Following consultation, Ofcom has published its new industry guidance which sets out how it expects sites and apps to introduce "highly effective" age assurance under the Online Safety Act 2023. While the guidance is focused on restricting access to pornographic content, it is relevant to any business wanting to implement online age-gating effectively.

In summary, Ofcom's final position on age assurance: 

• confirms that any age-checking methods deployed by services must be technically accurate, robust, reliable and fair to be considered highly effective;
• sets out a non-exhaustive list of methods that we consider are capable of being highly effective. They include: open banking, photo ID matching, facial age estimation, mobile network operator age checks, credit card checks, digital identity services and email-based age estimation;
• confirms that methods including self-declaration of age and online payments which don't require a person to be 18 are not highly effective;
• stipulates that pornographic content must not be visible to users before, or during, the process of completing an age check. Nor should services host or permit content that directs or encourages users to attempt to circumvent an age assurance process; and
• sets expectations that sites and apps consider the interests of all users when implementing age assurance – providing strong protection to children, while taking care that privacy rights are respected and adults can still access legal pornography.

Ofcom considers that this approach will secure the best outcomes for the protection of children online in the initial period of the Act being in force. Ofcom has decided not to introduce numerical thresholds for highly effective age assurance at this stage (eg 99% accuracy).  However, it acknowledges that numerical thresholds may be relevant in the future, depending on further developments in testing methodologies, industry standards, and independent research.

Ofcom expects all services to take a proactive approach to compliance and meeting their respective implementation deadlines. It is opening an age assurance enforcement programme, focusing its attention first on services that display or publish their own pornographic content. It will be contacting a range of adult services to advise them of their new obligations and says that it will not hesitate to take action and launch investigations against services that do not engage or ultimately comply.

All services which allow pornography must have highly effective age-checks in place by July 2025 to protect children from accessing it. This is the case whether a service publishes its own pornographic content or allows user-generated pornographic content.

Many platforms will already have age assurance measures in place under the ICO's Children's Code, the guidance for which now refers to the requirements of the OSA, but will need to carry out the necessary risk assessments under the OSA as well as ensuring that their age assurance measures are robust.

Ofcom has been criticised for taking too cautious an approach to implementation of the OSA, so it may be trying to change this perception with this guidance.