UK regulation
UK Online Safety Act age assurance
The Online Safety Act makes many services use highly effective age assurance to keep children away from adult content. This page covers what that means, the dates that matter and the limit of a wallet based over 18 check: member states issue the credentials, so a user outside the EU will generally hold none.
At a glance
- Law
- Online Safety Act 2023
- Regulator
- Ofcom
- Own pornographic content (Part 5)
- Age assurance duty in force 17 January 2025
- Children's codes (Part 3)
- Enforced from 25 July 2025, risk assessments due 24 July 2025
- Standard
- Highly effective age assurance: technically accurate, robust, reliable and fair
- Penalties
- Up to 18 million pounds or 10% of qualifying worldwide revenue, whichever is greater
What the Act requires
The Online Safety Act puts duties on online services to protect people, children in particular. Two parts matter most for age checks. Part 5 covers services that publish their own pornographic content, and its highly effective age assurance duty came into force on 17 January 2025. Part 3 covers user-to-user and search services that are likely to be accessed by children, and Ofcom began enforcing its Protection of Children Codes from 25 July 2025, with children's access assessments due by 16 April 2025 and children's risk assessments by 24 July 2025.
The aim is to stop children encountering the most harmful material, which the Act calls primary priority content. That includes pornography as well as content encouraging suicide, self harm or eating disorders. Where a service carries that content, it has to use age assurance to keep under 18s away from it.
What counts as highly effective
Ofcom does not accept a tickbox. Its guidance says highly effective age assurance has to be technically accurate, robust, reliable and fair. It also says self declaration of age does not clear that bar.
Ofcom does list methods that can be highly effective when they are implemented well. Those include photo ID matching, facial age estimation, open banking, mobile network operator age checks, credit card checks and, importantly here, digital identity services and wallets. You still have to show your chosen method meets the four criteria in practice.
How a wallet check fits
A wallet based check asks the user to prove one fact, that they are over 18, from a credential their EU Digital Identity Wallet or EU age verification app already holds. Ofcom lists digital identity services and wallets among the methods that can be highly effective, so for users who hold such a credential it is a recognised route rather than a workaround. A wallet check works only for someone who has an EU wallet credential, so under the UK Act you need another method for UK users without one.
For users the difference is privacy. With a wallet proof nobody uploads an ID: the user confirms they're over 18 and nothing else, and with Tessio no document or date of birth is stored on your systems or ours.
Where Tessio fits
For users who have the EU age verification app, Tessio checks a cryptographic over 18 proof from it and gives you a signed result to keep as evidence. There is no ID upload for the user and no document or date of birth stored.
You are still responsible for meeting Ofcom's highly effective criteria for your service. We do not provide a document or selfie fallback, so a wallet check is one method in your mix today rather than the whole answer. You will still need coverage for users without a wallet credential. We're happy to walk through how it sits in your setup.
Frequently asked
Does the Online Safety Act require age verification?
It requires highly effective age assurance, which can be met through age verification, age estimation or both. Ofcom judges a method on whether it is technically accurate, robust, reliable and fair, not on the label. A wallet based over 18 proof is one recognised way to get there for users who hold an EU wallet.
Who has to comply and when?
Services that publish their own pornographic content came under the Part 5 duty on 17 January 2025. User-to-user and search services likely to be accessed by children came under enforcement of the Protection of Children Codes from 25 July 2025. Ofcom is the regulator and can levy large fines.
Is a digital identity wallet an accepted method?
Ofcom lists digital identity services and wallets among the methods that can be highly effective. You still have to show your implementation meets the four criteria, but a wallet check is a recognised route, not a grey area.
Primary sources
- Ofcom: guidance on highly effective age assurance
- Ofcom: age checks to protect children online
- Online Safety Act 2023 (legislation.gov.uk)
This is a plain language summary, not legal advice. Check your own duties against the primary sources and your regulator.
Put it into practice
Age verification for adult platforms
Adult content
Age verification for social and UGC platforms
Social and user content
Age verification for dating apps
Dating and matchmaking
EU Digital Services Act and age assurance
EU regulation
The EU Digital Identity Wallet, for relying parties
EU Digital Identity
Tessio for compliance
For compliance, legal and DPOs
Age verification API
Check age without collecting documents
Tessio checks age with the EU age verification app today and stores no documents or dates of birth. Signup is open and a test project works as soon as you create one. Tell us what you're building.