United Kingdom: Office of Communications and Information Commissioner's Office adopted joint statement on age assurance

On 25 March 2026, the Office of Communications (Ofcom) and the Information Commissioner's Office (ICO) published a joint statement providing regulatory clarity on age assurance obligations under the Online Safety Act (OSA) and Data Use and Access Act (DUAA). The guidance applies to services likely to be accessed by children and aims to protect minors from harmful content and data harms through a risk-based, technology-neutral approach. Under the OSA, user-to-user services hosting primary priority content or pornographic material must implement highly effective age assurance (HEAA) to prevent children from encountering such material. Ofcom identifies methods such as facial age estimation and digital identity as capable of being highly effective, while self-declaration and certain online payment methods are excluded. Regarding data protection, the statement clarifies that services must have a lawful basis for processing personal data for age assurance. If a service sets a minimum age, such as 13, it must use effective age gates to prevent access by underage users and avoid unlawful data processing. The regulators emphasise that age assurance processes must adhere to UK GDPR principles, including data minimisation and purpose limitation. Providers are expected to mitigate circumvention risks and provide transparent privacy notices. The statement includes practical examples for pornography services and social media platforms to illustrate how to meet both online safety and data protection requirements simultaneously.