Age verification, children's risk assessment support, and harm detection mapped directly to what Ofcom actually requires under the Online Safety Act. Not a generic content-moderation checklist relabelled for the UK.
Trusted by 250+ companies worldwide. EU-based infrastructure. Zero content retention.
- What the OSA requires
- Accepted age assurance methods
- Harm categories mapped to duties
- Privacy by architecture
- Integrating in an afternoon
- The cost of getting it wrong
- Frequently asked questions
What the Online Safety Act actually requires
The Online Safety Act isn't one rule. It's a set of duties that apply differently depending on what your platform is and who uses it. The two duties most platforms are searching for a vendor to help with:
Children's risk assessment and safety duties (Part 3)
If your service is a user-to-user or search service likely to be accessed by children, you were required to complete and record a children's risk assessment by 24 July 2025. Since 25 July 2025, Ofcom's Protection of Children Codes require you to either implement the measures in the Codes or adopt other measures that meet the same standard, and keep records showing you did. Ofcom has said it's ready to take enforcement action against services that haven't acted.
Age assurance duties (Part 5, and Part 3 for primary priority content)
If you publish pornographic content, or you're a user-to-user service that allows primary priority content (pornography, suicide and self-harm content, or content promoting eating disorders), you must apply "highly effective age assurance" to keep children away from it. Ofcom's standard, reaffirmed in a joint statement with the ICO in March 2026, requires age checks to be technically accurate, robust, reliable, fair, and easy to use for everyone. Self-declaration, a payment card check on its own, and ticking a "yes, I'm 18" box do not meet the bar.
Ofcom is due to publish a report by the end of July 2026 assessing how effective services' age assurance has actually been in practice. This is a live, actively enforced area, not a box you tick once.
Ofcom's accepted age assurance methods, and where Tuteliq fits
Ofcom publishes a non-exhaustive list of methods capable of meeting the highly effective standard: photo-ID matching combined with facial recognition and liveness checks, facial age estimation, open banking verification, mobile network operator checks, credit card verification, and reusable digital identity services.
Ofcom-listed method
Tuteliq implementation
Photo-ID matching + facial recognition + liveness
Combined method: document OCR/MRZ extraction cross-referenced against a live selfie, with liveness detection to catch photo, screen, and deepfake spoofing.
Facial age estimation
Biometric method: age-bracket estimation from a selfie alone with our own model, no document required and no image sent to any language model.
Document-based verification (Tuteliq addition)
Document method: DOB extracted from a government ID via OCR, MRZ (ICAO 9303, passports), and PDF417 barcode decoding, with algorithmic document-number validation across 45 supported countries.
We won't tell you Tuteliq does open banking or mobile network checks. It doesn't, and a vendor claiming to do everything on Ofcom's list is usually doing none of it well. What we do, we do with layered cross-referencing most single-purpose age-check widgets skip: MRZ vs. OCR vs. barcode vs. selfie, with every mismatch flagged rather than silently ignored.
Harm categories, mapped to your OSA duties
Beyond age assurance, Part 3 requires safety measures against illegal content and content harmful to children. Tuteliq's detection endpoints map directly onto the categories Ofcom's Codes are concerned with:
OSA harm area
Tuteliq endpoint(s)
Grooming and child sexual exploitation
/safety/grooming, /safety/unsafe (multi-turn behavioural detection)
Suicide, self-harm and eating disorder content (primary priority content)
/safety/unsafe, always elevated to critical severity
Bullying, harassment and abuse
/safety/bullying, /safety/coercive-control
Image-based abuse and sextortion
/safety/image, /safety/grooming
Fraud, scams and financial exploitation targeting minors
/fraud/social-engineering, /fraud/romance-scam, /fraud/mule-recruitment
Radicalisation and extremist content
/safety/radicalisation
Voice chat and live audio
/safety/voice (WebSocket streaming for real-time monitoring)
Every endpoint accepts an age_group context field, so the same message is scored differently for an 8-year-old than a 16-year-old. That's the kind of age-appropriate calibration a children's risk assessment expects you to demonstrate, not just assert.
Privacy by architecture, not by policy
Age assurance means handling some of the most sensitive data a platform touches: identity documents, selfies, dates of birth. Tuteliq is built so that data doesn't become a liability.
Nothing stored after verification
Documents and selfies are processed in real time; only the verification result (age range, pass/fail, confidence) is retained. No images, no extracted PII sitting in a database waiting to be breached or subpoenaed.
Fully stateless detection
Safety analysis endpoints never store conversation text or session state between calls. You pass context with each request, Tuteliq analyses it, and discards it. No conversation cache to leak.
No training on your data
Content submitted for analysis is never used to train models, and nothing is shared with third-party APIs beyond the processing needed to return your result.
EU-based infrastructure
Processing runs on EU-region infrastructure, relevant to UK GDPR data-handling obligations alongside the OSA duties above.
Built to integrate in an afternoon, not a quarter
- SDKs for Node.js, Python, Swift, Kotlin, Flutter, React Native, .NET, and Unity, plus a CLI. Pick the one that matches your stack, not the vendor's.
- MCP server for AI-assisted development. Connect Tuteliq to Claude Desktop, Cursor, or Claude Code and your assistant can call detection and verification endpoints directly while you build.
- Sandbox API keys run real (not mocked) analysis with no credits consumed, so your engineering team can validate the integration before committing budget.
- 14-day free trial on any paid plan (no card charged for 14 days). Age verification is available from the Assure tier ($499/mo), 10 credits in Liveness Only mode and 20 credits in Complete mode.
The cost of getting this wrong
A Tuteliq plan costs less than a single regulatory finding. Ofcom's enforcement powers under the OSA include fines of up to £18 million or 10% of qualifying worldwide revenue, whichever is higher, and Ofcom has already signalled it's prepared to act on children's safety duties without waiting for a full investigation cycle.
Figures are statutory maxima from regulator publications. Tuteliq reduces regulatory exposure. It does not replace legal counsel.
Does Tuteliq make my platform "Online Safety Act compliant"?
Is Tuteliq's age verification "highly effective" under Ofcom's standard?
Where do I find general online safety act guidance rather than a vendor pitch?
What about the Illegal Content Duties and Part 5 age assurance separately?
How long does Tuteliq retain age verification data?
Do I need a separate Children's Access Assessment before turning on age assurance?
See also: All Ofcom duty guides, Illegal harms risk assessment, Protection of Children Codes, Enforcement and fines, UK age assurance guide, Compliance overview, Trust Center.
How age verification is configured in Tuteliq
Every setting below is available in the Tuteliq dashboard under Verification › Age Verification. Compliance, product and engineering teams share one source of truth: the same rules that appear here are the ones your integration reads at runtime through the /v1/age-verify endpoint.
Verification Mode
Pick the default level of assurance for new sessions. Overrides per market are set further down.
Liveness check plus an official document (passport, national ID or driver licence). Highest assurance, recommended for hard legal thresholds like 18+, 21+ or Online Safety Act "highly effective" categories.
Selfie plus liveness with biometric age estimation. Lower friction, ideal as a first-pass age gate or where the applicable rule accepts age estimation as a reasonable step.
Market Overrides
Override the default verification mode per jurisdiction. Unset markets inherit from their region group, or from the global default above.
Market
Default
Complete
Liveness Only
EU (27 member states)
Inherit
Document + liveness
Selfie + liveness
United States
United Kingdom
Australia
Canada
Latin America
Asia-Pacific
Middle East & North Africa
Sub-Saharan Africa
Rest of the World
EU and US groups can be expanded to set country and state level overrides (e.g. force Complete in the UK while keeping Liveness Only across the rest of the EU).
Age Threshold & Overrides
Global minimum age for verification. Users below this age are flagged as minors and routed into the minor handling flow (block, parental consent, or age-appropriate experience, depending on your platform rules).
- Global default: 18 (configurable 13, 14, 15, 16, 17, 18, 21).
- EU: default 16 for data processing consent (GDPR Article 8), lowered to 13 in states that opted down.
- United States: 13 (COPPA) with per-state overrides for KOSA and state-level laws.
- United Kingdom: 18 for pornography and 'highly effective' categories, 13 for social features under OSA.
- Australia: 16 for social media accounts under the Online Safety Amendment.
- Any market can be pinned to a fixed age regardless of its region group.
Integrating the settings into your app
Dashboard settings are enforced automatically. Your integration only needs to open a verification session and read back the result.
- 1. Install the SDK bun add @tuteliq/sdk # or: npm install @tuteliq/sdk
- 2. Store your API key Set TUTELIQ_API_KEY as a server-side secret. Never expose the key in browser code.
Set TUTELIQ_API_KEY as a server-side secret. Never expose the key in browser code.
- 3. Create a verification session (server side) import { Tuteliq, VerificationMode } from "@tuteliq/sdk"; const tuteliq = new Tuteliq(process.env.TUTELIQ_API_KEY!); const session = await tuteliq.createVerificationSession({ mode: VerificationMode.AGE, redirect_url: "https://yourapp.com/verified", }); return { url: session.url, sessionId: session.session_id }; Redirect the user (or open a new tab) to session.url. Tuteliq applies the verification mode and age threshold you configured for the user's market.
Redirect the user (or open a new tab) to session.url. Tuteliq applies the verification mode and age threshold you configured for the user's market.
- 4. Read the outcome const result = await tuteliq.getVerificationSession(sessionId); // result.status: "pending" | "verified" | "failed" // result.result.age: estimated or extracted age // result.result.is_minor: boolean flag against configured threshold
- 5. Optional: webhooks Register a webhook to receive instant session updates instead of polling. Persist the verified status in your database so users do not re-verify on every visit.
Register a webhook to receive instant session updates instead of polling. Persist the verified status in your database so users do not re-verify on every visit.
All configuration is versioned and audit-logged. Changes to verification mode, market overrides or age thresholds are timestamped against the acting admin, so compliance teams can produce evidence of controls on demand.
Settings reference
Every knob compliance and engineering teams can turn, with the values accepted by the dashboard and the API. Each rule links to the statute or regulator guidance it derives from, so you can cite the primary source in your own DPIA or audit pack.
Verification modes
Set globally or per market override. API field: mode.
Mode
API value
Signals used
Assurance
Typical use & sources
complete
Document (OCR + MRZ + barcode) + selfie + liveness
High
18+ / 21+ hard gates, OSA highly effective, adult content Ofcom highly effective age assurance guidance (opens in a new tab) UK Online Safety Act 2023 (opens in a new tab)
liveness
Selfie + liveness + biometric age estimation
Medium
First-pass age gate, waterfall entry point, no-ID alternative Ofcom highly effective age assurance guidance (opens in a new tab)
Document Only
document
Document OCR + MRZ + barcode (no selfie)
Medium-High
Server-side batch verification, KYC top-up UK Online Safety Act 2023 (opens in a new tab)
Estimation Only
estimation
Facial age estimation, no document
Low-Medium
Low-risk features, waterfall low-friction rung Ofcom highly effective age assurance guidance (opens in a new tab)
Age thresholds
Minimum age users must meet to pass a verification. API field: min_age. Users below are flagged as minors and routed into your minor-handling flow.
Threshold
Legal basis & sources
Examples
13
COPPA (US), GDPR Art. 8 floor COPPA (15 U.S.C. §6501) (opens in a new tab) GDPR Art. 8 (opens in a new tab)
US default, general social features
14
GDPR Art. 8 opt-down state GDPR Art. 8(1) national opt-down (opens in a new tab) Italy D.Lgs. 101/2018 (opens in a new tab) Spain LOPDGDD Art. 7 (opens in a new tab)
Italy, Austria, Spain data-processing consent
15
GDPR Art. 8 opt-down state GDPR Art. 8(1) national opt-down (opens in a new tab) France Loi 2024-449 (SREN) (opens in a new tab)
France, Czechia, Greece
16
GDPR Art. 8 default, AU Minimum Age Act GDPR Art. 8 (opens in a new tab) AU Online Safety Amendment (Social Media Minimum Age) Act 2024 (opens in a new tab)
EU default consent, AU social media accounts
17
Platform policy
Adult-adjacent content, R-rated marketplaces
18
OSA primary priority, general adult UK Online Safety Act 2023 (opens in a new tab) Ofcom highly effective age assurance guidance (opens in a new tab)
UK pornography and highly effective categories
21
Regional alcohol / gambling law
US alcohol, some gambling jurisdictions
Any market can be pinned to a fixed threshold that overrides its region group. Thresholds are evaluated against the extracted or estimated age at verification time.
Market overrides
Overrides resolve in priority order: country / state override, region group, then global default. API field: market (ISO 3166-1 or sub-region code).
Suggested mode
Suggested threshold
Rationale & sources
18 / 13
OSA highly effective for PPC; 13 for social features UK Online Safety Act 2023 (opens in a new tab) Ofcom highly effective age assurance guidance (opens in a new tab)
Ireland
18 / 16
OSA-adjacent Coimisiún na Meán rules, GDPR Art. 8 default Coimisiún na Meán Online Safety Code (opens in a new tab) GDPR Art. 8 (opens in a new tab)
EU (default)
GDPR Art. 8 default consent age GDPR Art. 8 (opens in a new tab)
France
GDPR Art. 8 opt-down GDPR Art. 8(1) national opt-down (opens in a new tab) France Loi 2024-449 (SREN) (opens in a new tab)
Germany
JMStV youth media protection JMStV (Jugendmedienschutz-Staatsvertrag) (opens in a new tab) GDPR Art. 8 (opens in a new tab)
Italy / Spain
GDPR Art. 8 opt-down GDPR Art. 8(1) national opt-down (opens in a new tab) Italy D.Lgs. 101/2018 (opens in a new tab) Spain LOPDGDD Art. 7 (opens in a new tab)
Social Media Minimum Age Act 2024 AU Online Safety Amendment (Social Media Minimum Age) Act 2024 (opens in a new tab) eSafety Commissioner age assurance guidance (opens in a new tab)
United States (default)
COPPA floor COPPA (15 U.S.C. §6501) (opens in a new tab)
US: California
CCPA / Age-Appropriate Design Code CCPA / CPRA (opens in a new tab) California Age-Appropriate Design Code (AB 2273) (opens in a new tab)
US: Texas / Utah / Louisiana
State adult-content age verification laws Texas HB 1181 (opens in a new tab) Utah SB 287 (opens in a new tab) Louisiana Act 440 (opens in a new tab)
PIPEDA guidance PIPEDA guidance for minors (OPC) (opens in a new tab)
Conservative default; override per market as needed
Suggestions reflect common configurations, not legal advice. Confirm applicable thresholds with counsel before publishing. Links open the official statute or regulator guidance in a new tab.
Pick the plan that covers your Online Safety Act duties
All plans include age assurance, CSAM and grooming detection. Business adds a public Trust Center and audit exports for Ofcom evidence.
Build
From $99/mo
For small platforms starting compliance work.
- Age verification API and SDK
- CSAM and grooming detection
- Dashboard with market overrides
- Email support
Assure
From $499/mo
For platforms with UK, EU or AU users in scope.
- Everything in Build
- Public Trust Center on your subdomain
- Audit logs and compliance exports
- SLA and priority support
Enterprise
Custom
For regulated platforms and large deployments.
- Custom retention and residency
- SSO, RBAC and DPA
- Named compliance partner
- Regulator-ready reporting
Request a security & compliance review for the Online Safety Act
A joint session with our security engineering and compliance leads mapping your platform against Part 3 children's duties, Part 5 age assurance, and Ofcom's illegal content codes. You leave with a written gap analysis and a prioritised action plan.
- Data-flow and retention review
- Written jurisdictional gap analysis
- Prioritised remediation plan
Response within one business day.
Book a security & compliance review
Tell us about your platform. Our security and compliance leads will confirm a 60-minute slot within one business day.
By submitting, you agree to be contacted by Tuteliq about this request. We do not share your details with third parties.
Map the Online Safety Act to your platform
Request a compliance assessment covering illegal content, children's access and Ofcom duties.