The Online Safety Act was introduced in the UK on July 25, with age verification checks now required on a number of sites.
People have been turning to the best VPNs in an attempt to bypass these age checks and subsequently major VPN providers have seen spikes in sign ups – along with suspect free VPNs.
The law is well intentioned and age checks are designed to protect children and vulnerable internet users from easily accessing harmful content.
However there are serious privacy and cybersecurity risks associated with the checks due to the sensitive data that needs to be handed over. There has been passionate debate over the act and cybersecurity experts have called it a “disaster waiting to happen.”
There has been anger over the types of sites age verification checks are appearing on whether they’re necessary. The act is still in its infancy, as are the age checks, but we’ve highlighted some key sites where you’re likely to encounter age verification checks.
Notable examples
X
Age verification has come to social media app X – but it’s not simple. Many UK users will receive a message saying “Due to local laws, we are temporarily restricting access to this content until X estimates your age.”
Some users will find they don’t need to verify their age. Accounts created in 2012 or earlier will be automatically verified, along with anyone who has already verified their age in the past.
User age verification involves submitting government-issued ID or a live selfie. Age will then be estimated by X’s AI systems but X says it also uses Au10ticx and Persona for non-creators.
However in our experience, on a free X plan, we couldn’t find a way to complete age verification. This correlates with some reports on Reddit that suggested only X Premium subscribers could verify age. But others suggested that even after subscribing, ID checks were required or even offline completely.
Reddit is a hugely popular forum-based social media site and now employs age verification. Checks were introduced on July 14, prior to the Online Safety Act becoming law.
Communities labelled as NSFW (Not Safe For Work), along with those that include content relating to alcohol or gambling, will require age verification before they can be accessed.
Persona is the third-party Reddit is using to verify a user’s age, with a selfie or government ID having to be uploaded.
Reddit says it does not have access to the uploaded photo. The site only stores your verification status and the birthdate provided at account creation. It says Persona doesn’t retain your photo for longer than 7 days and doesn’t have access to your Reddit data.
A number of Reddit users have expressed concern that subreddits have been unfairly affected by age verification checks and shouldn’t have been blocked. Subreddits discussing mental health, sobriety, addiction, and news reports are some of the examples given.
The BBC reported that posts about the conflicts in Gaza and Ukraine have been blocked.
Spotify
Perhaps the most surprising site or app on this list, music streaming service Spotify has seemingly introduced age verification.
Spotify said that age checks are required in order to access “some Spotify content and features.” Music videos that are tagged 18+ are an example of this content.
Yoti is the third-party provider Spotify is using, with facial age estimation and ID verification in place. In its Safety and Privacy Centre, Spotify says Yoti deletes all user data “after the age assurance process is complete.”
Users that can’t prove their age may find their Spotify accounts will be deactivated and eventually deleted.
Xbox
Microsoft has said it is bringing age verification to Xbox as part of its “compliance programme for the UK Online Safety Act” and to ensure “age-appropriate experiences.”
It also uses Yoti and says it offers four forms of age verification – age estimation, ID verification, mobile provider check, and credit card check.
For age estimation and ID verification, Microsoft says “the image is encrypted and deleted after use/verification.” For mobile provider and credit card checks, it says “the submitted information is not stored or shared beyond the initial check.”
For now, Xbox age verification is optional but “access to certain social features will be limited to friends only” if checks are not completed by “early 2026.”
Until your account is verified, you’ll only be able to use the following features with friends only:
- Voice and text communication
- Party functionality and game invites
- User generated content (including Activity Feed)
Looking for Group and custom clubs features won’t be available.
Bluesky
X alternative Bluesky is also asking users to verify their age. It is using Epic Games’ Kid Web Services to give users a choice over verification.
Credit card checks (verified by Stripe), ID scans (verified by Veriff), and face scans (verified by Yoti) are the three ways Brits can verify their age on Bluesky.
Bluesky has said it’ll “make adult-appropriate content inaccessible” for any users who don’t want to verify or are underage – this includes direct messaging.
Telegram
Seen as a popular alternative to WhatsApp and one of the best encrypted messaging apps, Telegram is a secure messaging service that is implementing age verification checks.
Telegram’s privacy policy states that it is offering “optional” age verification checks to “comply with regional legal requirements.”
Age checks are completed via a facial scan, which runs on your device. Telegram says: “Facial images and biometric data are not uploaded to or stored on our servers, are not accessible to Telegram, and are deleted after the age estimation is completed.”
However Telegram does say it “may store the age estimation result and certain metadata” on its servers to “track performance and prevent misuse.”
If age verification is not completed, certain content will be blurred or its access will be blocked.
Any form of age verification can still be seen as a cybersecurity risk and pose issues for online privacy. But Telegram doesn’t appear to be using any third-party age verification providers and this does mean there is a significant reduction in risk.
Other cases
This is not an exhaustive list of websites and apps that now require age verification but some popular examples. Others who have introduced age verification include Discord, Grindr, and Nexus Mods.
Wikipedia may also have to introduce age verification checks. However, the Wikimedia Foundation is fighting the regulations, arguing they “endanger Wikipedia and the global community of volunteer contributors.”
What happens next?
A petition calling on the UK government to repeal the Online Safety Act is approaching 490,000 signatures.
The government has said it won’t repeal the act and it’s unlikely this petition will do anything, but it does show a layer of opposition and concern surrounding the law.
Some argue that the government hasn’t fully thought the law through or explored more private age verification options – we’re not surprised the act doesn’t cover personal data safety.
Given the rise in VPN usage, people clearly don’t feel comfortable in handing over their sensitive personal information.
The act has prompted important discussions concerning online privacy and it remains to be seen how these will develop in the coming months.
We test and review VPN services in the context of legal recreational uses. For example: 1. Accessing a service from another country (subject to the terms and conditions of that service). 2. Protecting your online security and strengthening your online privacy when abroad. We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.