UK regulation
UK Online Safety Act age assurance
The Online Safety Act makes many services use highly effective age assurance to keep children away from adult content. Here's what that means in plain language, the dates that actually matter, and where a wallet based over-18 check fits.
At a glance
- Law
- Online Safety Act 2023
- Regulator
- Ofcom
- Own pornographic content (Part 5)
- Age-assurance duty in force 17 January 2025
- Children's codes (Part 3)
- Enforced from 25 July 2025, risk assessments due 24 July 2025
- Standard
- Highly effective age assurance: technically accurate, robust, reliable and fair
- Penalties
- Up to 18 million pounds or 10% of qualifying worldwide revenue
What the Act requires
The Online Safety Act puts duties on online services to protect people, and children in particular. Two parts matter most for age checks. Part 5 covers services that publish their own pornographic content, and its highly effective age-assurance duty came into force on 17 January 2025. Part 3 covers user-to-user and search services that are likely to be accessed by children, and Ofcom began enforcing its Protection of Children Codes from 25 July 2025, with children access risk assessments due by 24 July 2025.
The aim is to stop children encountering the most harmful material, which Ofcom calls primary priority content. That includes pornography as well as content encouraging suicide, self-harm or eating disorders. Where a service carries that content, it has to use age assurance to keep under-18s away from it.
What counts as highly effective
Ofcom does not accept a simple tick-box. Its guidance says highly effective age assurance has to be technically accurate, robust, reliable and fair. Self-declaration of age does not clear that bar.
Ofcom does list methods that can be highly effective when they are implemented well. Those include photo-ID matching, facial age estimation, open banking, mobile network operator age checks, credit-card checks and, importantly here, digital identity services and wallets. You still have to show your chosen method meets the four criteria in practice.
How a wallet check fits
A wallet based check asks the user to prove one fact, that they are over 18, from a credential their EU Digital Identity Wallet already holds. Ofcom lists digital identity services and wallets among the methods that can be highly effective, so this is a recognised route rather than a workaround.
The privacy story is the part users notice. The most common complaint about age checks, especially on adult sites, is being told to upload an ID. A wallet proof avoids that. The user confirms they're over 18 and nothing else, and with Tessio there is no document or date of birth stored on your systems or ours.
Where Tessio fits
Tessio gives you a cryptographic over-18 proof from the EU Digital Identity Wallet and a signed, auditable result to keep as evidence. There is no ID upload for the user and no personal data stored, which is exactly the friction and the liability that age checks usually add.
You are still responsible for meeting Ofcom's highly effective criteria for your service. We do not provide a document or selfie fallback, so a wallet check is one method in your mix today rather than the whole answer, and you will still need coverage for users without a wallet. We're happy to walk through how it sits in your setup.
Frequently asked
Does the Online Safety Act require age verification?
It requires highly effective age assurance, which can be met through age verification or age estimation, or both. Ofcom judges a method on whether it is technically accurate, robust, reliable and fair, not on the label. A wallet based over-18 proof is one recognised way to get there.
Who has to comply, and when?
Services that publish their own pornographic content came under the Part 5 duty on 17 January 2025. User-to-user and search services likely to be accessed by children came under enforcement of the Protection of Children Codes from 25 July 2025. Ofcom is the regulator and can levy large fines.
Is a digital identity wallet an accepted method?
Ofcom lists digital identity services and wallets among the methods that can be highly effective. You still have to show your implementation meets the four criteria, but a wallet check is a recognised route, not a grey area.
Primary sources
- Ofcom: guidance on highly effective age assurance
- Ofcom: age checks to protect children online
- Online Safety Act 2023 (legislation.gov.uk)
This is a plain language summary, not legal advice. Check your own duties against the primary sources and your regulator.
Put it into practice
Age verification for adult platforms
Adult content
Age verification for social and UGC platforms
Social and user content
Age verification for dating apps
Dating and matchmaking
EU Digital Services Act and age assurance
EU regulation
The EU Digital Identity Wallet, for relying parties
EU Digital Identity
Tessio for compliance
For compliance, legal and DPOs
Age verification API
Get ready with a wallet native check
Tessio proves someone is over 18 from their EU Digital Identity Wallet and stores no personal data. Access is invite only while we onboard design partners. Tell us what you're building.