Why Ofcom Objects to TikTok's Age Assurance Methods

By Audrey Hingle

Today, Ofcom opened an investigation into TikTok under section 12 of the UK's Online Safety Act. It will be the first major test of the law's "highly effective age assurance" standard against inference-based methods. TikTok's approach to age assurance is meaningfully different from many other platforms operating in the UK, which have responded to the Act by outsourcing their age assurance to third parties that primarily assess age by collecting biometric face scans or requiring users to upload government ID. TikTok has taken a different, proprietary route and instead largely relied on self-attestation and inference: estimating age from signals it already holds about its users.

In a recent Internet-Draft, Age Verification Architecture, we analyzed age-gating methods along two dimensions: efficacy and privacy. Efficacy asks whether a mechanism works: is it feasible to operate at the scale required, is it durable against circumvention, and is it accurate. Privacy asks what a mechanism costs even when it works as intended: what it discloses beyond age, to whom, and for how long. Every method carries trade-offs, and getting the balance right will be difficult for every platform that is required both to prevent users from accessing content that is inappropriate for their age, and protect the privacy of their users. TikTok has chosen a different point on that curve than most of its peers in the UK, and Ofcom's complaint is essentially that the law demands more efficacy, at a higher cost to privacy. The below essay is an example of the kind of analysis the draft's framework is designed to enable: taking a live enforcement case and locating each party's choices on the efficacy–privacy curve.

How TikTok describes its age assurance

In an October 2025 update, TikTok described its work to provide teens with age-appropriate experiences. Its policy is that children under 13 cannot create accounts. When people sign up, they are asked to provide their birthdate. This is self-attestation, which was the status quo for almost every online service until recently. Self-attestation sits at the low end of both dimensions: it costs almost nothing in exposure or retention, since no verifying party receives more than a claimed birthdate, but it is correspondingly weak on accuracy.

Once a person is through that first layer, additional technologies look for users who may have misrepresented their age. The two examples they give are a post referencing an upcoming birthday, or analysis of their profile picture. TikTok also cites new AI technologies piloted in the UK, though it isn't specific about what they are. Suspected underage accounts are escalated to specialized review teams, and TikTok says it removes around six million underage accounts globally every month.

Users aged 13 to 15 are allowed on the platform but blocked from features like direct messaging and having content appear in the For You feed. Everyone under 18 gets a default 60-minute screen time limit, no notifications after bedtime, and filtering of content not suitable for teens. To place users in the right experience, TikTok leverages technologies that predict whether someone falls within an age range, such as 13–15.

In our paper's terms, this is age estimation: inferring age from behavioral and context-specific signals, not all of which users explicitly opt in to. The behavior of a user on a platform: who they are friends with, what content they engage in, can provide clues about their age. But this data is limited to what the service already knows, and it is least accurate precisely for younger users, since there are statistically fewer ways for the platform to know its estimate is right. There are also general concerns that repurposing user data for age estimation contravenes data-protection frameworks that limit data use to specific consent structures. Estimating age from behavioral signals means repurposing user data for a purpose users never consented to, which sits uneasily with data-protection frameworks like the UK GDPR that tie data use to specific purposes.

On paper, estimation has advantages for privacy. It creates no new database of identity documents or biometrics, no centralized target for the breaches that have already exposed the identities of people online. And because it demands no documents, it doesn't exclude the people who don't have them. TikTok itself makes this point, noting that not everyone holds a passport or national ID. 

But while estimation avoids new data collection, that is only because it runs on the extensive data TikTok already gathers about every user. "No new collection" is a low bar for a platform whose recommendation and advertising systems depend on harvesting data. And TikTok may still collect more sensitive data. If a user feels the age estimation technology has wrongly excluded them from appropriate features, TikTok offers a range of appeal options which include facial age estimation performed by the third-party vendor Yoti, along with credit card data and scans of government-issued ID.

The trade-off at the heart of Ofcom's concern: accuracy is not a single number: methods trade off a false-accept rate against a false-reject rate, and are usually tunable along that curve. For example, an age-estimation system can lower its false-accept rate by requiring an estimate well clear of the threshold age, at the cost of a higher false-reject rate for people who are in fact old enough.

Why Ofcom objects to TikTok’s methods

Sections 12(4) and (6) of the Act require age assurance that is "highly effective at correctly determining whether or not a particular user is a child" to prevent children from encountering “primary priority content” which includes pornography and content encouraging suicide, self-harm, or eating disorders. Ofcom's Age Assurance report, published the same day the investigation opened, suggests that in some cases age inference models may have failed to correctly identify a significant proportion of children — the false-accept side of the trade-off.  If Ofcom ultimately decides TikTok’s features don’t count as highly effective, they may be subject to fines of up to £18 million or 10 percent of qualifying worldwide revenue, and in the most serious cases, court orders requiring payment providers or ISPs to disrupt the service in the UK. 

If TikTok’s methods are found to be sufficiently effective, it might change the privacy/efficacy balance in the UK.

All solutions are bad for privacy; it's just a question of how the costs are balanced. Our paper identifies that layered, proportionate approaches distributed across services, devices, and networks are necessary and that no single mandated high-assurance method will be sufficient. While I can't call TikTok a privacy champion; its preferred method — inference — is also the cheap, low-friction option that keeps data in-house and it repurposes user data for a purpose users never consented to. But a platform willing to try a different method is worth something, because the alternative is convergence. One provider, Yoti, already gates Instagram, Facebook, and TikTok's own appeals process. If every platform routes every user through the same few third parties, we will have built a centralized database of everyone's age, face and documents. That’s a lot of data to trust to a single intermediary. 

Introducing, Erika Owens

I'm excited to report that I'm going on holiday, and taking a three week break from IX. While I'm away, Erika Owens will be filling in. Please give her a warm welcome!

More about Erika:

Erika loves helping people problem solve and organize at the intersection of journalism, technology, and community. Previously, Erika was Co-Director at OpenNews, where she supported a thriving network and created inclusive, caring spaces for peer learning where people built connections and shared strategies on pushing for change in their organizations. She serves on the board of the Movement Alliance Project and Superbloom, and was a 2024 John S. Knight Journalism Fellow. Based in Sheffield, UK, she enjoys nonprofit journalism, people watching, and laughing heartily.

Want to appear here? Sponsor a newsletter.

This Week's Links