Ofcom tells social media firms to abandon age inference as Australia's under 16 ban leaks

Two regulators on opposite sides of the world spent the first half of 2026 measuring the same thing, and both concluded that the weakest part of protecting children online is the age check itself.

On 15 July 2026 Ofcom published its statutory report on the use of age assurance, required under the Online Safety Act 2023 and laid out on the UK government's publications register the following day. It assesses the first six months after the protection of children duties came into force on 25 July 2025. The headline number is progress: among children asked to prove their age, the proportion meeting a check Ofcom classes as highly effective rose from 25% in July 2025 to 43% in January 2026. More than 69 million age checks were completed across a sample of 32 services between July and December 2025, a 23 fold increase on the preceding six months. By June 2026, 64 of the 100 most popular pornography services in the UK had deployed age assurance and a further 10 were blocking UK users outright.

The report also measured the gaps. Eight per cent of children aged 8 to 14 in Ofcom's passive monitoring study visited a pornography service, and 87% of those visits lasted under 30 seconds, with 65% under 10 seconds, a pattern Ofcom reads as children bouncing between sites looking for one without a check. Four per cent reached at least one service with no age check at all, and search engines were the route: 33% of first page Google results and 54% of Bing results led to pornography sites with no age checks or geo-blocking. Ofcom says it has opened 23 investigations into the providers of 88 adult services, that 73% of those services have since introduced age checks or blocked UK users, and that it has fined seven providers of 24 sites, the largest penalties being 1.35 million pounds against 8579 LLC and 1 million pounds against AVS Group Ltd.

The finding that matters for social media is narrower and sharper. Ofcom's guidance lists the methods capable of being highly effective, and behavioural age inference, estimating a user's age from what they watch and how they behave, is not among them. Ofcom's report states that some companies relying primarily on inference may be failing to detect significant numbers of children. Its instruction was direct: switch to a listed method without delay, or prove with reliable and compelling evidence that the current one works. On the same day Ofcom opened a formal investigation into TikTok Information Technologies UK Limited under section 12 of the Act, case reference CW/01352/07/26, with an update promised in October 2026. Ofcom's own case notice is explicit that opening an investigation means no conclusion has been reached. Penalties, if a breach were eventually found, run to 18 million pounds or 10% of qualifying worldwide revenue, whichever is greater.

Australia is further down the same road and its data is less flattering. The Social Media Minimum Age took effect on 10 December 2025. On 31 March 2026 the eSafety Commissioner, Julie Inman Grant, published a first compliance report naming Facebook, Instagram, Snapchat, TikTok and YouTube, and announced a shift from monitoring to enforcement, with civil penalties of up to 49.5 million Australian dollars available. Reporting on that document, Jurist recorded eSafety's concerns that platforms let users repeatedly retry the same age assurance method until they passed, and that measures to stop new under 16 accounts were insufficient.

Then came the evidence. On 31 July 2026 eSafety published "Early days, early insights", the first instalment of a two year evaluation, based on 803 children aged 10 to 15 and their parents surveyed at baseline in November to December 2025 and again in March to April 2026. Social media use fell from 85.9% to 81.5%. Account ownership fell from 52% to 42%. Daily or more frequent use barely moved, from 60% to 58%. Reddit use rose from 6% to 9%. More than half of the children who kept accounts said they were never asked to prove their age, 18% said a platform estimated their age wrongly, and 37% said they simply entered an age of 16 or over.

The readings of that diverge. Assistant Minister Andrew Leigh compared the law to a minimum drinking age and told Al Jazeera the government never expected total compliance. The researcher Joanna Orlando pointed to virtual private networks and migration to less regulated services. eSafety itself cautions that the report cannot determine long term effectiveness, only whether early changes are beginning.

What is not yet known is whether behavioural inference can ever be shown to meet the statutory standard. Ofcom promised Parliament a rapid assessment by the end of October 2026 of what a highly effective check for being over 16 looks like, and a statutory report on app store level protections by January 2027, ahead of UK restrictions expected in 2027. The TikTok case has produced no finding. Neither regulator has published figures on logged out access or circumvention by network tools, which is precisely where both sets of numbers are weakest.