Ofcom’s 2026 age-assurance report: five operational changes to make now

Checked 31 July 2026. Ofcom’s first statutory report on how regulated services use age assurance does not reduce compliance to the purchase of an age-check product. The regulator looks at whether the complete implementation is highly effective, whether services follow the guidance in full, how vendors are overseen and whether privacy duties are met. For adult services, the immediate task is to turn a collection of screens and contracts into one testable evidence chain.

What the 2026 report says

The report focuses heavily on the first six months after protection-of-children duties took effect in July 2025 and covers pornography, social media and online dating. Ofcom says age checks are being deployed at unprecedented scale, but the work is incomplete. Pornography services without age checks are told to introduce highly effective age assurance without delay. Services that already use it must ensure the method and its implementation satisfy the guidance.

Ofcom highlights three improvement areas: follow its highly effective age-assurance guidance in full, conduct regular due diligence on any age-assurance vendor and comply with privacy and data-protection obligations. Responsibility remains with the regulated service even when a third party performs the check. The report also says no single method eliminates circumvention risk and points to layered protections across services, app stores, operating systems and devices.

Change 1: test the whole placement, not only the vendor

A technically capable method can still fail if it appears after harmful content, can be bypassed through an alternate route or breaks on common mobile and accessibility paths. Map every entry point, preview, embed, search landing page and authenticated route. Confirm what an unverified visitor can see before the decision and what happens after refresh, logout, device change or a failed attempt.

Keep dated screenshots and automated checks, but exclude identity documents and raw biometric data from general QA evidence. The purpose is to prove the product boundary, not to create another sensitive archive.

Change 2: measure effectiveness and legitimate-user friction

Ofcom distinguishes methods that can determine whether someone is an adult from techniques that may not fit a specific threshold. It also says age inference cannot be suitable for preventing access where it only works after a child has already signed up and used the service. Operators need a documented basis for the selected method, not a generic claim that it uses AI.

Measure completion, repeat checks, technical failure, fallback use, support contact and successful appeal. Segment results carefully enough to identify device or accessibility failures without collecting more personal data than the analysis needs. A low abandonment rate alone does not demonstrate protection, and a strict block alone does not demonstrate a usable, lawful process.

Change 3: govern the vendor as part of your own system

Vendor due diligence should cover the data received, purpose, retention, subprocessors, security controls, incident notice, model or threshold changes, deletion and audit rights. Product owners need to know when a supplier alters an SDK or decision flow. Legal teams need the current contract; engineering needs the current integration map; support needs an escalation route that does not bounce users between companies.

Change 4: explain privacy before the check

Before a user begins, identify the provider, the type of information used, whether the adult service receives a date of birth or only an over-threshold signal, how long records remain and what fallback exists. Do not require a user to submit first and discover the data flow later. Make the explanation readable on a small screen and available before any camera, document or account permission is requested.

Change 5: build support, appeal and recurring review

A legitimate adult who cannot pass needs a visible alternative and a support route with an accountable owner. Record categories of failure rather than sensitive payloads. Review the implementation on a fixed cadence and after a vendor, policy, threshold or product-route change. Re-run tests against logged-out, new-account and returning-user states.

A five-minute reader check

• Check whether explicit material is visible before the age decision.
• Read which company performs the check and what the adult site receives back.
• Look for a fallback if the first method fails and a support path for incorrect decisions.
• Avoid sending identity material through a link whose domain or purpose is unclear.
• Return to the privacy notice after the check and confirm how deletion or complaints work.

Editorial bottom line

Ofcom’s message is operational: highly effective age assurance is a system property, not a badge attached to one vendor. Adult services should be able to demonstrate placement, method selection, vendor oversight, privacy, fallback support and recurring review as one chain. Users should be able to understand that chain before sharing sensitive evidence. Where a service cannot explain the provider, data flow or remedy for a wrong decision, the implementation remains incomplete from a trust perspective.

Sources

• Ofcom: Report on the use of age assurance 2026
• Ofcom: research on proving age to access online pornography
• Ofcom: age-assurance duties and guidance

This is dated editorial analysis, not legal advice. FoxyPulse does not receive identity documents and does not assess an individual user’s eligibility.