Ofcom uses the term "age assurance," not "age verification," deliberately. Assurance covers everything from a quick estimate to a full document check; verification implies certainty a method might not actually provide. This guide walks through what Ofcom's standard actually requires, which methods meet it, and which don't.
For the full compliance picture (risk assessment duties, deadlines, and harm-category coverage), see our UK Online Safety Act compliance overview, or browse all Ofcom duty guides.
- What "highly effective" means
- Methods that meet the standard (and don't)
- How Tuteliq implements this
- Checklist before you pick a method
- Frequently asked questions
- Related reading
What "highly effective age assurance" means
Under the Online Safety Act, services that allow primary priority content (pornography, suicide and self-harm content, content promoting eating disorders), and any Part 5 service publishing its own pornographic content, must apply age checks that meet Ofcom's "highly effective" bar.
In March 2026, Ofcom and the ICO jointly clarified what that bar means in practice. A highly effective method must be, in Ofcom's own terms:
Technically accurate
It correctly estimates or verifies age in the large majority of cases.
Robust
It resists straightforward attempts to circumvent it (a printed photo, a borrowed ID).
Reliable
It produces consistent results, not results that vary by device, browser, or time of day.
Fair
It doesn't work meaningfully worse for some groups of users than others.
Easy to use and accessible
A method that's technically robust but so cumbersome that platforms quietly stop enforcing it doesn't meet the standard either.
Ofcom is due to publish a report by the end of July 2026 assessing how services have actually implemented age assurance and how effective it's been. This is a standard being actively monitored, not a one-time certification.
Methods that meet the standard
Ofcom's guidance lists several approaches capable of being highly effective:
Photo-ID matching + facial recognition + liveness
A government ID is matched against a live selfie, with liveness checks to rule out photos, screens, or deepfakes.
Facial age estimation
An age-estimation model estimates an age bracket from a live image, without a document.
Open banking verification
Uses bank-held age data via open banking rails.
Mobile network operator check
Confirms age via the account holder's mobile carrier.
Credit card verification
Uses the fact that UK card issuance requires being 18+.
Reusable digital identity
A pre-verified digital ID credential, checked once and reused.
Email-based age estimation
Analyses signals from how an email address has historically been used.
Methods that don't
Ofcom has been equally explicit about what falls short:
- Self-declaration (a checkbox or a typed date of birth)
- A payment card check used alone with no other signal
- Terms-and-conditions agreement ("I confirm I am 18")
If your current age gate is one of these, it does not meet Part 5 or primary-priority-content obligations, regardless of how it's presented in your UI.
Tuteliq's /verification/age endpoint covers two of Ofcom's listed methods, combinable in a single API call:
- Document method: DOB extracted from a passport, national ID, or driver's licence via OCR, ICAO 9303 MRZ parsing, and PDF417 barcode decoding, cross-referenced against algorithmic document-number validation (UK NI number check-digit validation included).
- Biometric method: facial age estimation from a selfie, classified into an age bracket by our own model running on our infrastructure. No image is sent to any language model.
- Combined method: both together, with any discrepancy over 10 years between document age and estimated age automatically flagged.
Every method includes liveness detection to catch the "robust" half of Ofcom's test. A printed photo, a photo of a screen, or a synthetic face doesn't pass. And because nothing beyond the verification result (age range, pass/fail, confidence score) is retained afterward, the data-minimisation half of your obligations is handled by architecture, not policy.
We don't offer open banking, mobile network, or reusable digital identity checks. If your platform needs one of those specific methods, you'll want a second vendor for that layer. What Tuteliq does offer is built to survive the "robust" and "technically accurate" parts of Ofcom's test: multi-source cross-referencing (MRZ vs. OCR vs. barcode vs. selfie), not a single check that quietly passes anything that isn't obviously wrong.
A short checklist before you pick a method
- 1 Confirm which duty applies Does it apply to Part 3 (primary priority content) or Part 5 (your own pornographic content), or both? The duty is the same standard, but confirm which applies to your service.
Confirm which duty applies
Does it apply to Part 3 (primary priority content) or Part 5 (your own pornographic content), or both? The duty is the same standard, but confirm which applies to your service.
- 2 Evidence technical accuracy Can you evidence technical accuracy? Ofcom will want more than a vendor's marketing claim: confidence scores, error rates, and audit logs matter.
Evidence technical accuracy
Can you evidence technical accuracy? Ofcom will want more than a vendor's marketing claim: confidence scores, error rates, and audit logs matter.
- 3 Handle graceful degradation Does it degrade gracefully? A method that fails should route to a fallback or a human reviewer, not silently let the user through.
Handle graceful degradation
Does it degrade gracefully? A method that fails should route to a fallback or a human reviewer, not silently let the user through.
- 4 Match method to risk Is it proportionate to your risk? A children's risk assessment should tie your chosen method back to the specific risks identified on your platform, not a generic 'we added an age gate' statement.
Match method to risk
Is it proportionate to your risk? A children's risk assessment should tie your chosen method back to the specific risks identified on your platform, not a generic 'we added an age gate' statement.
- 5 Keep a written record Do you have a record? Ofcom's Codes require you to keep evidence of what you did and why, not just that you did something.
Keep a written record
Do you have a record? Ofcom's Codes require you to keep evidence of what you did and why, not just that you did something.
What does Ofcom mean by 'highly effective' age assurance?
Is self-declaration or a tick-box enough to comply?
Which age assurance methods does Ofcom list as capable of being highly effective?
Does Tuteliq's age verification meet the highly effective standard?
What's the difference between 'age verification' and 'age assurance'?
How does privacy work when a document is checked?
Do I need a Data Protection Impact Assessment (DPIA) for age assurance?
- UK Online Safety Act compliance overview: risk assessment deadlines, harm-category mapping, and the full compliance picture.
- Ofcom: Age checks to protect children online: the regulator's own guidance.
- Trust Center: how Tuteliq handles the data behind these checks.
How age verification is configured in Tuteliq
Every setting below is available in the Tuteliq dashboard under Verification › Age Verification. Compliance, product and engineering teams share one source of truth: the same rules that appear here are the ones your integration reads at runtime through the /v1/age-verify endpoint.
Verification Mode
Pick the default level of assurance for new sessions. Overrides per market are set further down.
Liveness check plus an official document (passport, national ID or driver licence). Highest assurance, recommended for hard legal thresholds like 18+, 21+ or Online Safety Act "highly effective" categories.
Selfie plus liveness with biometric age estimation. Lower friction, ideal as a first-pass age gate or where the applicable rule accepts age estimation as a reasonable step.
Market Overrides
Override the default verification mode per jurisdiction. Unset markets inherit from their region group, or from the global default above.
Market
Default
Complete
Liveness Only
EU (27 member states)
Inherit
Document + liveness
Selfie + liveness
United States
United Kingdom
Australia
Canada
Latin America
Asia-Pacific
Middle East & North Africa
Sub-Saharan Africa
Rest of the World
EU and US groups can be expanded to set country and state level overrides (e.g. force Complete in the UK while keeping Liveness Only across the rest of the EU).
Age Threshold & Overrides
Global minimum age for verification. Users below this age are flagged as minors and routed into the minor handling flow (block, parental consent, or age-appropriate experience, depending on your platform rules).
- Global default: 18 (configurable 13, 14, 15, 16, 17, 18, 21).
- EU: default 16 for data processing consent (GDPR Article 8), lowered to 13 in states that opted down.
- United States: 13 (COPPA) with per-state overrides for KOSA and state-level laws.
- United Kingdom: 18 for pornography and 'highly effective' categories, 13 for social features under OSA.
- Australia: 16 for social media accounts under the Online Safety Amendment.
- Any market can be pinned to a fixed age regardless of its region group.
Integrating the settings into your app
Dashboard settings are enforced automatically. Your integration only needs to open a verification session and read back the result.
- 1. Install the SDK bun add @tuteliq/sdk # or: npm install @tuteliq/sdk
- 2. Store your API key Set TUTELIQ_API_KEY as a server-side secret. Never expose the key in browser code.
Set TUTELIQ_API_KEY as a server-side secret. Never expose the key in browser code.
- 3. Create a verification session (server side) import { Tuteliq, VerificationMode } from "@tuteliq/sdk"; const tuteliq = new Tuteliq(process.env.TUTELIQ_API_KEY!); const session = await tuteliq.createVerificationSession({ mode: VerificationMode.AGE, redirect_url: "https://yourapp.com/verified", }); return { url: session.url, sessionId: session.session_id }; Redirect the user (or open a new tab) to session.url. Tuteliq applies the verification mode and age threshold you configured for the user's market.
Redirect the user (or open a new tab) to session.url. Tuteliq applies the verification mode and age threshold you configured for the user's market.
- 4. Read the outcome const result = await tuteliq.getVerificationSession(sessionId); // result.status: "pending" | "verified" | "failed" // result.result.age: estimated or extracted age // result.result.is_minor: boolean flag against configured threshold
- 5. Optional: webhooks Register a webhook to receive instant session updates instead of polling. Persist the verified status in your database so users do not re-verify on every visit.
Register a webhook to receive instant session updates instead of polling. Persist the verified status in your database so users do not re-verify on every visit.
All configuration is versioned and audit-logged. Changes to verification mode, market overrides or age thresholds are timestamped against the acting admin, so compliance teams can produce evidence of controls on demand.
Settings reference
Every knob compliance and engineering teams can turn, with the values accepted by the dashboard and the API. Each rule links to the statute or regulator guidance it derives from, so you can cite the primary source in your own DPIA or audit pack.
Verification modes
Set globally or per market override. API field: mode.
Mode
API value
Signals used
Assurance
Typical use & sources
complete
Document (OCR + MRZ + barcode) + selfie + liveness
High
18+ / 21+ hard gates, OSA highly effective, adult content Ofcom highly effective age assurance guidance (opens in a new tab) UK Online Safety Act 2023 (opens in a new tab)
liveness
Selfie + liveness + biometric age estimation
Medium
First-pass age gate, waterfall entry point, no-ID alternative Ofcom highly effective age assurance guidance (opens in a new tab)
Document Only
document
Document OCR + MRZ + barcode (no selfie)
Medium-High
Server-side batch verification, KYC top-up UK Online Safety Act 2023 (opens in a new tab)
Estimation Only
estimation
Facial age estimation, no document
Low-Medium
Low-risk features, waterfall low-friction rung Ofcom highly effective age assurance guidance (opens in a new tab)
Age thresholds
Minimum age users must meet to pass a verification. API field: min_age. Users below are flagged as minors and routed into your minor-handling flow.
Threshold
Legal basis & sources
Examples
13
COPPA (US), GDPR Art. 8 floor COPPA (15 U.S.C. §6501) (opens in a new tab) GDPR Art. 8 (opens in a new tab)
US default, general social features
14
GDPR Art. 8 opt-down state GDPR Art. 8(1) national opt-down (opens in a new tab) Italy D.Lgs. 101/2018 (opens in a new tab) Spain LOPDGDD Art. 7 (opens in a new tab)
Italy, Austria, Spain data-processing consent
15
GDPR Art. 8 opt-down state GDPR Art. 8(1) national opt-down (opens in a new tab) France Loi 2024-449 (SREN) (opens in a new tab)
France, Czechia, Greece
16
GDPR Art. 8 default, AU Minimum Age Act GDPR Art. 8 (opens in a new tab) AU Online Safety Amendment (Social Media Minimum Age) Act 2024 (opens in a new tab)
EU default consent, AU social media accounts
17
Platform policy
Adult-adjacent content, R-rated marketplaces
18
OSA primary priority, general adult UK Online Safety Act 2023 (opens in a new tab) Ofcom highly effective age assurance guidance (opens in a new tab)
UK pornography and highly effective categories
21
Regional alcohol / gambling law
US alcohol, some gambling jurisdictions
Any market can be pinned to a fixed threshold that overrides its region group. Thresholds are evaluated against the extracted or estimated age at verification time.
Market overrides
Overrides resolve in priority order: country / state override, region group, then global default. API field: market (ISO 3166-1 or sub-region code).
Suggested mode
Suggested threshold
Rationale & sources
18 / 13
OSA highly effective for PPC; 13 for social features UK Online Safety Act 2023 (opens in a new tab) Ofcom highly effective age assurance guidance (opens in a new tab)
Ireland
18 / 16
OSA-adjacent Coimisiún na Meán rules, GDPR Art. 8 default Coimisiún na Meán Online Safety Code (opens in a new tab) GDPR Art. 8 (opens in a new tab)
EU (default)
GDPR Art. 8 default consent age GDPR Art. 8 (opens in a new tab)
France
GDPR Art. 8 opt-down GDPR Art. 8(1) national opt-down (opens in a new tab) France Loi 2024-449 (SREN) (opens in a new tab)
Germany
JMStV youth media protection JMStV (Jugendmedienschutz-Staatsvertrag) (opens in a new tab) GDPR Art. 8 (opens in a new tab)
Italy / Spain
GDPR Art. 8 opt-down GDPR Art. 8(1) national opt-down (opens in a new tab) Italy D.Lgs. 101/2018 (opens in a new tab) Spain LOPDGDD Art. 7 (opens in a new tab)
Social Media Minimum Age Act 2024 AU Online Safety Amendment (Social Media Minimum Age) Act 2024 (opens in a new tab) eSafety Commissioner age assurance guidance (opens in a new tab)
United States (default)
COPPA floor COPPA (15 U.S.C. §6501) (opens in a new tab)
US: California
CCPA / Age-Appropriate Design Code CCPA / CPRA (opens in a new tab) California Age-Appropriate Design Code (AB 2273) (opens in a new tab)
US: Texas / Utah / Louisiana
State adult-content age verification laws Texas HB 1181 (opens in a new tab) Utah SB 287 (opens in a new tab) Louisiana Act 440 (opens in a new tab)
PIPEDA guidance PIPEDA guidance for minors (OPC) (opens in a new tab)
Conservative default; override per market as needed
Suggestions reflect common configurations, not legal advice. Confirm applicable thresholds with counsel before publishing. Links open the official statute or regulator guidance in a new tab.
Plans that meet Ofcom's 'highly effective' bar
Start with the detection API and SDK. Move up when you need a public Trust Center and audit-grade evidence.
Build
From $99/mo
For small platforms starting compliance work.
- Age verification API and SDK
- CSAM and grooming detection
- Dashboard with market overrides
- Email support
Assure
From $499/mo
For platforms with UK, EU or AU users in scope.
- Everything in Build
- Public Trust Center on your subdomain
- Audit logs and compliance exports
- SLA and priority support
Enterprise
Custom
For regulated platforms and large deployments.
- Custom retention and residency
- SSO, RBAC and DPA
- Named compliance partner
- Regulator-ready reporting
Request a security & compliance review of your age assurance design
Our security and compliance leads audit your chosen method (document, biometric, or combined) against Ofcom's 'technically accurate, robust, reliable, fair, and easy to use' criteria and hand back a written justification your DPO and legal team can rely on.
- Data-flow and retention review
- Written jurisdictional gap analysis
- Prioritised remediation plan
Response within one business day.
Book a security & compliance review
Tell us about your platform. Our security and compliance leads will confirm a 60-minute slot within one business day.
By submitting, you agree to be contacted by Tuteliq about this request. We do not share your details with third parties.
Talk to us about UK age assurance
Request a demo or a gap analysis against Ofcom's 'highly effective' standard.