Prove you are forty, or you cannot read this

Sarah is thirty-nine. She wants to read an article about her town. Up comes a box: confirm you are over 18. She could tick a box. The box no longer counts. Now there is a face scan, or a photo of a passport, or a bank transfer of a pound to prove an adult made it.

For an article about a town.

She closed the tab. That is the whole story for most adults, and it is the part nobody measures.


This arrived in Britain quietly. Under the Online Safety Act, services that host adult content must now use age assurance that Ofcom judges "highly effective". Self-declaration is not. A payment method that a child could use is not. Ofcom's list of acceptable methods includes credit card checks, facial age estimation, open banking, photo ID matching, mobile network checks, digital identity services and email-based age estimation. Fines reach £18 million or 10 per cent of worldwide revenue, whichever is larger.

Nobody voted for this in particular. It came through the side door of something everyone agrees with.

## The numbers, and what they actually say

By June 2026, 64 of the 100 most popular adult sites in Britain had put in age assurance. Ten more had blocked British users entirely and gone home.

At the same time, daily use of VPN apps in the UK went from roughly 650,000 people before the rules landed to more than 1.4 million in August, then settled around 900,000 by November. Ofcom has been careful here, and deserves credit for it: the regulator says the evidence does not establish that this rise was caused by children dodging checks. It is a rise in VPN use. That is all it is.

What we do know about children comes from government research. Around a quarter to a third of 11 to 17 year olds had used a VPN at some point. Some 45 per cent of children surveyed had met at least one of the advanced checks: facial age estimation, uploading a government ID, card verification, or a third-party identity app. And in one survey of children, 39 per cent said they had got past a check at least once, rising to 71 per cent among those who set a VPN up themselves.


Read those three numbers in order and an uncomfortable shape appears. The checks are real. The children who want past them are past them. And the people actually standing at the gate, handing over a face scan or a passport, are adults who were doing nothing wrong.

## My own view

Here is where I land, and I want to be honest that reasonable people disagree.

I think protecting children from pornography is a decent aim, and I think the method chosen is bad. Not because it is strict, but because of who pays.

A fourteen-year-old with a borrowed account, a sibling's face or a VPN is through. A thirty-nine-year-old who wants to read the news about her own town is asked for a passport, and she is asked by a company she has never heard of, which may store the scan, and which she has no way to audit.

That is not protection. That is a verification economy, and the currency is adults' identity documents.

The accuracy argument does not rescue it either. NIST's testing puts the average error of facial age estimation at about 1.32 years for adults and 2.80 years for 13 to 17 year olds. That is better than most people assume, and it is still a guess made about your face by a model, logged somewhere.

## What to do with the box

You will meet these checks for years. A few things make them less costly.

Pay with a card if you can. A credit card check satisfies the rule and gives a payment processor a yes or no, not a scan of your face. It is the least data you can hand over and still get in. Where open banking is offered, it is usually a one-off confirmation, not a copy of your statement.

Avoid the passport photo when an alternative exists. A scan or a photo of an ID document is the most valuable thing on the list and the hardest to get back. Ask the provider what it keeps and for how long, in writing if you can. If they cannot tell you, that is the answer.

Ask for another method if the face scan fails you. Providers must offer a route that does not shut people out, and a failed age estimation is not a verdict. Say: the automated check failed me, what alternative route do you offer? Keep the reply.

If you are shut out of something you had a right to see, complain to the service first, then to Ofcom. Regulators read patterns, and a single complaint about one site is how a pattern starts.

One more thing nobody warns you about. The check is often run by a third party you have never heard of, in a country you did not choose. Ofcom's framework requires services to comply with data protection law, which is a floor, not a promise. Ask what happens to the image after the scan, who else sees it, and whether it is kept. If the answer is not on the page in plain English, assume the worst.

And watch for the market going quiet. Smaller and overseas services that cannot afford compliance have simply stopped serving Britain. Ten of the hundred most popular sites did exactly that. They did not become safe. They became unavailable, and the traffic went to whatever replaced them.

Do not teach a child to use a VPN. Ofcom's guidance says services should not publish material that encourages getting around age checks, and it names VPN advice specifically. Whatever you think of the rules, handing a child a tool that hides their traffic from every other safeguard as well is a different decision from the one you are making about your own reading.


One thing that did not happen, and deserves saying: the government confirmed on 15 July 2026 that it will not ban or age-gate VPNs, because they have legitimate uses. A proposed amendment to make it an offence to sell VPN services to under-18s was stripped from a bill in later proceedings. There is no VPN ban. Repeat that next time you see the headline.

> The gate is real. The people it stops are mostly the ones who were never the problem.

I keep thinking about the shape of the thing. A rule aimed at children, delivered at adults, enforced by companies, and measured by nobody in a way that would tell us whether any child is safer. Ofcom has been unusually candid that it cannot yet say.

So here is my question, and I do not have an answer that satisfies me: if we cannot show a single child is safer, and we can show that a million adults started routing their internet traffic through a company in another country to avoid being counted, has this worked?

Les actualités sont collectées automatiquement depuis des flux publics robotique & IA.