Online Age Verification Laws: What’s Changing and Why

For most of the internet's history, a website asking your age meant a box you could tick. That is changing. Online age verification laws in the UK, Australia, the United States and India now require many services to find out, with some confidence, whether a user is a child. The rules differ sharply from country to country, and so do the arguments about them. This explainer sets out what each law requires, as of October 2026, how age checks work in practice, and what is still unsettled.

Why age checks are spreading

The common thread is a shift in who carries the burden. Older rules mostly told children and parents what not to do. The new laws put the duty on platforms to know, or at least estimate, how old their users are, and to change what those users can see. Supporters argue that children routinely see pornography, self-harm content and aggressive recommendation feeds that the platforms could filter if they knew a user's age. Critics argue that checking everyone's age means collecting sensitive data from adults as well as children, and can block lawful speech.

Both sides are discussed below, but the laws themselves come first.

United Kingdom: the Online Safety Act 2023

The Online Safety Act 2023 gives Ofcom, the communications regulator, powers over user-to-user services (such as social media) and search services. According to the government's Online Safety Act explainer, the most harmful category for children, "primary priority content", covers pornography and content that encourages, promotes or gives instructions for self-harm, eating disorders or suicide.

The timeline

• 16 January 2025: Ofcom published its age assurance guidance. On 17 January 2025 the duty on sites that publish their own pornography to check ages (section 81) came into force, according to the government explainer.
• 16 April 2025: deadline for services to complete a children's access assessment.
• 24 April 2025: the Protection of Children Codes were laid in Parliament.
• 25 July 2025: the children's safety duties took effect. Ofcom's announcement of 24 July 2025 said sites and apps that allow harmful content must use highly effective age checks to keep children away from pornography and from self-harm, suicide and eating disorder content.

Ofcom said at that point that Bluesky, Discord, Grindr, Reddit and X had committed to age checks, as had major adult providers. The children's codes also go beyond age checks: they require recommendation algorithms to filter the most harmful material out of children's feeds, and cover bullying, dangerous challenges and violent or hateful content.

What counts as "highly effective"

Ofcom's January 2025 statement on age assurance sets four criteria: a method must be technically accurate, robust, reliable and fair. Ofcom deliberately did not prescribe a single technology. Its non-exhaustive list of methods it considers capable of being highly effective includes:

• open banking (confirming age from a bank's records, with the user's permission)
• photo-ID matching (a selfie compared with an uploaded ID document)
• facial age estimation
• mobile network operator age checks
• credit card checks
• digital identity services
• email-based age estimation

Ofcom stated that self-declaration of age, and online payments that do not require the payer to be 18, are not highly effective. It also said harmful content must not be visible before or during the check. Where a service uses age estimation, Ofcom recommends a "challenge age": users estimated to be close to the threshold are asked for a stronger check. Ofcom did not set a fixed figure, saying the challenge age should be higher where a method is less accurate.

Enforcement

The government explainer states that companies can be fined up to £18 million or 10% of qualifying worldwide revenue, whichever is greater. In the most serious cases, and with a court's agreement, Ofcom can require payment providers, advertisers and internet service providers to stop working with a site. Senior managers can face criminal liability for failing to comply with certain information requests and enforcement notices.

Ofcom's first penalties have been against adult sites. On 23 February 2026, for example, it fined 8579 LLC £1.35 million for not having age checks in place, plus £50,000 for failing to answer an information request, with a daily penalty of £1,000 until it complied. Ofcom said it had opened investigations into providers of dozens of adult sites within days of the July 2025 deadline.

Australia: a minimum age of 16 for social media

Australia took a different route. Instead of filtering content by age, it set a minimum age for holding an account at all. The Online Safety Amendment (Social Media Minimum Age) Act 2024 amended the Online Safety Act 2021. Its key provisions, from the text of the Act:

The Act left the start date to the minister, within 12 months. The duty took effect on 10 December 2025. On 16 January 2026, the Prime Minister and Communications Minister announced that more than 4.7 million under-16 accounts had been deactivated, removed or restricted within days of the law taking effect. The release described these as preliminary figures, and the ministers acknowledged there was more work to do.

Compliance has since become the focus. Reporting on eSafety's March 2026 compliance update by Mediaweek said the regulator had opened investigations into Facebook, Instagram, Snapchat, TikTok and YouTube. Its concerns included platforms prompting users who had said they were under 16 to attempt an age check, allowing repeated attempts at the same check, relying heavily on self-declared ages at sign-up, and making it hard for parents to report under-age accounts. The same report put the maximum civil penalty at AUD 49.5 million and said enforcement decisions were expected by mid-2026.

United States: courts are shaping the map

There is no federal age verification law in the US. Instead, states have passed their own, and many have been challenged under the First Amendment. Two broad types matter: laws aimed at adult content, and laws aimed at minors' use of social media and apps.

Adult sites: Free Speech Coalition v. Paxton

Texas's HB 1181, passed in 2023, requires commercial websites where more than one-third of the content is sexual material harmful to minors to verify that visitors are 18 or over. On 27 June 2025, the US Supreme Court upheld the law by six votes to three. Justice Thomas wrote for the majority, and Justice Kagan wrote the dissent.

The Court held that the law only incidentally burdens adults' protected speech, so it is judged under intermediate scrutiny rather than the stricter test critics had argued for, and that it passes that test. The opinion notes the law allows verification through government-issued ID or transactional data, and that violations can draw civil penalties of up to $10,000 a day, plus up to $250,000 if a minor accesses covered material. The ruling gives other states a clearer legal footing for similar adult-content laws.

Social media and app stores

Laws restricting minors' social media use rest on weaker legal ground. In August 2025, the Supreme Court declined to lift a lower court's stay that had let Mississippi enforce its law while the case continued (NetChoice v. Fitch, 14 August 2025). But Justice Kavanaugh, concurring, wrote that the Mississippi law was "likely unconstitutional" under current precedent. He listed federal district courts that had enjoined similar laws in Ohio, Texas, Utah, California, Arkansas, Florida and Georgia. The trade group NetChoice, which brought many of these cases, tracks them on its litigation page.

A newer approach moves the check to the app store. Texas's SB 2420, the App Store Accountability Act, was signed on 27 May 2025 with an effective date of 1 January 2026. As written, it requires app stores to verify each Texas user's age category (under 13, 13 to 15, 16 to 17, or adult), link minors' accounts to a parent, and get parental consent for each download or purchase. Developers must assign age ratings and use the store's age signal. Violations are treated as deceptive trade practices under Texas law.

States continue to legislate. According to the Electronic Frontier Foundation, California's governor signed AB 1709, which EFF describes as a ban on social media use for people under 16, on 10 September 2026, despite EFF's opposition.

India: parental consent under the DPDP Act

India's approach is built into its data protection law rather than a content law. The Digital Personal Data Protection Act 2023, which received assent on 11 August 2023, defines a child as anyone who has not completed 18 years. Section 9 says a Data Fiduciary (the company deciding how data is used):

• must obtain verifiable consent of the parent or lawful guardian before processing a child's personal data
• must not process data in a way likely to harm a child's well-being
• must not track, behaviourally monitor or target advertising at children

The government can exempt certain classes of companies or purposes, and can lower the age for a company whose processing is "verifiably safe". The government's PIB backgrounder on the Rules states that breaching the obligations relating to children can attract a penalty of up to ₹200 crore.

How the 2025 Rules make it work

The Digital Personal Data Protection Rules 2025 were published in the Gazette on 13 November 2025 (G.S.R. 846(E)); PIB's backgrounder gives the notification date as 14 November. Rule 10 sets out the parental consent check. A company must use due diligence to confirm that the person claiming to be the parent is an identifiable adult, using either:

• reliable identity and age details it already holds (for example, if the parent is already a registered user), or
• identity and age details provided voluntarily by the parent, directly or through a "virtual token" issued by an authorised entity, which includes details verified through a Digital Locker service provider such as DigiLocker.

The Fourth Schedule exempts certain cases from the parental consent and tracking rules, subject to conditions. These include hospitals and health professionals providing care, schools tracking pupils for education or safety, crèches and school transport tracking children's location for safety, creating an email-only account, and processing needed to confirm that a user is not a child.

Timing matters. Under Rule 1, the children's consent rule (Rule 10) and the exemptions (Rule 12) come into force 18 months after publication. A timeline from Acuity Law puts that at 12 May 2027. Until then, as of October 2026, these specific duties are not yet enforceable. For a broader look at how new privacy laws affect everyday users, see our consumer guide to the new digital privacy acts.

Comparing the four approaches

How age assurance works, and the trade-offs

"Age assurance" is the umbrella term. Ofcom's guidance distinguishes age verification, which checks age against a trusted record, from age estimation, which infers an age range. The main methods in use:

• Self-declaration. Typing a birth date or ticking a box. Cheap and private, but easy to lie about. Ofcom says it is not highly effective, and eSafety's concerns about reliance on self-declared ages point the same way.
• ID document checks. Uploading a passport or licence, often with a selfie match. Strong evidence of age, but it collects sensitive data and excludes people without ID. Australia restricts platforms from making it the only option.
• Facial age estimation. Software estimates age from a selfie. It avoids collecting a name, but all estimation carries a margin of error, which is why Ofcom recommends a challenge age.
• Credit card, bank and mobile operator checks. These rely on the fact that a bank or mobile network has already checked the customer's age. They work only for people who have such accounts.
• Digital ID and tokens. A trusted provider confirms "over 18" or "is an adult" without passing on other details. India's Rules explicitly allow tokens, including via DigiLocker.

No method is accurate, private, cheap and universally available all at once. Each law chooses which of those to give up.

What critics and regulators say

The views below are the stated positions of the organisations named, not findings of fact.

• Electronic Frontier Foundation (US civil liberties group): EFF opposes age verification mandates, arguing that every method requires sensitive personal data, links offline identity to online activity, creates targets for data breaches, undermines anonymity and can block lawful speech for adults and young people. It argues comprehensive privacy laws would protect young people better.
• Ofcom (UK regulator): Ofcom says services must protect children while "taking care that privacy rights are respected", and frames its approach as flexible and technology-neutral.
• The UK Information Commissioner's Office: as cited in Ofcom's January 2025 statement, the ICO's Opinion on age assurance says that, used correctly, layered "waterfall" techniques (starting with a lighter check and escalating only when needed) can offer high confidence while respecting privacy.
• US Supreme Court justices: three justices dissented in the Texas case, and Justice Kavanaugh's August 2025 concurrence in the Mississippi case signalled that he sees social media restrictions as facing a harder test than adult-content laws.

What remains uncertain

This section is analysis, not settled fact.

• Effectiveness. Account removal figures show activity, not outcomes. Whether children are safer, or simply move to services outside the rules or use VPNs, will take independent evaluation. Australia's own Act requires a review within two years.
• Enforcement against large platforms. As of October 2026, the UK's published fines have been against adult sites, and Australia's investigations into five major platforms had not been reported as concluded in the sources reviewed for this article.
• US litigation. The Supreme Court has settled the standard for adult-content laws but not for social media or app store laws. More appeals are likely.
• India's implementation. How companies will verify that a person is a child's parent at scale, and how the Data Protection Board will enforce it, will only become clear after May 2027.
• Privacy of the checks themselves. All four jurisdictions rely partly on third-party age assurance providers. How well their data handling is audited is an open question.

The bottom line

Age checks are moving from optional to mandatory, but countries are using them for different purposes: the UK to filter specific harmful content, Australia to set a minimum age for social media accounts, US states mainly to gate adult content and app downloads, and India to require parental consent for processing children's data. The methods overlap, and so do the concerns about privacy, accuracy and free expression. If you are a parent, expect more consent prompts and age checks on the services your children use. If you run an online service with users in any of these countries, check the regulator's current guidance rather than relying on summaries, because deadlines and court rulings are still shifting.

Frequently asked questions

Is ticking an "I am over 18" box still allowed?

For services covered by the UK's age assurance duties, no: Ofcom says self-declaration is not highly effective. In other places it depends on the law and the service, so check the relevant regulator's guidance.

Do I have to show government ID to use social media in Australia?

No. The Act bars age-restricted platforms from requiring government-issued ID or an accredited digital ID unless they also offer a reasonable alternative, such as age estimation.

When do India's parental consent rules start?

Rule 10 of the DPDP Rules 2025 comes into force 18 months after the Rules were published on 13 November 2025, which works out to around May 2027.

Did the US Supreme Court approve age checks for social media?

No. Its June 2025 ruling covered Texas's law on adult-content websites. Challenges to state social media and app store laws are being decided separately.

Sources

1. Online Safety Act: explainer, UK Government (GOV.UK), accessed 2026.
2. Age checks to protect children online, Ofcom, 2025.
3. Statement: Age Assurance and Children's Access, Ofcom, 2025.
4. Online age checks now in force, Ofcom, 2025.
5. Ofcom fines porn company £1.35 million for not having age checks, Ofcom, 2026.
6. Online Safety Amendment (Social Media Minimum Age) Act 2024, Federal Register of Legislation (Australia), 2024.
7. 4.7 million accounts deactivated, removed or restricted, Prime Minister of Australia, 2026.
8. eSafety puts five social platforms on notice, Mediaweek, 2026.
9. Free Speech Coalition, Inc. v. Paxton, No. 23-1122, Supreme Court of the United States, 2025.
10. NetChoice, LLC v. Fitch, No. 25A97, Supreme Court of the United States, 2025.
11. SB 2420 (enrolled text), Texas Legislature, 2025.
12. SB 2420 bill history, Texas Legislature Online, 2025.
13. Litigation, NetChoice, accessed 2026.
14. Age Verification, Electronic Frontier Foundation, accessed 2026.
15. The Digital Personal Data Protection Act, 2023, Ministry of Electronics and Information Technology, 2023.
16. Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), Ministry of Electronics and Information Technology, 2025.
17. DPDP Rules, 2025 Notified, Press Information Bureau, 2025.
18. Notification of Digital Personal Data Protection Law in India: certain key timelines, Acuity Law, 2025.