Report on social media age assurance trial says there is not a one-size-fits-all solution

The government’s trial has found age-assurance for its under-16 social media ban can be done effectively and protect privacy but there is not a one-size-fits-all model.

The report, from an independent company and released in full, also warns continued vigilance is needed on privacy and other issues.

It found some providers, in the absence of guidance, were collecting too much data, over-anticipating what regulators would require.

The ban on under 16s having their own social media accounts has been passed by parliament and comes into effect in December. It covers a wide range of platforms, including Facebook, Instagram, TikTok, X, and YouTube (which was recently added).

The measure is world-leading, and has been very controversial. One issue has been the degree of likely reliability of age verification.

The trial looked at various age assurance methods including AI, facial analysis, parental consent and identity documents. The methods were judged on accuracy, usability and privacy grounds.

More than 60 technologies were examined from 48 age assurance vendors.

The report concluded age assurance systems “can be private, robust and effective”. Moreover there was “a plethora” of choices available for providers, and no substantial technological limitations.

“But we did not find a single ubiquitous solution that would suit all use cases, nor did we find solutions that were guaranteed to be effective in all deployments.” Instead, there was “a rich and rapidly evolving range of services which can be tailored and effective depending on each specified context of use”.

The age assurance service sector was “vibrant, creative and innovative”, according to the report, with “a pipeline of new technologies”.

It had a robust understanding of the handling of personal information and a strong commitment to privacy.

But the trial found opportunities for technological improvements, including ease of use.

On parental control systems, the trial found these could be effective.

“But they serve different purposes. Parental control systems are pre-configured and ongoing but they may fail to adapt to the evolving capacities of children including potential risks to their digital privacy as they grow and mature, particularly through adolescence.

"Parental consent mechanisms prompt active engagement between children and their parents at key decision points, potentially supporting informed access.”

The trial found while the assurance systems were generally secure, the rapidly evolving threat environment meant they could not be considered infallible.

They needed continual monitoring, improvement and attention to compliance with privacy requirements.

Also, “We found some concerning evidence that in the absence of specific guidance, service providers were apparently over-anticipating the eventual needs of regulators about providing personal information for future investigations.

"Some providers were found to be building tools to enable regulators, law enforcement or Coroners to retrace the actions taken by individuals to verify their age which could lead to increased risk of privacy breaches, due to unnecessary and disproportionate collection and retention of data.”

Communications Minister Anika Wells said: “While there’s no one-size-fits-all solution to age assurance, this trial shows there are many effective options and importantly that user privacy can be safeguarded”.