Ofcom Targets TikTok's Age Checks

The UK's communications regulator, Ofcom, has launched a formal investigation into TikTok's age assurance practices, marking one of the first major enforcement actions under the Online Safety Act. The probe will examine whether TikTok has met its legal obligations to protect children from harmful online content.

At the center of the investigation is TikTok's use of age inference, an AI-driven technique that estimates a user's age based on behavioral patterns and account activity rather than verified identity checks such as government-issued IDs or facial age estimation. Ofcom is assessing whether this approach provides adequate protection for minors.

The investigation follows Ofcom's first Age Assurance Report, which concluded that age inference technologies may fail to identify a significant number of underage users. The regulator has made it clear that age inference alone does not qualify as a "highly effective" age assurance method and has urged platforms to adopt stronger verification technologies.

The action also follows troubling findings from Ofcom's recent children's online safety report, which revealed that 73% of children aged 11 to 17 encountered harmful content within a four-week period. More than half of those exposed to such content reported seeing it on TikTok, placing additional pressure on the platform to strengthen its child safety measures.

TikTok maintains that it complies with UK regulations through advanced, expert-informed age detection technologies. However, if Ofcom ultimately finds the platform in breach of the Online Safety Act, it could impose penalties of up to £18 million or 10% of TikTok's global annual revenue, whichever is greater, and in extreme cases seek court orders restricting the platform's UK operations.

Beyond TikTok, the investigation is expected to set an important precedent for the technology industry. A ruling against age inference could effectively discourage platforms from relying on behavioral profiling and accelerate adoption of stronger age verification methods, including biometric age estimation and government-issued identity verification.

The case also reignites the debate between privacy and child protection. While age inference is less intrusive than collecting identity documents or biometric data, regulators increasingly argue that privacy-friendly methods must also demonstrate reliable protection for children. Ofcom's decision is therefore likely to shape the future of age assurance standards not only in the UK but across the global digital ecosystem.