Photo Credit: Daren Inshape
A major shift has rippled through the United Kingdom’s digital landscape with the full implementation of the Online Safety Act. This legislation marks a new era for age verification across a broad spectrum of major websites—not just those with explicit content.
The Online Safety Act’s centerpiece requires that online services hosting adult or potentially harmful materials establish robust age checks to keep minors out. The law replaces earlier initiatives like the Digital Economy Act and is widely viewed as one of the world’s broadest internet age-exclusion legislation to date.
The Office of Communications (Ofcom) is the primary regulator enforcing these new rules. Under the law, platforms must deploy the most effective available age verification methods, which include facial verification, digital ID uploads, bank or credit card checks, and mobile network verification. This legislation doesn’t just impact websites serving adult content—social media platforms, forums, and even music streaming services now fall under the law’s reach.
The impact for UK internet users is immediate and significant. Attempts to access content flagged as 18+ or otherwise will prompt age verification requests. Sites must deny access—or even block and/or delete accounts—for users unable or unwilling to verify their age. This heavy-handed approach has already driven a surge in VPN downloads in the UK as internet users seek workarounds.
Spotify is the latest major platform to comply with this new UK law. In the UK, Spotify now mandates age verification before users can access certain features or content, such as music videos labeled 18+ by rights holders. The company has partnered with Yoti, a UK-based digital identification firm, to facilitate the checks needed to ensure minors don’t access 18+ content.
Yoti utilizes facial scanning technology or government-issued ID uploads to determine a users age. If a user fails the verification, Spotify’s policy is unequivocal: “You cannot use Spotify if you don’t meet the minimum age requirements for the market you’re in. If you cannot confirm you’re old enough to use Spotify, your account will be deactivated and eventually deleted.”
As quickly as these AI-driven checks rolled out, resourceful UKers have discovered ways to bypass them. The recent video game Death Stranding 2 features actor Norman Reedus with a highly customizable ‘selfie camera’ mode. The in-game character he plays is named Sam and he can be posed with a variety of highly realistic facial expressions. In one demo, after being prompted by the age verification tool to open and close his mouth, simply cycling through Sam’s mocapped facial animations met the requirements for the video selfie to be considered legitimate. This loophole worked with both Discord and Reddit’s tools, but Yoti’s facial recognition is less easy to exploit.
