-laundering rules. Social platforms built around low-friction sign-up carry no such duty, which goes some way to explaining why the ICO’s patience with the largest platforms has worn thin.
The cost of a settled rule
There is a price. When the automated check fails, customers are asked to upload a passport or driving licence, and some give up at that point, while operators end up holding sensitive identity data with the storage and security obligations that come with it.
Still, the sector shows that age assurance becomes routine once it is a licence condition and a regulator is willing to enforce it; left as a feature each company designs for itself, it tends to stall. Whether social platforms get there will depend less on the technology than on how firmly Ofcom and the ICO use the powers they already hold.
