Ofcom Investigate TikTok Over Weak UK Internet Age Verification Measures

Popular video streaming site TikTok, which can be used by those who are 13 years of age or older (18+ for livestreaming), appears to have landed itself in hot water with Ofcom’s enforcement of the UK’s Online Safety Act (OSA) over their use of “age inference” technology to identify the age of their users (i.e. this is not something the regulator considers to be “highly effective” for age verification).

The focus around the regulator’s requirement for “highly effective” age verification is often expressed as being something targeted more towards porn and other “harmful” adult content. But in reality, the new requirements also stretch to almost “all user-to-user and search services” in scope of the act (e.g. social media, online forums, tube sites, cam sites, and fan platforms) – both big and small sites alike. Only a few exceptions exist.

The regulator’s related guidance sets out how the legal duty works and makes clear that any age-checking methods deployed by services must be “technically accurate, robust, reliable and fair” in order to be considered “highly effective“. But TikTok currently uses a type of age assurance known as “age inference“, which involves analysing a user’s activity and behaviour on a platform to estimate whether they are a child or an adult (as well as just asking them to input their date of birth).

The problem for TikTok is that age inference is not included in Ofcom’s industry guidance as a method that is capable of being highly effective for this purpose. “Our Age Assurance report published today also raises serious doubts about the effectiveness of some of these models. Our evidence suggests that, in some cases, age inference methods may be failing to correctly detect significant numbers of children, putting them at risk of exposure to harmful content,” said the regulator.

In response Ofcom has opened a new investigation to establish whether TikTok’s age checks are effective in preventing children from encountering harmful content on its platform.

Ofcom Statement

The opening of an investigation does not mean that Ofcom has reached any conclusion about whether the provider has breached its duties. However, where we identify compliance failures, we can impose fines of up to £18m or 10% of qualifying worldwide revenue (whichever is greater).

In the most serious cases of non-compliance, and where appropriate given risks of harm to individuals in the UK, we can seek a court order to require third parties to take action to disrupt the business of the provider. This may require third parties (such as providers of payment or advertising services, or Internet Service Providers) to withdraw services from, or block access to, a regulated service in the UK.

The move isn’t all that surprising as the OSA tends to be targeted towards the largest social media platforms and TikTok are certainly in that grouping. On the other hand, big questions remain over the credibility of age verification requirements in general, not least in terms of the fact that such providers are often unregulated (i.e. can you really entrust your private details to them) and it raises the risk from data breaches.

Back in 2023 the European Policy Information Center (EPICENTER) published a report that summed up some of these challenges quite nicely, not least by highlighting the tendency of politicians to “promise the impossible without fully understanding the dynamics of what they are trying to regulate and without giving sufficient consideration to the side-effects of the proposed solutions.”