A Year of the Online Safety Act: Ofcom’s Progress Report Reveals the Scale, Successes, and Systemic Gaps of UK Age Verification

Introduction

Nearly one year after the United Kingdom enacted its landmark Online Safety Act (OSA), Ofcom, the nation’s communications regulator, has released a comprehensive progress report detailing the real-world impact of the legislation. Designed to shield minors from harmful and age-inappropriate material online, the law has triggered an unprecedented overhaul of how digital platforms verify the identity and age of their users.

Ofcom’s findings paint a complex picture of a digital landscape in transition. While age-assurance mechanisms are being deployed at a scale never before seen across social media, adult entertainment, gaming, and online dating, significant loopholes remain. Minors continue to discover adult content through mainstream search engines, and some platforms rely on weak verification methods that the regulator warns are no longer acceptable.

As the UK prepares to introduce even stricter digital regulations—including a blanket social media ban for children under the age of 16 and curfews for older teenagers—the efficacy of these age-assurance technologies has become the central battleground for the future of internet governance.

Main Facts: The Current State of UK Age Assurance

The Online Safety Act mandates robust, highly effective age-verification measures for any website or platform hosting content categorized as "restricted to adults." This regulatory umbrella is remarkably broad. It spans not only explicit adult entertainment sites but also non-explicit forums and communities that discuss adult-oriented topics, such as the popular Reddit community r/stopsmoking.

According to Ofcom’s assessment, the deployment of these age-verification barriers has grown exponentially. However, the regulator’s report highlights a stark divide between industry compliance and ongoing vulnerability:

• Massive Scaling of Verification: Between July 2025 (when the law’s key age-assurance provisions went into active enforcement) and January 2026, the percentage of children prompted to prove their age who encountered "highly effective" checks rose from 25 percent to 43 percent.
• Volume of Checks: Across a monitored sample of just 32 digital services, users completed an astonishing 69 million age-verification checks between July and December of last year—representing a 23-fold increase compared to the preceding six-month period.
• Adult Site Compliance: The compliance rate among major adult content providers has surged. All of the UK’s top 10 most visited pornographic websites, and 64 of the top 100, have successfully integrated age-assurance technologies. An additional 10 platforms opted to pull out of the UK market entirely, implementing geo-blocking to prevent UK IP addresses from accessing their services.
• Persistent Vulnerabilities: Despite these gains, Ofcom cautions that "too many porn sites still don’t have age checks in place." The regulator has officially launched 23 active investigations targeting the operators of 88 adult services. Furthermore, search engines continue to act as gateways to unverified adult material, and a significant portion of older teenagers are still successfully bypassing age gates on popular dating applications.

Chronology: The Road to Implementation and Future Milestones

The implementation of the Online Safety Act and its subsequent enforcement timeline reflect a phased, highly monitored regulatory rollout:

[October 2023] --------> [July 2025] -----------> [Dec 2025 - Jan 2026] ------> [Oct 2026] ------------> [Jan 2027]
Online Safety Act        Age-assurance           Ofcom monitors 69M             Ofcom delivers         Report on app-store-
becomes law              provisions active       checks; launches 23            under-16 age-check     level verification
                         enforcement             investigations                 standards to Parl.     to Parliament

Phase 1: Enactment and Preparation (Late 2023 – Mid-2025)

Following years of parliamentary debate, the Online Safety Act was passed into law. Tech companies and adult service providers were given a grace period to source, test, and integrate age-assurance technologies—ranging from credit card verification and database matching to facial age-estimation software.

Phase 2: Active Enforcement and Monitoring (July 2025 – January 2026)

In July 2025, Ofcom’s strict enforcement window opened. Over the subsequent six months, the regulator initiated its Children’s Passive Online Monitoring study to track how minors interacted with these new barriers in real-time. By December 2025, the volume of digital age checks peaked at unprecedented levels.

Phase 3: The Present Report and Active Investigations (Early 2026)

Ofcom consolidated its data from the July–January window, culminating in the release of this progress report. Recognizing that dozens of mid-tier and smaller adult sites remained non-compliant, Ofcom opened 23 investigations covering 88 adult services.

Phase 4: Upcoming Regulatory Deadlines (Late 2026 – Early 2027)

The regulatory roadmap does not end here. By the end of October 2026, Ofcom is legally required to deliver a formal assessment to Parliament outlining what constitutes a "highly effective age check" specifically designed to verify if a user is over the age of 16. Looking further ahead, the regulator will publish a highly anticipated report on the feasibility of app-store-level age verification by January 2027.

Supporting Data: Examining the Metrics of Compliance and Evasion

To measure the real-world efficacy of the Online Safety Act, Ofcom relied on passive monitoring data, direct audits of platform traffic, and search engine query analysis. The resulting data points highlight both the strength of the new barriers and the creative ways minors navigate around them.

Children’s Interaction with Adult Sites

Ofcom’s Children’s Passive Online Monitoring study focused on the online habits of minors aged 8 to 14. The data revealed that:

• Exposure Rates: 8 percent of the children participating in the study attempted to visit or visited online porn providers during the monitoring period.
• The Power of Age Gates: Of those who attempted to access these sites, exactly half (50 percent) were successfully blocked, only ever reaching landing pages protected by mandatory age checks.
• Friction and Bouncing: For the minors who did manage to load adult pages, their exposure was fleeting. The vast majority of these visits—87 percent—lasted less than 30 seconds, while 65 percent of visits were cut short in under 10 seconds. This suggests that even when a site is reached, subsequent pop-ups, verification prompts, or slow loading times caused by compliance frameworks quickly deter younger users.

The Search Engine Loophole

One of the most glaring vulnerabilities exposed in the report is the role of search engines in helping minors bypass age-assurance walls.

Because the Online Safety Act does not explicitly legally mandate search engine providers to implement their own age-assurance gates to block search results, minors frequently use these platforms to discover smaller, non-compliant adult sites that have not yet been targeted by Ofcom’s enforcement actions.

Underage Access to Dating Apps

The data also raised alarm bells regarding the online dating sector. In December 2025, despite the widespread implementation of age gates, over 10 percent of teenagers aged 15 to 17 successfully accessed three of the UK’s most popular dating applications (including Tinder and Hinge). This high rate of underage infiltration suggests that the verification methods deployed by these dating services are failing to catch older teens who falsify their birth years or use alternative identification methods.

Official Responses: Ofcom’s Stance and Enforcement Actions

In releasing the report, Ofcom has taken a firm, uncompromising stance against tech companies that rely on weak or outdated verification methodologies.

The Rejection of "Age Inference"

A major focal point of Ofcom’s communication is the rejection of "age-inference" models. Age inference involves using algorithmic systems to estimate a user’s age based on their behavioral patterns, typing speed, interests, or interaction history.

In a press release shared with the media, Ofcom delivered an explicit warning:

"Our message to social media companies is clear: those which use age inference models to comply with their child protection duties should switch to other methods listed in our guidance as highly effective without delay."

The regulator favors more deterministic, highly reliable methods, such as facial age estimation (which uses AI to analyze a selfie without requiring formal identity documents) or secure third-party identity verification.

Targeting Search Providers and Non-Compliant Platforms

Ofcom confirmed that both Google and Microsoft (Bing) are actively collaborating with the regulator to address the high discoverability of unverified adult sites through search results. However, because search engines are not legally bound by the same age-gate requirements as content hosts under the current text of the OSA, this cooperation remains largely voluntary and collaborative rather than strictly punitive.

For the 23 investigations currently underway, Ofcom has warned that platforms failing to implement highly effective age assurance face severe financial penalties. Under the Online Safety Act, Ofcom has the authority to fine non-compliant companies up to £18 million or 10 percent of their global annual turnover, whichever is higher.

Implications: The Broadening Scope of UK Digital Regulation

The findings of this one-year review have profound implications for the UK’s broader digital policy agenda. The data gathered during this period is directly shaping the government’s plans for subsequent, even more restrictive internet regulations.

The Under-16 Social Media Ban and Teen Curfews

The UK government is currently progressing plans to enact a total ban on social media for children under the age of 16. To enforce this ban, the government intends to rely on the exact same age-assurance frameworks validated under the Online Safety Act.

Furthermore, the government recently announced a proposed "social media curfew" for teenagers aged 16 and 17, which would restrict platform access during late-night hours. The success of both policies hinges entirely on the ability of social media platforms to accurately and consistently identify the exact age of their users—a task that Ofcom’s report proves is still highly inconsistent.

Lessons from Abroad

The UK’s aggressive push toward age verification stands in stark contrast to recent international developments. A recent study evaluating Australia’s proposed social media ban concluded that such bans are largely ineffective. The Australian study noted that because age-estimation models are often weak and easily bypassed, younger users frequently evade detection entirely, while privacy-conscious adults are subjected to intrusive surveillance and data-collection practices.

Ofcom is attempting to avoid these pitfalls by establishing a rigid, standardized definition of "highly effective age checks" by October 2026. By shifting the burden of verification away from individual websites and potentially onto app stores (via the upcoming January 2027 report), the UK regulator hopes to create a centralized, secure verification ecosystem that protects children without compromising adult privacy or data security.

Whether the tech industry can successfully adapt to this centralized vision remains the defining question of the UK’s ambitious digital experiment.