Ofcom Says Age Checks Are Scaling Fast — But VPN and Privacy Questions Remain

Ofcom has published a fresh update on how age checks are being used under the UK's online safety regime. The regulator says age assurance is now being deployed at unprecedented scale across pornography, social media, dating and gaming services, but warns that the tech industry still needs to strengthen protections.

The headline figures are significant: Ofcom says all of the UK's top 10 porn sites now have age checks in place; 64 of the top 100 UK pornography services had deployed age assurance by June 2026; and another 10 were geo-blocking UK users. It also says the share of children who encountered highly effective age checks after being asked to prove their age rose from 25% in July 2025 to 43% in January 2026.

At the same time, Ofcom says the job is not done. It has launched a formal investigation into whether TikTok's age checks are effective in preventing children from seeing harmful content, and it says search engines need to do more where children can still find pornography sites without effective checks.

This is not just a child-safety story. Age assurance affects adults too because proving age can involve sensitive personal data, identity documents, face scans, third-party verification services, device controls, account signals or other privacy-sensitive checks. The central policy question is how to protect children without normalising excessive data collection for everyone.

Ofcom's dedicated research page also tracks children's experiences of age assurance and VPN use. That matters because VPNs are often pulled into the debate as a circumvention tool, even though they also have ordinary privacy and security uses: safer public Wi-Fi, less hotspot tracking, reduced ISP visibility and more private browsing when travelling.

If you are asked to complete an age check, pause before handing over data. Check who operates the age-assurance service, what data is collected, whether identity documents or biometrics are retained, and whether there is a lower-data way to verify eligibility. Avoid uploading identity documents to lookalike or unofficial pages reached through search ads, messages or social links.

Parents should treat VPN use as a conversation starter rather than automatic proof of wrongdoing. Ask what the VPN is used for, check device and app settings together, keep accounts secured with strong passwords and MFA, and explain why some services are legally required to restrict access.

A VPN helps when the problem is network privacy: public Wi-Fi snooping, local network monitoring, basic IP-location exposure or ISP-level visibility. Those are real reasons to use a reputable VPN, especially on shared networks or while travelling.

A VPN does not prove your age, stop a platform enforcing its rules, make unsafe content safe, or remove legal duties from services covered by the Online Safety Act. It also does not protect identity documents uploaded to an age-check provider if that provider later mishandles data. For that, users need careful data-minimising services, secure accounts and clear regulation.

The best outcome is not a VPN panic or a privacy free-for-all. Age checks should be effective for child safety, but proportionate, auditable and privacy-preserving for everyone else. VPNs should remain available as legitimate security tools, while platforms and age-assurance providers should be judged on whether they minimise data and explain the limits clearly.