Age verification checks: what are they and is your data safe?

Under the new Online Safety Act regulations, websites hosting content which could be harmful to those under 18 must now carry out robust age verification checks.

This has led to a spike in internet users downloading virtual private networks (VPNs) to bypass checks and reports of scam websites offering services to dodge the new checks too, as internet users have expressed concern over data sharing.

Before you look for ways to avoid age verification checks, Which? is warning that you should consider the risks involved first.

Below, we explain the age verification checks, what it means for your data and what risks you should be aware of. 

Why are there age verification checks?

Age verification has been introduced for some of the biggest online platforms - such as Facebook, Instagram or YouTube - to help ensure that potentially harmful content is hidden from those under 18. 

The basis for the checks is to prevent harmful content, which includes content promoting suicide or self-harm and pornography, from being easily accessible to children. 

Under the Online Safety Act, the regulator, Ofcom, has outlined age verification methods that it considers highly effective. These include:

• Open banking - this verifies your age by accessing your banking information.
• Photo identification - this compares a photo of your with submitted identification, such as a passport.
• A picture or video of your face - this uses AI to analyse your age based on a photo of your face.
• Mobile network operator age checks - verification services will confirm whether or not your mobile phone number has age filters applied to it.
• Credit card checks - you must be over 18 to obtain a credit card, so a payment processor checks if the card is valid to check your age.
• Digital identity services - such as digital identity wallets, which store information proving your age.
• Email-based age estimation - online services where you use your email address, such as banking or utility providers, are analysed to estimate your age.

Platforms have been preparing for these new checks for some time. The social media platform Reddit, for example, is using age verification technology and will require users to upload a government-issued ID. Telegram will be using facial scans to confirm age, and Bluesky will be offering a range of age verification details, including credit card or facial scanning.

Should I hand my data over and is it safe?

If you choose not to hand over your data, you should expect to find that content that would be considered inappropriate for an under-18, such as pornography, will not be accessible to you. On a social media platform, you may find that some age-restricted content will be hidden from view.

Concerns have been raised about handing over data and what this means for user privacy. 

In the UK, any company offering services to UK-based consumers must comply with the UK General Data Protection Regulation (UK GDPR). It applies to companies in the UK and those operating outside of the UK that offer goods and services to UK customers. 

With a website's terms and conditions, it should clearly outline how your data will be stored and used. It's always worthwhile to read through the terms and conditions of any company you are sharing data with to ensure they have robust measures in place to protect your data. 

The Information Commissioner's Office (ICO) is responsible for the application of UK GDPR. The ICO should be ready to take action against any platform found to be incorrectly gathering, handling and storing data.

The website you are sharing your data with should have clear information on what data it is gathering, how it is using and storing that data. 

What is a Virtual Private Network?

A VPN is a downloadable tool that allows users to disguise their location to the websites they visit. 

However, VPNs can carry privacy risks when it comes to your personal data.

VPNs disguise your IP address, which is the geographical location you are accessing your device from. However, in exchange for this service, it may be tracking your data and selling it to third parties. 

It’s important to note that many free online services operate this way, though reading privacy policies will help you understand who your data is being shared with.

• Read more: what is a VPN?

What about scams?

Sign up for scam alerts

Our emails will alert you to scams doing the rounds, and provide practical advice to keep you one step ahead of fraudsters.

Sign up for scam alerts

Scammers are always on the lookout to capitalise on big news events, and this is no exception. Be especially wary of services claiming to offer a means of bypassing checks, as the chances are that you're handing your data over to a scammer. 

Your data is like gold dust to a scammer, and with plenty of large-scale data breaches, it’s reasonable to worry about the link between sharing personal information and receiving a scam attempt.

In particular, spear-phishing scams, typically see personal data gathered about you by a fraudster to make scams more convincing.

Identity theft is also a potential risk. This is when a fraudster has managed to obtain your data, which can be done via a data breach or a phishing message, and identity fraud is when this data is used to commit crimes such as opening bank accounts or ordering goods in your name.

Minimise your scam risk by considering who you share your data with and how much data you share. If you choose not to carry out age verification checks, then you should not be able to access 'legal' content that is considered inappropriate to under-18s.