Age Verification Compliance by Jurisdiction: What Regulated Businesses Must Know

Age verification is no longer a checkbox. Across the UK, EU, United States, and Australia, regulators have moved from guidance to enforcement, and the penalties for non-compliance now include fines measured in percentages of global revenue, license revocation, and outright service blocking. If your business operates across borders in gaming, adult content, or age-restricted retail, you face a fragmented, fast-moving regulatory landscape where the rules differ not just by country but by industry vertical.

This article maps the current legal requirements by jurisdiction, explains what each regime actually demands technically, and offers practical guidance on building a verification flow that satisfies regulators without destroying conversion.

Why the Regulatory Landscape Changed So Quickly

For most of the internet's history, an "I am 18+" checkbox was the industry standard. Regulators tolerated it. That era is over.

Age verification requirements have rapidly moved from a niche policy concept to a central feature of the regulatory landscape. Over the last two years, and accelerating sharply in 2025, jurisdictions have increasingly adopted laws that require online services to confirm a user's age before allowing access to certain types of content or platform features.

The shift is driven by two forces: growing evidence of harm to minors from unverified access, and the political will to hold platforms accountable rather than parents. The result is a patchwork of laws with inconsistent requirements, different technical standards, and different enforcement bodies. For any business operating across more than one jurisdiction, that patchwork is the compliance problem.

The United Kingdom: Ofcom Enforcement Is Live   

The UK’s online age-assurance requirements are now in force, and Ofcom has moved from preparation to active enforcement.

The Online Safety Act 2023   

Under the UK’s Online Safety Act 2023, services within scope of the child-safety duties must take measures to protect children from harmful content. From 25 July 2025, relevant services were required to comply with Ofcom’s Protection of Children rules, including requirements concerning highly effective age assurance in specified circumstances.

For services that allow pornography, the Act requires highly effective age verification or age estimation to prevent children from encountering pornographic content where the relevant statutory duties apply. Ofcom has been actively monitoring compliance and launched investigations shortly after the 25 July 2025 deadline.

Enforcement is no longer theoretical. Ofcom has since issued financial penalties against providers for failing to implement effective age checks. In February 2026, Ofcom fined Kick Online Entertainment SA £800,000 for failing to implement age checks between 25 July and 29 December 2025. In May 2026, Youngtek Solutions Ltd was fined £500,000 for failing to have the required age checks in place.

The requirements extend beyond dedicated adult websites. Depending on the service, its content, and whether it is likely to be accessed by children, social media, dating, gaming and messaging platforms can also have child-safety obligations under the Act. Ofcom has reported age-check measures being introduced across these sectors.

Beyond pornography   

The UK regime is not limited to pornography. The Protection of Children duties also address other forms of content considered particularly harmful to children, including content that encourages, promotes or provides instructions for suicide, self-harm and eating disorders. Services likely to be accessed by children must implement proportionate measures to prevent children from encountering these forms of primary-priority harmful content where the relevant duties apply.

Ofcom has also established enforcement activity targeting smaller or higher-risk services that host or disseminate harmful content, including suicide, self-harm, eating-disorder and serious violent content.

What “Highly Effective” Actually Means   

The Online Safety Act does not prescribe a single age-assurance technology. Instead, it establishes legal duties and requires services to use an age-assurance process that is sufficiently effective to meet the relevant requirements. Ofcom has provided guidance on how services can meet the “highly effective” standard. Its Age Assurance and Children’s Access Statement was published in January 2025.

According to Ofcom, an age-assurance process should meet four criteria to be considered highly effective: it must be technically accurate, robust, reliable, and fair. Ofcom also says services should consider accessibility and interoperability and must comply with applicable data-protection and privacy obligations.

Ofcom identifies several methods that can be capable of meeting the highly effective standard, including facial age estimation, photo-ID matching, open banking, mobile-network operator checks, credit-card checks, email-based age estimation and digital identity services. The effectiveness of a method depends on how it is implemented as part of the overall age-assurance process.

Self-declaration is not considered highly effective. Ofcom explicitly lists self-declaration of age among the methods that are not capable of meeting the highly effective standard. This means that simply asking users to tick a box or confirm that they are over 18 is not sufficient where highly effective age assurance is required.

Penalties  

Non-compliance with the Online Safety Act can result in fines of up to £18 million or 10% of a provider’s qualifying worldwide revenue, whichever is greater. In the most serious cases, Ofcom can also seek a court order for business-disruption measures. These can include requiring payment providers or advertisers to withdraw services from a platform or requiring internet service providers to block access to a service in the UK. Such measures are subject to the applicable legal and proportionality requirements and are not an automatic consequence of non-compliance.

Ofcom’s enforcement activity began across different areas of the Online Safety Act at different times. Its dedicated enforcement programme concerning highly effective age assurance for pornography was launched in January 2025, while the first illegal-content duties became enforceable in March 2025. Ofcom subsequently opened investigations into pornography services that appeared not to have implemented the required age-assurance measures.

Ofcom has also investigated file-sharing services and other high-risk online services under separate Online Safety Act enforcement programmes, so these should not be presented as a single pornography age-verification enforcement initiative.

 UK Gambling: A Separate Regime   

Online gambling in Great Britain is regulated by the UK Gambling Commission (UKGC) under a separate regulatory framework from Ofcom’s online-safety regime.

The UKGC requires licensed remote gambling operators to verify a customer’s age and identity before the customer can gamble. Its rules also require age verification before a customer can deposit funds or access free-to-play games offered by the operator. 

Consequently, simply declaring an age is not sufficient. Operators must complete the required verification process before permitting the relevant gambling activity.

The UKGC also imposes continuing identity and customer-verification obligations. For example, operators must take reasonable steps to ensure that customer identity information remains accurate and must request additional verification information promptly where required.

Regulatory action against gambling operators can include financial and licensing consequences, depending on the nature and seriousness of the breach. Licence suspension or revocation is possible, but it should not be presented as the automatic consequence of an age-verification failure.

The UK gambling framework therefore represents a separate compliance regime with its own requirements around age, identity and customer verification rather than simply an extension of the Online Safety Act.

The European Union: DSA Obligations and a Developing Blueprint

The EU’s approach combines EU-wide digital regulation with national rules in areas such as gambling. The Digital Services Act (DSA) establishes a common framework for online platforms across the EU, while Member States retain significant responsibility for areas such as gambling regulation.

 Digital Services Act: Article 28 

Article 28(1) of the Digital Services Act requires providers of online platforms that are accessible to minors to implement appropriate and proportionate measures to ensure a high level of privacy, safety and security for minors on their services. The provision applies to online platforms accessible to minors rather than only to the largest platforms.

On 14 July 2025, the European Commission published guidelines on the protection of minors under the DSA. The guidelines set out a non-exhaustive range of measures addressing risks including harmful content, grooming, cyberbullying, problematic and addictive behaviours, and harmful commercial practices.

The guidelines are not legally binding. However, the Commission states that they can serve as a reference when assessing whether platforms comply with their DSA obligations and may inform enforcement actions by national regulators.

The Commission’s approach to age assurance emphasises methods that are accurate, reliable, robust, non-intrusive and non-discriminatory. The guidelines also address different approaches to determining age, including age estimation and age verification.

The EU Age Verification Blueprint

In July 2025, the European Commission released the first version of an EU age-verification blueprint designed to provide a common, privacy-preserving technical approach to age verification across Member States. The initiative was developed to support the implementation of the DSA while also laying the technical foundations for compatibility with the forthcoming European Digital Identity Wallets.

The blueprint allows users to prove that they meet an age threshold - such as being over 18 - without disclosing their exact age or identity to the online service. The architecture separates the issuance of the proof of age from its presentation to the platform, helping prevent the platform from receiving unnecessary identity information or tracking the user’s activity across services.

The initial pilot involved Denmark, France, Greece, Italy and Spain. The initiative has since expanded: current Commission materials identify Cyprus, Denmark, France, Greece, Ireland, Italy and Spain as frontrunners for deployment.

The technical solution became feature-ready in April 2026. The European Commission is now encouraging Member States to make the age-verification solution available to citizens, either as a standalone application or through integration with European Digital Identity Wallets. The Commission’s current objective is for the solution to become available across the EU by the end of 2026.

The solution can use trusted sources such as national electronic identities, passports and identity cards to establish proof of age. Once the proof is issued, the online service can receive an anonymous confirmation that the user meets the relevant age threshold without receiving the user’s identity or exact age. The technical architecture also incorporates privacy-enhancing approaches such as selective disclosure and zero-knowledge technologies.

The European Digital Identity Wallet framework is being developed in parallel. EU Member States are required to provide at least one EU Digital Identity Wallet to citizens and residents by the end of 2026. These wallets will support the secure sharing of verified attributes, including proofs of age, with public and private services.

DSA Penalties

Violations of the DSA can result in fines of up to 6% of global annual sales.

EU Gambling: Member-State Rules Apply

Unlike areas governed by harmonised EU legislation, gambling is not subject to a single EU-wide sector-specific regulatory regime. Member States retain significant autonomy over how gambling services are organised and regulated, subject to EU law and relevant CJEU case law. This results in different licensing, consumer-protection and age-verification requirements across the EU.

Minimum age requirements and verification procedures therefore vary by jurisdiction and, in some cases, by the type of gambling product. Operators must comply with the rules of each market in which they are licensed or otherwise authorised to provide gambling services.

The GDPR adds a separate layer of requirements whenever operators process personal data for age or identity verification. The European Data Protection Board has specifically stated that age-assurance mechanisms should process only the age-related attributes that are necessary for the stated purpose and should use privacy-enhancing measures where appropriate.

The United States: A State-by-State Patchwork

The United States does not have a single comprehensive federal law requiring age verification for all online content. Instead, age-verification requirements have developed through a combination of state legislation, state regulations, and federal constitutional litigation.

The Supreme Court Ruling

A significant development came in June 2025, when the U.S. Supreme Court decided Free Speech Coalition, Inc. v. Paxton. The case concerned Texas House Bill 1181, which requires certain commercial websites publishing sexual material harmful to minors to use reasonable age-verification methods to verify that users are at least 18. The Supreme Court held that the law triggers intermediate scrutiny under the First Amendment and survives that scrutiny, and therefore upheld the Texas law against the constitutional challenge brought in the case.  

The decision should not be described as a blanket ruling that all age-verification laws are constitutional. It specifically addressed the constitutionality of Texas HB 1181.

Texas HB 1181 was enacted in 2023. The Texas Legislature lists its statutory effective date as September 1, 2023. It applies to commercial entities that knowingly and intentionally publish or distribute material on a website, including a social media platform, where more than one-third of the material is sexual material harmful to minors. Covered entities must use reasonable age-verification methods to verify that a person attempting to access the material is at least 18.  

How Many States Now Have Laws

As of September 2026, at least 27 states have enacted laws requiring age verification for access to online pornography, according to current legal trackers. The requirements are not uniform: states differ in the content covered, the verification methods permitted, enforcement mechanisms, and effective dates.  

It is important to distinguish age verification from ID verification. Not every state requires a user to submit a government-issued ID. Depending on the applicable law, permitted methods can include government identification, digital identification, commercial age-verification systems, or other methods meeting the relevant statutory or regulatory requirements. For example, Missouri’s rules provide for digital identification or commercial age-verification systems using government-issued identification or commercially reasonable methods relying on transactional data, while allowing alternative methods under specified conditions.  

The regulatory trend also extends beyond adult content. States have introduced separate legislation concerning minors’ access to social-media platforms and other online services. These measures should be treated as a separate category of online-safety regulation, rather than being counted automatically as adult-content age-verification laws.

Key State Laws to Know

Several states have enacted adult-content age-verification requirements:

• Texas - HB 1181: Enacted in 2023; statutory effective date September 1, 2023. The law requires covered commercial entities to use reasonable age-verification methods for users accessing covered sexual material.  
• Utah - SB 287: Enacted in 2023; its age-verification provisions took effect May 3, 2023. Utah subsequently amended its framework, including legislation enacted in 2026.  
• Virginia - SB 1515: Enacted in 2023 and effective July 1, 2023. It established requirements relating to online publication/distribution of material harmful to minors.  
• Florida - HB 3: Enacted in 2024 and effective January 1, 2025. It established requirements concerning minors’ access to certain online content, including age verification for covered adult websites.  
• Tennessee - SB 1792: The Protect Tennessee Minors Act established age-verification requirements for covered websites containing material harmful to minors. The operative date is reported as January 13, 2025, following litigation concerning the law.  
• Missouri: Missouri’s Attorney General promulgated an age-verification regulation covering commercial websites where at least one-third of the content is pornographic or sexually explicit. The regulation became effective November 30, 2025, and the Attorney General announced it as fully in force on December 1, 2025.  
• West Virginia - HB 4412: The state’s adult-content age-verification requirement became effective June 12, 2026.  
• Wyoming - HB 43: The state’s adult-content age-verification requirement became effective July 1, 2025.  

For companies operating online, this creates a state-by-state compliance environment in which requirements can differ according to the definition of covered content, applicable age-verification methods, enforcement mechanisms, and effective dates.  

US Online Gambling

Online gambling in the United States is governed by a combination of federal and state law. The Unlawful Internet Gambling Enforcement Act of 2006 (UIGEA) does not establish a blanket federal prohibition on all online gambling. Instead, it addresses the acceptance of payments connected to unlawful Internet gambling and operates alongside other federal and state laws.

Consequently, gambling operators must comply with the requirements applicable in each jurisdiction in which they operate. These requirements can include licensing, geolocation, identity and age verification, responsible-gambling measures, and restrictions on which gambling products may be offered.

Minimum-age requirements vary by state and gambling product. For that reason, there is no single nationwide age-verification standard for online gambling. Online casino gambling is generally limited to individuals aged 21 or older in jurisdictions where it is permitted, while some jurisdictions set different minimum ages for sports betting or other forms of gaming.

Australia: A World-First Social Media Minimum Age Law 

Australia has introduced a world-first national minimum-age requirement for social media accounts.

On 10 December 2025, Australia’s social media age restrictions came into effect, requiring age-restricted social media platforms to take reasonable steps to prevent Australians under 16 from creating or keeping accounts.

The law places responsibility on technology companies rather than parents, carers or young people. Under-16s and their parents or carers do not face penalties for accessing age-restricted platforms; platforms, however, can face enforcement action if they fail to take reasonable steps to comply.

The legislation does not prescribe a specific technical solution. Platforms can use different forms of age assurance, including age verification, age estimation and age inference, and eSafety encourages layered approaches that combine different measures across the user journey.

Self-declaration alone is not considered sufficient to meet the legal obligation. eSafety states that platforms should use additional measures to prevent under-16 users from creating or maintaining accounts.

Platforms that fail to take reasonable steps can face court-ordered civil penalties of up to AUD $54.6 million.

Australia has also introduced a broader set of Age-Restricted Material Codes under the second phase of its online safety framework. These codes cover services including search engines, hosting services, app distribution platforms, social media services, relevant electronic services and designated internet services, with different requirements taking effect from December 2025 and March 2026 and some measures commencing later. Importantly, these codes primarily address access to age-restricted material, rather than extending the under-16 social-media account restriction to all of these services.

What Every Compliant Verification Flow Needs

While requirements vary by jurisdiction and industry, several principles appear consistently across major age-assurance and identity-verification frameworks. Building these capabilities into the verification architecture from the start can make it easier to adapt to different regulatory requirements.

1. Document-Based Identity Verification

Government-issued identity documents are an important age-verification method in many regulatory environments, particularly where the service needs stronger evidence of a user’s age or identity. However, they are not the only method recognized by regulators. For example, Ofcom’s guidance identifies photo-ID matching alongside open banking, facial age estimation, mobile-network operator checks, credit-card checks and digital identity services as methods that can potentially provide highly effective age assurance.

Where documents are used, technologies such as optical character recognition (OCR), machine-readable zone (MRZ) parsing and, where supported, NFC chip reading can help extract and authenticate document information. These are technical implementation choices rather than universally mandated regulatory requirements.

A document check establishes information contained in the document, such as date of birth. It does not necessarily establish that the person presenting the document is its legitimate holder. Where stronger identity assurance is required, the document should be linked to the person presenting it. Ofcom’s guidance, for example, describes photo-ID matching as comparing the identity document with an image of the user.

2. Biometric Liveness Detection

Where facial age estimation or photo-ID matching is used, liveness detection can help establish that the biometric sample comes from a live person rather than a photograph, video or other spoofed representation. Ofcom’s current guidance specifically recommends liveness detection when facial age estimation and/or photo-ID matching is used.

Liveness controls can help mitigate presentation attacks such as replay attacks, static-image attacks and other forms of biometric spoofing. The appropriate implementation depends on the use case, risk profile and performance of the overall verification process.

3. Age Estimation as a Complement

The EU's guidelines particularly contemplate that "age estimation methods can complement age verification technologies" and can be used as a temporary alternative, in particular in cases where verification measures that meet the criteria are unavailable. The UK's Ofcom guidance takes a similar position. Age estimation works well as a first-pass filter: users who are clearly adults pass without friction; edge cases trigger a document check fallback.

4. Privacy by Design

Every jurisdiction that mandates age verification also has data protection obligations running alongside it. The GDPR applies across the EU and, in its UK variant, across the UK. Collecting more personal data than is necessary to confirm age creates a second compliance exposure. The EU's blueprint specifically aims to enable age confirmation without transmitting personal data to the platform. Build data minimization into the verification architecture, not as an afterthought.

5. Audit Trails and Ongoing Monitoring

Most gambling regulators require ongoing monitoring, not just a one-time check at registration. Even outside gambling, regulators expect platforms to demonstrate compliance, not just assert it. Verification events, timestamps, method used, and outcome should be logged in a format that supports regulatory audit.

6. Jurisdiction Detection

A user in Texas faces different requirements than a user in Germany or Queensland. A compliant multi-jurisdictional flow detects the user's jurisdiction at the point of access and routes them to the appropriate verification method. This is not optional for businesses with international user bases: a single global flow calibrated to the most permissive jurisdiction will fail in the most restrictive ones.

The Conversion Problem: Why Friction Matters

Compliance teams focus on the legal risk of under-verification. Product teams focus on the commercial risk of over-friction. Both are real.

A verification flow that demands a full document upload for every user in every context will drive abandonment. The regulatory frameworks themselves acknowledge this: Ofcom's guidance explicitly requires that methods be "fair" and respect adult users' rights to access legal content. The EU's guidelines call for methods that are "as non-invasive as possible."

The practical answer is a tiered, risk-based approach. RIsk-based, modular approach allows businesses to apply stronger verification where it matters without unnecessarily adding complexity to every user journey.

Identomat’s modular verification stack is designed around this principle. Businesses can combine ID Verification, Liveness Check, Age Verification, Face Match, AML Screening, Risk Assessment, and Manual Review within configurable workflows and adjust the verification journey according to their business requirements and applicable regulatory obligations.

The result is a verification strategy that balances three objectives: regulatory compliance, fraud prevention, and user experience. Rather than treating verification as a single mandatory step, businesses can build a flexible process in which the level of assurance increases when the risk or regulatory requirement calls for it.

Building for Compliance Across Borders  

The businesses that will navigate this landscape successfully are not necessarily the ones that build the most restrictive verification flows. They are the ones that build the most intelligent ones: flows that know which jurisdiction they are operating in, apply the appropriate standards for that context, collect only the data they need, and maintain audit-ready records.

That requires a platform that can handle document verification across a wide range of ID types, apply biometric liveness at the appropriate assurance level, support jurisdiction-aware workflows, and produce audit-ready records. It also requires a platform that can adapt as the regulatory landscape continues to shift - because it will.

Identomat supports KYC onboarding, biometric liveness (Active, Passive, and Adaptive), document verification across thousands of ID document types from 193+ countries, Face Match, and AML Screening, all through a single API. Identomat’s Adaptive Orchestration layer adjusts verification depth based on risk, geography, and regulatory context, enabling businesses operating across the UK, EU, US, and Australia to configure verification workflows without rebuilding their infrastructure for each market.

If you are mapping your age-verification obligations across jurisdictions and want to understand how a single platform can support your verification needs, the Identomat team will be happy to help.