PRESS RELEASE
AVPA Response to Prime Minister’s Announcement on Social Media
The Age Verification Providers Association (AVPA) confirms that the age assurance requirements needed to support a minimum age of 16 for social media are technically achievable using technology that is already widely deployed.
The age assurance sector has delivered more than one billion privacy-preserving age checks worldwide. The overwhelming majority of users affected by any social media age threshold are adults, and a wide range of privacy-preserving “highly effective age assurance” methods to confirm users are 18+ are already operating at scale under regulatory oversight from both Ofcom and the Information Commissioner’s Office.
Establishing a minimum age of 16 presents additional challenges because some younger people have fewer sources of authoritative age data available to them than adults. Fewer minors hold passports, for example. However, other sources of age evidence are available, including bank accounts, electoral registration records, provisional driving licences (from three months before your sixteenth birthday).
Age estimation technologies can provide a convenient and privacy-preserving way to establish whether someone is likely to be above or below a particular age threshold. However, all age estimation systems have a margin of error and therefore require an appropriate age buffer to achieve a desired level of confidence. Many age assurance journeys use estimation as a first step and only request additional evidence where a user’s estimated age is too close to the threshold for a reliable decision to be made.
Age checks are often reusable, for example, by using a digital ID app or wallet, and interoperable networks allow a single check to be used across multiple apps and websites.
PASS-accredited proof-of-age cards are available even to those without any suitable source of proof, because this scheme also allows your age to be confirmed by a professional referee.
The Data (Use and Access) Act 2025 also created a new Information Gateway that enables certified Digital Verification Service providers operating under the UK Digital Identity and Attributes Trust Framework to access certain government-held data under controlled conditions. This creates new opportunities to verify age against authoritative government records while maintaining strong privacy protections.
Circumvention
The Association also notes that anecdotal reports of children bypassing age checks should be viewed in context. Modern age assurance systems incorporate multiple safeguards designed to resist circumvention, including liveness detection to prevent the use of photographs, videos or avatars, and controls intended to detect manipulated or AI-generated identity documents. As with all areas of cybersecurity, providers must continually adapt to emerging threats, but reputable providers actively monitor new attack techniques and update their systems accordingly.
Collusion remains a challenge, just as it is difficult to prevent an adult purchasing alcohol on behalf of a minor. However, online services have additional tools available to mitigate this risk, including periodic re-authentication and checks designed to confirm that the person using an account remains the same individual who originally completed the age check.
Virtual Private Networks are not kryptonite to age assurance
The AVPA does not believe that virtual private networks (VPNs) present an insurmountable obstacle to implementing this policy. VPN use can often be detected or inferred through a combination of technical signals. Platforms may also use additional geolocation, device and behavioural indicators to assess whether a user is likely to be accessing a service from within the United Kingdom. Where uncertainty exists, services can require an age check or apply additional location verification measures.
Australia
The eSafety Commissioner has begun investigations into five leading platforms (Facebook, Instagram, Snapchat, TikTok and YouTube). Until those investigations conclude, and any resulting enforcement action is taken, it is premature to treat current levels of under-age access as evidence that age assurance technology has failed.
Commenting on Australia’s experience, the AVPA noted that the principal challenge appears to be inconsistent deployment rather than technological capability. Independent testing has shown that many platforms still do not routinely verify age when new accounts are created. If age assurance is not deployed at the point an account is opened, it is unsurprising that underage users continue to gain access.
Australia’s eSafety Commissioner, Julie Inman Grant, recently observed in response to the AVPA stating “If there is the will, there is a way.”:
“There is the way. Social media companies need to find the will.”
Commenting on the announcement, Iain Corby, Executive Director of the Age Verification Providers Association, said:
“The debate has moved beyond whether online age assurance works. The technology already exists and is being used successfully every day at enormous scale.
“The real question is whether platforms are prepared to deploy it consistently and effectively. Australia’s eSafety Commissioner is now doing exactly the right thing in moving to enforcement, and we expect that to drive the improvement that early compliance monitoring alone could not. The UK has an opportunity to build that accountability in from the start, so that the policy delivers in practice what it promises on paper.
“No technology can guarantee perfect compliance, just as no system can completely prevent underage drinking or gambling. The relevant question is whether it materially reduces access. The evidence increasingly suggests that it does.”
Notes for editors
- PASS cards are available across the UK from CitizenCard issued for free to 13-15 year olds who can still use them to access social media when they turn 16, or for £18 to those 16 and above. In Scotland, free YoungScot cards may be obtained from the age of 12.
- AVPA article on VPNs VPNs are not Kryptonite to age assurance
- AVPA Australian Lessons Learned Report
- Includes KJR testing of social media account opening processes
- eSafety Commissioner quote source https://www.linkedin.com/feed/update/urn:li:activity:7452829689464852481
- YouGov research on circumvention behaviours – 7 News Australia
- Molly Rose Foundation research on under-age social media access “Two-thirds (64%) of continuing YouTube users, 61% of Snapchat users, and 60% of both Instagram and TikTok users, said platforms had taken ‘no action’ to remove or deactivate an account they had before restrictions”
- Family Online Safety Institute research: 19% of children 10-16 reported having lost all of their accounts, 33% reported having lost some, and 17% reported having lost none
- Australian Age Assurance Technology Trial (AATT)
- Internet Matters research: “In focus groups… One technique brought up was children drawing facial hair on themselves”
- Social Media Minimum Age: Compliance update, Australian eSafety Commissioner. March 2026
Notes on Australia
- 9 in 10 platforms are not routinely checking age at account creation
- Children usually don’t need to ‘evade’ age assurance because they are never asked for it
- Australia’s challenge is deployment and enforcement, not technology
- If social media companies wish to argue that age assurance does not work, they should first try using it
Four facts that are often missing from coverage of the Australian experience:
- Recent independent testing by Australian technical auditors KJR found that nine out of ten platforms were still allowing new accounts to be created without routinely confirming age. A new user has no behavioural history to analyse. Platforms therefore have no basis for inferring age at account creation and cannot prevent underage accounts being opened without actively requiring age assurance.
- Age verification providers report being asked to perform substantially fewer checks than would be expected if platforms were routinely verifying users whose age was uncertain.
- Research commissioned by the Molly Rose Foundation reinforces our conclusions: “in a majority of cases platforms have failed to identify and remove under-16 accounts, meaning that most children haven’t had to proactively use workarounds”. Their evidence confirms that the biggest loophole is not children defeating age assurance technology, but platforms failing to use it. Their survey shows the most common issues are (i) no age check is performed, (ii) users lying about their age where only self-declaration is used, or (iii) parental collusion.
- Claims that age assurance technologies are easily defeated are based on isolated anecdotes rather than quantitative research. Modern systems are routinely evaluated against presentation attacks and fake documents. Platforms can choose to apply age buffers and a waterfall of alternatives to improve effectiveness of estimation for users close to the legal threshold.
Commenting on the Australian experience, Iain Corby, Executive Director of the Age Verification Providers Association, said:
“The evidence from Australia already suggests that the main barrier to success is not the capability of age assurance technology, but the willingness of some platforms to deploy it consistently and at scale. An important question arises: are some platforms genuinely trying to prevent under-16s having accounts, or merely trying to test how little they can get away with?
If social media companies wish to argue that age assurance has not worked Down Under, they should first try using it.”
About The Age Verification Providers Association
The AVPA is the global trade body for independent providers of privacy-protecting, standards-based, age assurance technology. Our mission is to make the Internet “age-aware”
As an association, we work to:
- Inform and educate the public, industry and media on age verification and age estimation solutions and technology.
- Promote a positive image of privacy-preserving age assurance and the independent sector which delivers it.
- Represent the industry to regulators and law makers for the advancement of best practice.
The AVPA was formed in 2018 and is growing rapidly as the age and identity provider industry takes off.
The AVPA is a non-profit organisation, governed by a representative Board drawn from its member organisations.