Age Verification Laws for the Internet: The UK Online Safety Act and US State Laws Explained

Age verification for online content moved, over the course of roughly a year, from a policy debate into an actual enforcement regime with real fines attached — and the mechanics of how that enforcement actually works are considerably more specific than the general phrase "age verification law" suggests.

What "Highly Effective" Actually Means Under the UK's Law

The UK's Online Safety Act requires platforms hosting pornography or content promoting self-harm, suicide, or eating disorders to implement what the law calls "highly effective" age-assurance systems. That specific legal standard is doing real work: it rules out the methods platforms have historically relied on, most notably a simple checkbox asking users to confirm they're over 18, or a self-entered birthdate with no verification behind it. Ofcom, the UK's communications regulator responsible for enforcing the Act, has published a non-exhaustive list of methods it considers capable of clearing the "highly effective" bar, including open banking checks (verifying age through financial account data), photo ID matching, facial age estimation software, and third-party digital identity verification services.

Children's safety duties under the Act came into force on July 25, 2025, and enforcement has continued to build through 2026. Ofcom's own tracking shows real, measurable movement: the proportion of children who encountered a highly effective age check when trying to access restricted content rose from roughly 25% in July 2025 to 43% by January 2026 — a meaningful jump, though one that also makes clear a majority of attempts still weren't being caught by adequate checks partway through the rollout.

The Fines and Investigations So Far

Enforcement hasn't stayed theoretical. As of February 2026, Ofcom had opened investigations into more than 90 online services and issued six fines for non-compliance, the most recent an £800,000 penalty against Kick Online Entertainment for failing to put adequate age checks in place. Ofcom's own public statements around its statutory reporting have signaled that it considers the current pace of compliance insufficient and expects tougher, more assertive enforcement going forward rather than a plateau.

What's arguably more significant than the fine amounts is where enforcement attention has started moving: in January 2026, Ofcom opened formal investigations into X, specifically regarding its Grok AI chatbot, and into a separate AI companion service called Joi.com. This marks a real expansion of the Act's practical reach — from traditional pornography sites, the kind of service age-verification laws were originally designed around, to generative AI chat products capable of producing sexual or otherwise age-restricted content on demand, a category that essentially didn't exist in its current form when the underlying legislation was first drafted.

Why This Approach Is Genuinely Contentious

Age-verification requirements of this kind sit at the center of a real, substantive disagreement rather than a purely technical implementation question. Supporters argue that self-certification has never functioned as a meaningful barrier for minors and that verification methods like facial age estimation or ID matching are the only realistic way to actually restrict access rather than merely gesture at restricting it. Critics — including a range of digital rights and privacy advocacy groups — argue that mandatory identity or facial verification for accessing legal adult content creates a privacy and security risk of its own: it requires either the platform or a third-party verification service to collect and retain sensitive identifying information, which becomes an attractive and potentially catastrophic target if breached, and creates a data trail linking a real identity to specific browsing behavior that many adults have legitimate reasons to want kept private, regardless of the content's legality.

The US Picture: A Patchwork, Not a Single Law

Unlike the UK's single national framework, age verification in the United States exists as a state-by-state patchwork, with a majority of states having passed some version of an age-verification requirement targeting pornographic content specifically, generally modeled on similar underlying logic to the UK's approach — requiring "reasonable" or "commercially reasonable" age verification methods rather than self-certification alone. These state laws have faced their own legal challenges on First Amendment grounds, with outcomes and specific requirements varying by state and by which court has weighed in, making "what does US law require" a meaningfully different and more fragmented question than the equivalent question about the UK, where one national regulator with one consistent standard is doing the enforcing.

What to Actually Expect Going Forward

The clearest trend across both the UK and the expanding set of US state laws is that "self-certify your own age" as a compliance method is being phased out, not merely discouraged, and platforms that continue relying on it are increasingly exposed to real regulatory and financial risk rather than a theoretical one. The clearest signal of where this is heading is Ofcom's own expansion into AI chatbot services in January 2026 — a strong indication that age-assurance obligations are being read as applying to any service capable of producing age-restricted content, not just the sites the original legislation's drafters had specifically in mind when the language was written.