Ofcom's statutory Use of Age Assurance Report 2026, published 15 July, is the first hard evidence of what the Online Safety Act's child-protection duties have actually produced. The numbers are genuinely striking: the share of children who encountered a "highly effective" age check when asked to verify their age rose from 25% to 43% between July 2025 and January 2026, and regulated services ran more than 69 million age checks in the second half of 2025 alone — a 23-fold jump on the prior six months, according to legal analysis from Lewis Silkin. Almost every one of the UK's ten most-visited pornography sites, and most of the top 100, now gate access behind some form of check.
The case for taking this seriously
Before picking this apart, it's worth stating the strongest version of Ofcom's position. Regulators spent years being told age verification was technically infeasible at scale; eighteen months into enforcement, tens of millions of checks are running weekly, adoption nearly doubled in two quarters, and providers who were dragging their feet — Ofcom has opened 23 investigations into 88 adult-content providers — are now facing enforcement rather than warnings. That is a real result, and a regulator that ships measurable progress against a hard problem deserves credit for it, not reflexive skepticism.
Where the report undercuts the policy it's meant to support
The trouble is what the same report says about the next, much bigger ask: age-gating an entire category of platforms for everyone under 16, a policy the government intends to implement through regulations under the Children's Wellbeing and Schools Act 2026, with rules laid before Parliament this year and restrictions taking effect in spring 2027, per Global Policy Watch's analysis. Ofcom's own report says it has "serious doubts" that the age-inference systems social media platforms currently rely on — device signals, behavioral patterns, self-declared birthdates cross-checked against activity — are fit for purpose, and it explicitly rules inference out as a basis for enforcing the ban or a minimum age at all, per the same Biometric Update summary of the report. That is the mechanism most large platforms actually use today. If it doesn't count, the sector-wide compliance rate for the specific policy Parliament is being asked to legislate around is close to zero, not 43%.
The dating-app finding makes the gap concrete: more than one in ten 15-to-17-year-olds were still using major dating apps in December 2025 despite those apps having checks in place. Checks existing and checks working are different claims, and Ofcom's data shows the industry is still closer to the former. That is precisely why the regulator is sending Parliament a rapid assessment of what a "highly effective" over-16 check would even look like by the end of October 2026 — two months before the government's own regulations are due to be laid. Legislating the target before the regulator has finished defining the technology that hits it is a sequencing problem, not a detail.
The proportionality question nobody in the timeline is answering
This is where the pro-innovation case has to be more than "deregulate." Nobody sensible disputes that platforms whose core product is algorithmic social interaction should take child safety seriously. The objection is to compressing a genuinely hard verification problem — one Ofcom's own report admits isn't solved — into a legislative deadline set for political rather than technical reasons.
Open Rights Group has documented the mechanism by which that compression bites: verification vendors like Persona have been found running background checks — reportedly screening users against 14 categories of "adverse media" from terrorism to espionage — that go well beyond confirming a birthdate, while some providers' business models depend on monetizing the biometric and behavioral data collected in the process. The EFF's guidance for UK users on what age-verification companies actually retain makes the same point from the user side: the privacy exposure scales with the number of services demanding checks, and a blanket under-16 social media rule multiplies that exposure across every platform a teenager — or an adult mistaken for one — tries to use.
None of this is an argument for abandoning age assurance. It's an argument for sequencing: let Ofcom's October assessment actually land, let it say plainly whether inference-based methods can ever qualify, and calibrate the ban's scope and enforcement timeline to what the technology can support rather than to a date fixed months before the evidence exists. A regulator publishing a report that says "we don't yet know if this can work as designed" is not the same as a regulator confirming a policy is ready to enforce, and Parliament should legislate accordingly.