The ICO has published some interesting information on Age assurance, which references the Online Safety Act. The Introduction in particular makes it clear that age assurance comes with potential problems, including:

---

1. Disproportionate intrusiveness (e.g. processing special category data)

2. Inaccuracy

3. Discrimination (e.g. groups who don’t have access to ID)

So not only do you have to satisfy Ofcom and the OSA, you have to not upset the ICO.

…

There are some sensible suggestions, e.g. by performing extra checks on users whose age estimate is close to the cut-off, which I guess is a bit like Challenge 25 (ask people for proof if they look under 25, anyone who looks older than that is probably over 18).

The ICO also says you MUST allow users to challenge the decision. They also say they don’t expect you to implement age assurance measures which:

* pose a significant and disproportionate economic impact on businesses

https://fosstodon.org/@pwaring/113995839060162279