Is UK Age Verification Safe? What Happens to Your ID and Face Scan

Is UK age verification safe?

It can be, but it depends entirely on how the check is done. Age verification is now legally required for adult content in the UK, and the safest methods never store your ID or send your identity to the website. The risky ones create a database of ID documents that can be breached.

Age checks became mandatory under the Online Safety Act, enforced by Ofcom, with a deadline of 25 July 2025 for services hosting adult content. The law requires highly effective age assurance, which rules out just ticking a box. But the law sets the goal, not a single method, so the privacy varies a lot between providers.

How does age verification actually work?

The site sends you to a third-party provider that checks your age using one of several methods, then tells the site only whether you passed.

• -Photo ID matching: you upload a passport or driving licence
• -Facial age estimation: a camera estimates your age from your face
• -Open banking or mobile network checks: your bank or phone provider confirms you are an adult
• -Credit card or digital ID checks

Ofcom accepts a range of these methods as long as they are accurate and hard to fool. The provider is a separate company from the website, which is both the privacy protection and the privacy risk.

What is the real risk?

The risk is that a verification provider stores your ID or face scan and becomes a honeypot: a single database of identity documents that is valuable to attackers and damaging if breached.

Security professionals have warned about exactly this, and about age checks turning into a form of digital ID by the back door. The concern is not the one-off check; it is what happens to your data afterwards. If a provider keeps your uploaded passport, that is a target. Deleting your account on the website does not necessarily wipe what the verifier holds.

What do the regulators require?

Age checks still have to obey data protection law. The ICO and Ofcom say providers must minimize the data they collect, be transparent, and run data protection impact assessments.

In a joint statement in March 2026, Ofcom and the ICO stressed that every age-assurance method processes personal data and is only lawful where it is necessary, proportionate, and compliant with UK GDPR. The ICO has warned that age verification should not become digital ID by the back door and points people to its Age Check Certification Scheme for providers that meet the standard.

How to tell a safe check from a risky one

• -It processes on your device where possible, especially for facial age estimation
• -It deletes your ID document immediately after checking, rather than storing it
• -It passes only the result to the website, over 18 or not, never your identity
• -It is certified, for example under the ICO Age Check Certification Scheme

A well-designed check confirms your age and forgets you. If a service wants to keep your passport on file to prove your age, that is the pattern to be wary of.

What you can do

You cannot avoid age checks on services that legally require them, but you can favor privacy-preserving methods and know your rights over the data.

Where you get a choice of method, an on-device facial estimate or a bank or mobile check usually exposes less than uploading a passport to a site you do not know. And whatever method you use, you keep your UK data rights: you can ask a verification provider what it holds and request deletion. If you are weighing this up for your family alongside the incoming rules for teenagers, see the UK under-16 social media ban explained.