Which Countries Require Age Verification? 2026 Laws by Country, Platforms and Trade-offs

Two years ago, most websites asked for your age with a single drop-down menu and believed whatever you chose. That model is ending. Since July 2025 the UK has required "highly effective" age checks, Australia has barred under-16s from major social platforms, more than 25 US states have required age verification for adult sites, and the European Commission has proposed banning self-declared ages altogether.

This brief covers the laws in force and in progress as of late October 2026, how the largest platforms now check age, what the evidence says about whether it works, whether users can avoid it, and the trade-offs for privacy and free expression. Every figure links to a source at the end of the article. Where sources conflict or a claim rests on a single report, we say so or leave it out.

The Global Map at a Glance

Why This Matters Now

Three shifts happened between mid-2025 and late 2026:

Verification, Estimation, Assurance: The Terms

Regulators use three terms that are often confused:

• Age verification confirms age against an authoritative record, such as a passport, driving licence, bank or mobile operator.
• Age estimation infers a likely age, usually from a face scan or from account behaviour, and returns a probability rather than a fact.
• Age assurance is the umbrella term for both. The UK's standard is "highly effective age assurance". The EU's guidelines require methods that are accurate, reliable, robust, non-intrusive and non-discriminatory.

Self-declaration, where a user types a birthdate, does not count as age assurance in the UK, Brazil or under the proposed EU KIDS Act.

United Kingdom

The Online Safety Act 2023 made "highly effective age assurance" mandatory on 25 July 2025 for services that host pornography or other content Ofcom classes as harmful to children. Ofcom lists methods that can qualify: open banking, photo-ID matching, facial age estimation, mobile operator checks, credit card checks, digital identity services and email-based age estimation. Self-declaration, debit cards and terms-of-service clauses do not qualify. Fines can reach £18 million or 10% of qualifying worldwide revenue, whichever is greater, and Ofcom can ask courts to block non-compliant services.

Enforcement has so far focused on smaller adult sites and forums. Ofcom's June 2026 bulletin listed fines including £800,000 for Kick Online Entertainment (motherless.com), £600,000 for Youngtek Solutions, £540,000 for 4chan and £950,000 for a suicide forum. Two larger cases opened after that:

• TikTok (July 2026). Ofcom is examining whether TikTok's behavioural age inference is effective enough. TikTok says it complies.
• Aylo, owner of Pornhub (September 2026). Aylo blocked new UK visitors in February 2026, then in May restored access only for iPhone users whose adulthood Apple had confirmed at device level. Ofcom is investigating whether Aylo tested that signal adequately, saying some of its own tests let children through.

Ofcom's first statutory report on age assurance (July 2026) found that more than 69 million age checks were completed across 32 services in the second half of 2025. The share of children who faced a highly effective check when asked to verify rose from 25% to 43%. Ofcom also said it has "serious doubts" about some age inference models, and that no single method stops circumvention. It called for a layered approach covering apps, app stores, operating systems and devices.

The next step is larger. On 15 June 2026 the government confirmed an under-16 social media ban covering Snapchat, TikTok, YouTube, Instagram, Facebook and X, with WhatsApp, Signal and YouTube Kids excluded. The legal basis is a new section 214A of the Online Safety Act, inserted by the Children's Wellbeing and Schools Act 2026. A House of Commons Library briefing (October 2026) says the ban is expected from spring 2027, with regulations to be voted on by the end of 2026.

Australia

Australia's Social Media Minimum Age law took effect on 10 December 2025. Ten platforms must take "reasonable steps" to stop under-16s holding accounts: Facebook, Instagram, Threads, Snapchat, TikTok, YouTube, X, Reddit, Kick and Twitch. Messaging and gaming services such as Discord and Roblox are excluded. Children and parents face no penalty. Platforms face up to A$49.5 million per breach, and a 2026 bill to strengthen enforcement would double that ceiling and add compulsory evidence-gathering powers.

Platforms restricted about 4.7 million accounts in the first weeks. eSafety stressed that these are accounts, not unique children. Meta reported more than 750,000 removals by June 2026. eSafety's three-month evaluation, which surveyed 4,121 young people aged 10 to 16, found:

In March 2026 eSafety opened investigations into Facebook, Instagram, Snapchat, TikTok and YouTube. It cited children being allowed to retry age checks until they passed, and weak controls on new accounts. On 20 October 2026 the Communications Minister said eSafety is gathering evidence for Federal Court proceedings against all five. No penalty has yet been imposed under the law. Reddit and the Digital Freedom Project have challenged the law in the High Court.

Separately, an industry code required search engines to age-assure signed-in users by 27 June 2026 and apply the strictest safe search to likely minors. Signed-out users are not checked, but explicit images are blurred by default.

European Union and Member States

Article 28 of the Digital Services Act requires platforms accessible to minors to take "appropriate and proportionate" measures for their safety, but sets no minimum age. The Commission's July 2025 guidelines on protecting minors spell out what that means for age assurance. In April 2026 the Commission issued preliminary findings that Meta breaches the DSA by not keeping under-13s off Facebook and Instagram, where it estimates 10–12% of EU under-13s are active. A final decision could carry a fine of up to 6% of global turnover.

The Commission launched its age verification app in April 2026. It uses zero-knowledge proofs, so a user can prove they are over a threshold without revealing who they are. Security researchers reported flaws shortly after launch. A Commission recommendation asks member states to deploy it, either on its own or inside the EU Digital Identity Wallet, by 31 December 2026.

On 17 September 2026 the Commission proposed the EU KIDS Act. It is a proposal, not law, and commentators do not expect it to apply before about 2028. As drafted it would:

• bar social media accounts for children under 13, except guardian-managed children's video services;
• give 13 and 14-year-olds supervised accounts capped at one hour a day, with parents approving contacts;
• allow independent accounts from 15;
• ban self-declared ages and require EU-certified age verification;
• extend safety-by-design duties to games, AI chatbots and app stores, with fines of up to 6% of global turnover.

Member states are moving at different speeds:

United States

The legal turning point was Free Speech Coalition v. Paxton, decided on 27 June 2025. By 6 to 3, the Supreme Court upheld Texas's law requiring adult sites to verify age. It applied intermediate scrutiny rather than strict scrutiny, reasoning that the law only incidentally burdens adults' protected speech. Justice Kagan dissented, joined by Justices Sotomayor and Jackson. After the ruling, trackers count about 25 to 27 states with porn-site age verification laws. Aylo has responded by blocking Pornhub in many of them rather than verifying users.

The newer laws target app stores:

• Texas SB 2420 requires app stores to verify age and get parental consent for minors. A federal court blocked it in December 2025. The Fifth Circuit stayed that injunction in mid-2026, and the Supreme Court declined to intervene on 6 July 2026, so the law is now enforceable while the appeal continues.
• Utah, Louisiana and Alabama have similar laws. Their main duties now start in 2027.
• California AB 1043, operative from 1 January 2027, takes a lighter approach. The operating system asks for an age at device setup, without verifying it, and passes an age bracket (under 13, 13–15, 16–17, 18+) to apps. Apple, Google and Meta supported it.

State social media laws are more contested, because they require checking every user rather than visitors to adult sites. Florida's HB 3 (no accounts under 14) is enforceable after an appeals court lifted an injunction in November 2025. Mississippi's HB 1126 is in effect while litigation continues; Bluesky blocked the state in response. Laws in Georgia, Louisiana, Arkansas, Colorado and Virginia remain blocked, according to a June 2026 Loeb & Loeb survey.

At the federal level, the House passed the KIDS Act on 29 June 2026, and the Senate Commerce Committee advanced KOSA in August 2026. The two bills differ on a "duty of care" and on overriding state law, and neither has become law.

Brazil, India, Asia-Pacific, and Canada

How Platforms Check Age Today

Most large platforms now use a cascade. They first try to infer age from data they already hold. If that is inconclusive, or a user wants to unlock adult features, they ask for a face scan, and fall back to ID or a card. The face scan and ID check are usually run by a third-party vendor such as Yoti, Persona or k-ID.

Two patterns stand out. First, platforms increasingly default unverified users to the restricted experience. Discord's teen-by-default settings, ChatGPT's under-18 mode when age is uncertain, and Apple's UK content filters for unconfirmed users all put the burden on adults to prove their age. Second, the operating system is becoming the checkpoint. Apple's Declared Age Range API and Google's Play Age Signals API return an age band without a birthdate, ID or face scan. Aylo, Meta and the Free Speech Coalition have lobbied for this model. Age verification vendors oppose it, and Google has resisted being held liable for OS-level checks.

The Methods Compared

On facial estimation accuracy: Yoti's own July 2025 white paper reports a mean absolute error of 1.1 years for 13 to 17-year-olds and 2.4 years across ages 6 to 70. NIST's independent evaluation (2024, updated through 2026) found that no algorithm performed best in every condition, and that error was consistently higher for female faces and varied by region of birth. Average error also hides the case that matters most: a 17-year-old estimated as 20 passes a check meant to stop them. Regulators therefore recommend a buffer, such as requiring an estimated age of 21 or 25 before skipping a second check.

On the double-blind model: France's CNIL designed it so the website learns only "over 18" and the verifier learns who you are but not which site asked. The EU app and Google's open-source longfellow-zk library apply the same idea with zero-knowledge proofs. Commentators note this is "double confidentiality" rather than true anonymity, because the credential issuer still knows your identity.

Does It Work? What the Data Shows

The honest answer is: partly, and less than headline numbers suggest.

The pattern across studies is consistent. Checks reliably reduce traffic to the compliant services that implement them. They are much less effective at reducing what a determined user, child or adult, can reach elsewhere.

Can You Avoid It?

This is the question most readers ask, so here is a direct answer for each situation.

On a compliant platform, mostly no

If a platform is legally required to check your age, it will restrict features until you comply. You can decline, but you will usually get the teen experience, lose access to some content, or be locked out. Appeals generally require more data, not less. Several platforms also re-check users whose behaviour suggests a different age.

VPNs: legal, common, and imperfect

VPN demand surged when checks began. Proton VPN reported UK sign-ups up more than 1,400% on 25 July 2025, and VPN apps briefly topped the UK App Store. Ofcom found that 25% of UK children aged 11 to 17 had used a VPN in the six months to March 2026, though only a small share said they used it to reach age-restricted content. In the UK, EU, US and Australia, using a VPN is legal for adults. The UK government told Parliament it is not considering a VPN ban. Ofcom has said platforms must not encourage VPN use to get around checks.

There are limits to keep in mind:

• A VPN changes location, not account history. Platforms that use account-level inference, such as YouTube, Meta or ChatGPT, and app-store laws tied to account region apply regardless of IP address.
• Free VPNs and non-compliant sites carry their own risks. Some free VPNs log and sell traffic, and sites that ignore age rules are more likely to ignore other safety and privacy rules.
• The legal position may change. Wisconsin lawmakers removed a VPN-blocking provision from a 2026 bill after public backlash, and a Michigan bill that would require ISPs to block VPNs has not advanced. Both show that lawmakers are watching VPN use.

Other workarounds are unreliable

In July 2025, PC Gamer confirmed that users could pass Discord's face check with a character from the video game Death Stranding. Children have also reported using borrowed IDs, fake birthdates and a parent's face. Tricks like these spread quickly but tend to be short-lived, and platforms such as Roblox now re-check accounts whose behaviour does not match their verified age.

What you can control: reduce what you hand over

For adults who have to verify, the realistic goal is to minimise the data that leaves your hands:

Pros and Cons

The debate is not simply safety versus privacy. Many child-safety groups also question blanket bans. Ian Russell, whose daughter Molly's death led to the founding of the Molly Rose Foundation, called the UK's under-16 ban a "rush job"; the foundation argues that platform design duties matter more than blanket bans. Several privacy groups, in turn, accept age checks for adult sites but oppose checking every user of general-purpose platforms.

What Good Age Assurance Looks Like

If age checks are here to stay, the design choices determine how much harm they cause. Drawing on CNIL, ICO, Ofcom and Internet Society guidance, a defensible system should:

What It Means for Private Messaging

Most of these laws treat private messaging differently from public social media. The UK's planned under-16 ban excludes WhatsApp and Signal, Australia's law excludes messaging services, and New Zealand's bill does the same. Lawmakers have generally accepted that one-to-one and small-group communication is not the same as algorithmic feeds open to strangers.

That distinction matters for how communication tools are built. At Lupyd, we build an end-to-end encrypted workspace where messages are encrypted with the Signal Protocol and MLS, keys stay on users' devices, and there are no ads or behavioural profiles. The lesson from the age verification debate applies to any service: the data you never collect cannot be breached, subpoenaed or misused. Where age checks are required, the privacy-preserving designs described above should be the default, not an option.

Frequently Asked Questions

The Bottom Line

Age verification has moved from a niche rule for adult sites to a default expectation across social media, app stores and AI services. The UK and Australia show that it changes behaviour on compliant platforms, and also that it pushes some users elsewhere and leaves many children online. The decisive question for the next two years is not whether checks happen, but how they are built: as identity collection that will eventually leak, or as privacy-preserving proofs that reveal only what is needed.

For users, the practical advice is to pick the least invasive method each platform offers. For builders, it is to treat every piece of identity data as a liability, and collect as little as the law allows.

Last updated: 4 November 2026. This article is general information, not legal advice. Several laws described here are under legal challenge or still in draft, and platform policies change often; check primary sources before relying on any detail.