UK Tells Ofcom to Nail Down Highly Effective Age Assurance by October 2026

Key Takeaways

• On June 15, 2026, Technology Secretary Liz Kendall asked Ofcom to produce proposals for "highly effective" age assurance by October 2026 to inform parliamentary debate on regulations she intends to lay before the end of the year.
• The age assurance mandate is part of a wider package that bans social media for under-16s across platforms, including TikTok, Instagram, YouTube, Snapchat, Facebook, and X, with implementation expected in spring 2027.
• Kendall's letter asks Ofcom to ensure age assurance protects data privacy and avoids excluding users who cannot verify their age via passports or driver's licenses.
• The social media ban follows the same structural logic as every previous UK online safety intervention, announcing an access restriction while leaving platform business models untouched and building surveillance infrastructure to paper over the gap.

An Earnest Ask Inside a Fundamentally Broken Package

On June 15, Liz Kendall wrote to Ofcom chair Sir Ian Cheshire and CEO Dame Melanie Dawes asking the regulator to conduct a rapid assessment of what highly effective age assurance looks like for determining whether someone is over 16. The deadline is October 2026, timed to inform parliamentary debate on regulations Kendall intends to lay before the end of the year.

The letter is, by UK online safety standards, a reasonably careful document. It asks Ofcom to ensure age assurance works for everyone, including those without passports or driver's licenses, and explicitly requires data privacy to be prioritized throughout the assessment. Asking the regulator to define the standard before the regulations land is the right sequencing.

The problem is everything the age assurance work is meant to support. Alongside the Ofcom letter, Kendall delivered a parliamentary statement announcing a ban on social media for under-16s across platforms including TikTok, Instagram, YouTube, Snapchat, Facebook, and X, modeled on Australia's approach and expected to take effect in spring 2027. And that ban has not worked anywhere it has been tried.

The Ban That Has Never Once Held as Promised

Kendall acknowledged in her statement that some children will inevitably seek to circumvent the restrictions, which is a fairly direct admission that the ban needs age assurance to enforce what the ban cannot do on its own. The social media ban pattern that has never held runs the same way every time: announce an access restriction, find it insufficient, build enforcement infrastructure to compensate, and describe the infrastructure as a support mechanism rather than the real policy.

The government's own fact sheet reveals what the "less invasive" verification tier actually looks like. Many adults won't need to do checks, it notes, because they have accounts opened over 16 years ago, a credit card connected, or email addresses age-verified in other ways. That is a system where your financial data, account tenure, and email history become the mechanism by which you establish your right to use social media without further scrutiny.

What "Highly Effective" Age Assurance Actually Builds

Every reliable method of confirming a user's age requires collecting and processing real identity signals. Facial age estimation, document-based verification, and credit-linked age signals all involve data infrastructure that persists after the check, can be breached, and will eventually be sought by actors beyond the regulator who commissioned it. Kendall's letter acknowledges this tension, which is more than most government directives on the subject manage. The acknowledgment, unfortunately, does not change what the infrastructure becomes once it exists.

This is the pattern the UK keeps building under child safety framing. Construct enforcement infrastructure, describe the privacy risks as a concern being taken seriously, and let Ofcom manage the tension. The surveillance that results is not a side effect of the policy. It is the output.

And yet, Ofcom being asked to define the standard carefully, with privacy explicitly on the brief, is better than the alternative. A government that tasks a regulator to work out what "highly effective" means before drafting the regulations is doing more than most have managed at this stage. But should something this sensitive be made based on a “rapid assessment”? That’s not really what you want to hear when talking about something that will affect your privacy that much.

Ultimately, good process on the privacy question does not change what the underlying ban produces. Getting Mysterium VPN with 78% off won't fix the logic that keeps generating surveillance infrastructure in the name of child safety, but it will protect the privacy that infrastructure keeps chipping away at. We really shouldn’t be asked to choose between the two, but we are where we are and it’s in our hands to do whatever we can now to protect ourselves.