A formal probe, not yet a finding
On July 16, 2026, Ofcom opened a formal investigation into TikTok Information Technologies UK Limited under section 12 of the Online Safety Act 2023 — the provision requiring user-to-user services to run proportionate systems, including "highly effective" age assurance, to keep children away from primary priority content such as pornography, self-harm material, and extreme violence. Ofcom says TikTok's age-inference model, which estimates a user's age from behavioral signals rather than verifying it directly, "may have failed to correctly identify a significant proportion of children, putting them at risk of exposure to harmful content." The regulator is careful to note that opening a case "does not mean that Ofcom has reached any conclusion about whether the provider has breached its duties" (Ofcom). Evidence-gathering will run at least three months, with an update to Parliament due in October 2026 under case reference CW/01352/07/26.
The exposure is real. If Ofcom finds a breach, TikTok faces a fine of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater, plus — in the most serious cases — court orders that can force UK access restrictions (Ofcom).
The gap Ofcom flagged months ago
What makes this investigation notable is that it targets a compliance approach Ofcom had already signaled was inadequate. In its Report on the Use of Age Assurance, published July 15, 2026 — one day before the investigation opened — Ofcom states it has "ruled out age inference as highly effective age assurance," in part because inference can only operate after a child has already signed up and used a service long enough to generate the behavioral signal the model relies on, which means by definition after exposure may have already occurred (Ofcom). Inference remains the most common method platforms lean on regardless, because it requires no friction at signup — no ID upload, no biometric estimate, no age gate a curious teenager has to route around.
Steelmanning the regulator
Ofcom's position deserves a fair hearing before dismissal. Age-inference models are trained to spot patterns, not identities, and a "significant proportion" of misclassified children is not a rounding error when the content on the other side of the wall includes pornography and self-harm material — exactly the primary priority categories the Online Safety Act was built to keep from minors. Ofcom has already shown it will follow through on enforcement: in February 2026 it fined 8579 LLC £1.35 million, its largest Online Safety Act penalty to date, over age-assurance failures on adult platforms including justpornflix.com (Inforrm). A regulator that lets the largest platforms rely on a method it has already ruled out — while fining smaller adult sites over the same underlying gap — invites the charge that enforcement scales with a company's ability to fight back, not with the size of the harm.
Where the balance tips
Proportionality cuts both ways, though, and that is where this investigation should draw scrutiny rather than applause. TikTok is not a pornography site dodging age gates outright — it is a mainstream platform that has deployed some form of age assurance and disputes Ofcom's framing, telling reporters it has invested "billions in platform safety" over eight years in the UK and is "confident" it meets its Online Safety Act obligations (The Record). Treating "not on Ofcom's highly-effective list" as functionally equivalent to reckless non-compliance collapses a real spectrum — imperfect-but-improving age assurance versus none at all — into a binary that only rewards companies willing to impose the most intrusive verification (ID upload, biometric scanning) regardless of the friction that creates. Push too hard in that direction and the practical effect is teenagers migrating to less-regulated, offshore platforms rather than being kept safer on ones a UK regulator can actually reach.
What should happen next
The right outcome is not for Ofcom to abandon the case. A significant proportion of misclassified children, if substantiated, is a genuine harm, and the investigation's evidentiary phase exists precisely to test that claim rather than assume it. But Ofcom should use its October 2026 Parliamentary update to publish the actual misclassification data behind "significant proportion," not just the legal theory, and to clarify how it will treat platforms transitioning in good faith toward harder verification versus platforms making no effort at all. A multibillion-pound fine against a company actively engaging with the regulator, over a method Ofcom had flagged as inadequate but never formally banned outright for user-to-user services, would set a precedent that any imperfect compliance effort gets punished as severely as none — the kind of blunt enforcement that undermines the very proportionality principle the Online Safety Act claims to be built on.