The Investigation, Precisely Stated
On July 16, 2026, Ofcom opened a formal investigation into TikTok Information Technologies UK Limited over its compliance with Section 12 of the Online Safety Act 2023 — the duty to run "proportionate systems and processes" that prevent children from encountering primary priority content, using age checks that are "highly effective at correctly determining whether or not a particular user is a child" (legislation.gov.uk, Online Safety Act 2023 s.12). Those duties have been in force since July 25, 2025. Ofcom's stated concern is narrow and specific: TikTok's age-inference model — which estimates age from behavioral signals like watch history and interactions rather than checking a document or biometric — "may have failed to correctly identify a significant proportion of children, putting them at risk of exposure to harmful content" (Ofcom investigation notice). Evidence-gathering will run at least three months, with a status update due in October 2026. If Ofcom finds a breach, penalties can reach £18 million or 10% of TikTok's qualifying global revenue, whichever is greater — and in serious cases Ofcom can seek court orders compelling payment providers or ISPs to disrupt UK access to the service.
The Case for Ofcom's Position
Before arguing against the intervention, the regulator's logic deserves to be stated on its own terms, because it is not frivolous. Age inference is a probabilistic classifier, not a verification method: it infers a likely age band from engagement patterns, and any classifier of that kind has a false-negative rate — some real children will be scored as adults and served content the law says they shouldn't see. Ofcom's own guidance on "highly effective age assurance," finalized April 24, 2025, lists seven methods it considers capable of meeting the bar — including open banking checks, photo-ID matching, facial age estimation, mobile network operator checks, credit card checks, digital identity services, and email-based estimation — and pointedly does not include behavioral age inference among them (Ofcom, Guidance on Highly Effective Age Assurance). A platform the size of TikTok, with primary priority content on the other side of the error rate — material related to suicide, self-harm, and pornography — is exactly the case Parliament had in mind when it wrote a strict-liability-adjacent duty rather than a best-efforts one. If a company chooses a method that isn't on the approved list and that method underperforms, an investigation is the predictable, correctly-targeted consequence, not regulatory overreach.
Where the Proportionality Argument Bites
The steelman holds up to a point, and then runs into a harder question: what should replace behavioral inference, and at what cost to the users who aren't the intended target of the duty? Ofcom's approved alternatives — photo-ID matching, facial age estimation, digital identity checks — all require adults to hand over identity documents or biometric data to use an ordinary social app, or to submit a live facial scan to a third-party verification vendor. That is a real privacy and data-security cost imposed on the entire adult user base to catch a "significant proportion" of children Ofcom has not yet quantified publicly. The Open Rights Group has argued in prior Online Safety Act consultations that mandatory identity-linked age checks create honeypots of sensitive data and push privacy-conscious users toward VPNs and unregulated alternatives — undermining the safety goal even as it satisfies the letter of the duty. Ofcom's own framing implicitly concedes the tradeoff by refusing to prescribe a single technology and instead setting an outcomes-based bar; the problem is that in practice, only identity- or biometric-based methods currently clear it, which narrows "proportionate systems and processes" to a fairly blunt set of options.
What TikTok Actually Did, and Didn't, Get Wrong
TikTok's defense — that its "age inference technologies" are "strictly enforced" and "in line with major industry peers" — is true and also not the relevant test. Meta, Snap, and others rely on similar behavioral inference layered under self-declaration, which is precisely why Ofcom's investigation matters beyond TikTok: it is a test case for whether an entire category of age-assurance technology, in use across the industry, can satisfy a statute that was drafted with named alternatives in mind. That is a legitimate regulatory question to litigate through an actual investigation rather than settle by press release. What would overreach look like from here: treating an unresolved evidentiary question — Ofcom has not yet published the error rate it's relying on — as a foregone conclusion, or moving straight to the £18 million/10%-of-revenue tier without giving TikTok the three-month window Ofcom itself has set aside to establish the facts.
The Standard We'd Set
Ofcom is right to test whether age inference, as currently deployed, meets a statutory bar Parliament wrote in specific and demanding terms. It should also be transparent, when it publishes its October update, about the actual false-negative rate driving the case — a number that would let outside observers judge proportionality rather than take the regulator's characterization on faith. A regime that eventually forces every major platform toward document- or biometric-based verification for an entire national user base deserves that scrutiny before, not after, the fines start.