UK's Under-16 Social Media Ban Turns Every Signup Into an Identity Checkpoint

Britain has decided that the price of a social media account is your face, or your passport.

Under rules slated for spring 2027, anyone opening a new account on a covered platform will need to prove they're at least 16. That means uploading government ID, submitting to a facial age-estimation scan, or running through a third-party age-assurance flow. Existing accounts held by under-16s will be cut off.

The policy sits downstream of the Online Safety Act and Ofcom's children's-access duties. The intent is reasonable. The implementation is where IAM people start grinding their teeth.

Age assurance is not authentication. It's a one-shot assertion at registration, typically handled by a third-party processor like Yoti, Persona, or Veriff. Once the "over 16" claim is minted, the platform doesn't actually want to know who you are — they want a signed boolean. In practice, what gets retained, where, and for how long depends entirely on the vendor's contract and the platform's appetite for risk.

That appetite has not historically been large.

The circumvention path is trivial and well-documented. A VPN egress point outside the UK skips the check on most platforms that geo-gate the requirement. Borrowed ID, a parent's selfie, or a passable deepfake will defeat liveness checks that don't enforce strong presentation-attack detection. Facial age estimation has published error bars of plus or minus two years at best, which is exactly the range that matters here.

Meanwhile, the data side gets ugly fast. Every covered platform now becomes a collection point — directly or by proxy — for identity documents and biometric templates tied to email addresses. That's the kind of dataset that turns a routine credential-stuffing incident into a Subject Access Request nightmare. The ICO has guidance on age assurance that leans heavily on data minimisation, but guidance is not a STRIDE model.

A few things worth flagging for anyone building toward this:

• Treat the age-assurance vendor as a high-value supply-chain dependency. Their breach is your breach, and the Capita and MOVEit playbooks apply.
• If you're caching the result, cache the assertion, not the evidence. Signed JWTs with short lifetimes and rotation beat a database row containing a passport scan.
• Decouple the age claim from the user's primary identifier. The processor should never need to know which TikTok handle the face belongs to.
• MFA on the resulting account still matters. Age-gating registration does nothing for session hijacking, OAuth token theft, or the usual OIDC misconfigurations that have nothing to do with how old the user is.

The quiet irony: a regime built to protect children will create one of the largest concentrations of minors' biometric data in Europe. Whether that trade lands well depends almost entirely on vendors most users have never heard of.

The passport scan, as ever, is forever.