Online Safety Act: age verification without a data lake
Part 3 and Part 5 duties are live. Ofcom's July 2026 effectiveness report is the next industry milestone. Platforms that minimise data at the verifier win on both privacy and engineering cost.
Online Safety Act age assurance in 2026 requires platforms to implement highly effective age verification or estimation where children's access assessments demand it. AffixIO evaluates eligibility at the boundary and returns signed yes or no with Merkle audit, without building another identity vault.
UK Online Safety Act age assurance in July 2026: HEAA methods must be accurate, robust, reliable, and fair. AffixIO returns signed over-18 outcomes without storing date of birth at the content provider.
What changed in July 2026
Children's safety duties under Part 3 user-to-user and search services have applied since 25 July 2025. Part 5 publisher duties for pornographic content require age verification or estimation for all users. By end July 2026, Ofcom's statutory report on age assurance effectiveness is due. Engineering and legal teams should already hold documentation mapping method choice to Ofcom's four HEAA criteria.
HEAA four criteria in practice
- Technically accurate: the method correctly distinguishes adults from children at the threshold your risk assessment requires.
- Robust: resistant to trivial bypass (shared accounts, VPN-only checks, self-declaration alone).
- Reliable: consistent outcomes across devices, regions, and peak load.
- Fair: inclusive for users who lack government ID or credit history.
Score your proposed method with the age assurance scorer. Map Part 3 vs Part 5 scope with the OSA scope checker.
Architecture: verification layer vs age vendor
Age vendors establish identity signals. AffixIO sits at the allow or deny boundary and returns signed proof the gate executed. Zero-knowledge threshold paths can prove over-18 without sending date of birth to the content provider. See verification vs age vendor and privacy-preserving age check.
Reproduce before Ofcom evidence requests
- Run age threshold flows in the sandbox.
- Export Merkle inclusion with the Merkle verifier.
- Attach artefacts to your children's access assessment.
Full buyer guide: Online Safety Act compliance guide. Calendar: regulatory deadlines.