What’s that coming over the hill? – Ofcom’s Heavy Fines for Age Assurance Failures

Ofcom has stepped up the pressure, firstly, by issuing two new sets of fines, with one reaching up to £1,050,000 for failure to implement highly effective age verification and failure to respond to statutory notices.

Alongside these new fines, 20 new sites are now being investigated by Ofcom, bringing the total number of sites under investigation to 76. With the potential of significant penalties, services now face a clear message: do not ignore Ofcom and the Online Safety Act, or you will face the consequences. 

The requirement

All regulated services under the OSA that host or disseminate primary priority content (i.e. adult content providers or any services that have suicide, self-harm, or eating disorder content on their platform), must have ‘highly effective’ age assurance. 

The OSA is extra-territorial, this means it applies to any digital platform regardless of where they are based around the globe. 

For more details on age assurance, see our previous article here.

What ‘highly effective’ means in practice 

The OSA adopts a principled framework for what is ‘highly effective’ age assurance. Systems must be technically accurate, robust, reliable, and fair. That means it is more than a superficial age gate.

This principled approach has also allowed innovation in this area, compared to other jurisdictions like France which mandates platforms to use third-party age verification providers rather than in-house solutions. 

What works and what doesn’t

Whilst the requirements are not prescriptive, highly effective age assurance recognised in Ofcom’s guidance include: 

• open‑banking age checks that return an 18+ “yes/no” without sharing a date of birth; credit‑card checks;
• mobile‑network operator content‑restriction status as a proxy for being 18+;
• photo‑ID document matching combined with selfie capture, liveness detection, and document‑fraud checks;
• facial age estimation used with an appropriate “challenge age” and a secondary verification step for borderline results; and
• reusable digital identity/attribute wallets or age tokens that let users prove 18+ across multiple services.

Ofcom also specifically outlines self-declaration, payment cards or terms and conditions declarations as not being ‘highly effective’.

Escalating enforcement 

Ofcom is taking no prisoners as the frequency and amount of the fines escalate. Penalties can reach £18 million or 10% of global revenues as well as service disruption measures such as blocking UK access or service providers. 

So far, 3 sets of fines totalling £125,000 have been issued for failure to respond to Ofcom’s information requests, being i) £20,000 to 4chan; ii) £55,000 to Itai Tech Ltd; and iii) £50,000 to AVS Group Ltd. 

An additional £1,000,000 fine was issued to AVS Group Ltd for failure to implement ‘highly effective’ age assurance. However, with the increased scope of investigation in the number of services and expanded investigation into the number of breaches for existing platforms under investigation, more fines are likely to follow. 

The amount of the financial penalty depends on a number of factors, such as harm to children, seriousness and persistence of breaches, co-operation with Ofcom, remediation, and deterrence. 

Communication is key

Open, timely communication with Ofcom is critical. In Ofcom’s investigation of Score Internet Group LLC concerning compliance with highly effective age assurance, the investigation was subsequently closed without penalties as Score Internet Group had taken steps to implement highly effective age assurance in response to Ofcom’s investigation, despite missing the deadline for Part 5 providers to implement age assurance by January 2025. 

Although Ofcom has made it clear it will continue to monitor and can revisit the investigation if issues re‑emerge, the quick response from this provider demonstrates the potential for leniency from Ofcom when communication is prioritised. 

Co-operation with Ofcom is also important to mitigate the impact of the financial penalty, just as we have learned from the details of the first confirmation decision issued by Ofcom relating to 4chan’s £20,000 fine. 

The Bottom Line

Platforms must implement age checks that are accurate, robust, reliable, and fair—at the point of entry—using methods that Ofcom recognises as highly effective. Platforms should also: 

• Document performance and be ready to show the work done using evidence and data.
• Keep clear records and a user‑facing summary of the chosen approach.
• Embed privacy by design to ensure all aspects of digital platform regulations are considered.