A UK regulator ties age checks to risk, not one fixed method

The short answer

The UK's data regulator, the Information Commissioner's Office, publishes guidance describing several ways an online service can check a user's age, and states the method used should depend on the risk its processing poses to a child, not one fixed universal check. A strict check on one site and a typed birthdate on another can both match the regulator's own approach, depending on what each service does with a child's data.

What the evidence says

The guidance names five approaches: age verification, methods that verify exact age or confirm over-eighteen status; age estimation, often algorithmic methods that estimate an age or range; parental confirmation, a parent confirming a child's age through an account; self-declaration, a user simply stating their age with no further evidence; and waterfall techniques, which combine several of the above. It states that the method used depends on the risk the processing creates for the child and the certainty required, and that for high-risk processing a service should either apply the full Children's code to all users or use a method giving the highest achievable certainty of age. It instructs services to collect only the minimum information needed. The guidance states it replaces an earlier opinion published in October 2021, and sits under a wider Children's code, described on the regulator's site as a statutory code of practice for online services likely to be accessed by children.

For context

The guidance, as retrieved on 16 September 2026, carries a notice that it is under review and may change following the Data (Use and Access) Act, so its wording is a snapshot rather than a settled position; no publication date for this update was visible, only that it replaced the 2021 version. The document explains what a service is expected to do; it does not tell a parent which method a given app is currently using, so a family cannot judge age-check quality from this guidance alone, only from what a service discloses. The risk-based structure also means a stricter check on one app does not make a lighter check elsewhere unlawful, only that the two services were assessed differently.

A practical next step

When a service asks for your child's age, notice which of the five approaches it appears to use, and treat a bare typed birthdate on a service handling sensitive information as worth asking about, rather than assuming any age gate offers equal protection.

• Which age-check method does your child's most-used app actually use: a typed birthdate, an estimate, or something else?
• Does the risk of that service, what data it collects, what content it shows, match the strength of its age check?
• If a stated age turns out to be wrong, does the service explain what happens next?

The ICO's guidance describes a menu of methods matched to risk rather than one universal check, and says plainly that it may still change. Reading it this way helps you judge a specific app's age gate against a standard the regulator has published, rather than an assumed single rule.