The Bouncer in Your Browser: How UK Age Checks Work in 2026

It used to be a simple box: “Are you over 18?” Tick yes, carry on. In 2026, that box has grown a clipboard, a camera and a request for your passport. If you’ve been asked to prove your age online lately, you’re not imagining it — and you’re not alone.

Under the UK’s Online Safety Act, services that host certain types of content are expected to take children’s safety seriously. For some sites and apps, that means putting proper age checks in place before someone can watch, buy, post or chat. The result is a new layer of digital door staff: sometimes a quick face scan, sometimes a bank check, sometimes a full ID upload.

The good news is that age checks can be done without handing over your life story. The less good news is that not every check is built with privacy in mind. Here’s how to tell the difference.

Why the internet has started asking for ID

The Online Safety Act became law in 2023, and Ofcom has been setting out what platforms need to do since then. The rules are not a single switch that makes every website demand your passport. They apply differently depending on the service and the risk. A gambling site, a dating app, a video platform and a forum can all face different expectations.

What has changed for ordinary users is the spread of “age assurance” — the catch-all term for methods that estimate or verify how old you are. Some are light-touch. Some are quite serious. Most sit somewhere in between.

The main ways UK sites check your age in 2026

Facial age estimation. You take a selfie or short video, and software estimates whether you look old enough. This is not the same as facial recognition. A good system is trying to answer “is this person likely over 18?” rather than “who is this person?” — but the image still has to be handled carefully.

Photo ID upload. You photograph your passport, driving licence or another accepted document. Some services add a liveness check, such as asking you to turn your head or read a phrase. This is closer to traditional verification and deserves the most caution.

Bank or card checks. Some services use a payment card or bank account as a signal of adulthood. A card check might involve a small authorisation, while an open banking check can confirm age-related details through your bank app. These can be convenient, but read what is being shared before you tap approve.

Mobile network checks. Some age checks use information held by a mobile operator to confirm that the account holder is over 18. It can feel invisible, which is good for convenience and less good for understanding what just happened.

Reusable digital proof. A growing option is a privacy-preserving token or digital credential: you prove your age once with a trusted provider, and then share only a “yes, over 18” style result with other sites. This is the direction many privacy campaigners prefer, because the site does not need to see your passport or your face.

What happens to your face or passport afterwards

This is the question worth asking every time. The answer depends on the company doing the check, not just the website you were trying to use.

A well-designed age check should collect the minimum it needs and keep it for the shortest time possible. Some providers estimate your age from a selfie and then delete the image, keeping only a pass or fail result. Others may retain records for fraud prevention, audit or legal reasons. ID documents are sensitive, so retention periods and access controls matter.

Look for a privacy notice written in plain English. It should say who is responsible for your data, what is collected, why, how long it is kept and who it is shared with. If the only information is a vague line about “trusted partners”, treat that as a warning sign rather than a warm welcome.

Under UK data protection law, you also have rights: to ask what is held about you, to correct it, and in many cases to have it deleted. You can complain to the Information Commissioner’s Office if a company ignores you. That is not a magic wand, but it is a real route.

How to spot a legitimate check from a lookalike

Most age checks are dull, official-looking and a bit annoying. Scams are often the opposite: urgent, messy and oddly keen to get your passport by email.

A few practical checks:

• Look at the web address. A real check usually happens on a named provider’s domain, reached from the app or site you already trust. Be wary of a link sent by direct message.
• Check the operator. The service should name the company running the check and explain its role. If you cannot tell who is asking, stop.
• Never send ID by email or WhatsApp. Legitimate providers use a secure upload flow, not an attachment request from a “support agent”.
• Beware of screen-sharing. No genuine age check needs to watch you use your banking app.
• Refuse gift cards and “verification fees”. Age checks may cost the platform money, but they should not ask you to pay a stranger to unlock your account.
• Use the official app or website. If a link in a social post takes you to a login page that looks almost right, close it and navigate yourself.

Staying private without giving up on the service

You do not have to choose between using the internet and caring about privacy. You can be a bit deliberate.

Choose the least invasive option offered. If a site allows facial age estimation or a reusable age token instead of a full ID upload, that is usually the better trade. Use an email alias if you are signing up for something new. Read the retention line before you upload anything. And if a service demands far more than it needs — say, a passport scan to read a recipe — ask yourself whether you actually need that service.

A VPN is not a privacy fix for age checks. Dodging a check may break the service’s terms, and it does nothing for the data you have already handed over.

A quick checklist before you tap “verify”

• Is this the official app or website?
• Which company is doing the check, and what does its privacy notice say?
• Is there a less invasive option, such as age estimation or a reusable token?
• Does it really need my passport, or would a face estimate do?
• How long will it keep my data, and how do I ask for deletion?

The age gate is here to stay for plenty of UK services. That does not mean you have to hand over the family album at the door. A little scepticism, a quick look at the small print, and a preference for the lightest check available will get you through most of them without giving away more than you need.