Why 18, 16 and 13 Need Different Age Checks

One age gate can’t cover an 18-year-old buying wine and a 13-year-old signing up to an app

The same digital sign-up page can meet a 25-year-old placing a bet and a 13-year-old opening a social account inside the same minute. A 17-year-old buying an adult-rated game sits somewhere between them. Treat all of them with a single age check and you either block people you should let through or wave through people the law says you must stop. Effective age verification depends on the number you are checking against, because the legal duty behind each threshold is different.

The UK does not have one age line. It has several, each written into a different statute, each carrying its own penalty for a failed check. This piece walks through the three bands that matter online: the hard 18+ threshold, the awkward 16-to-18 middle, and the under-16 and 13 layer where the picture is still forming.

Why do different ages need different age checks?

Different ages sit under different laws. An 18+ purchase like gambling or alcohol carries criminal liability and demands a decisive pass or fail. The 16-to-18 band has no single online regime and is the hardest range to place accurately. Under-16 and 13 rest mostly on platform terms and anticipated rules, with no settled UK statute yet.

How the hard 18+ line works

Eighteen is the busiest number in UK age law. Several statutes converge on it, and each one attaches real liability to the business that fails the check.

Under the Online Safety Act, a child is anyone under 18. Services that host pornography, or content promoting suicide, self-harm or eating disorders, must apply highly effective age assurance to keep under-18s out. The Part 5 duties began in January 2025 and the Part 3 child-protection duties became enforceable on 25 July 2025 (Ofcom, “Age checks to protect children online”; GOV.UK, “What’s changing for children on social media from 25 July 2025”). This is a pass or fail 18 line with a regulator behind it.

Gambling sits at the same number. For online, remote gambling the minimum age is 18, and operators must verify a customer’s age before they deposit money or place a bet. The Gambling Commission removed the old 72-hour grace period, and that change took effect on 7 May 2019 (Gambling Commission, LCCP consultation response). There is no soft start and no provisional access. Age has to be confirmed up front.

Alcohol runs on the Licensing Act 2003, which makes it an offence to sell to anyone under 18 in England and Wales, with a statutory due-diligence defence for sellers who check properly (legislation.gov.uk, ss.146 and 149). Tobacco and vapes are also at 18 today. From 1 January 2027, the Tobacco and Vapes Act 2026 introduces a rolling age of sale: it will be illegal to sell tobacco to anyone born on or after 1 January 2009, the start of the smoke-free generation (GOV.UK factsheet; legislation.gov.uk).

For the end user, the experience should be short. They confirm they are over 18 once, and they are through. For the business, the stakes behind that moment are criminal liability, licence conditions and regulatory enforcement. That combination is why the 18+ band leans on methods that confirm someone is over 18 decisively rather than approximately.

Why 16 to 18 is the hardest band to check

There is no single UK regime that says “check for 16” online today. That is what makes this band difficult.

Sixteen appears in the law, but mostly as context rather than a verification trigger. The age of consent is 16. The National Lottery moved its minimum age from 16 to 18, with the operator applying it from April 2021 and legal effect from 1 October 2021, a clean example of a 16 threshold being deliberately raised to 18. Sixteen is also the number at the centre of the current social-media debate and the age Australia has legislated, which we come to below.

The practical problem is accuracy near a hard line. The protective threshold that carries liability sits at 18, and the people hardest to place are the ones just below and just above it. A 16-year-old, a 17-year-old and an 18-year-old look close in age, and any estimate returns a range rather than an exact birthday. The standard response is to set a challenge age comfortably above the legal threshold, then route anyone who falls inside that margin to a stronger, confirmatory check. We keep this at the level of principle here. The numbers behind the buffer, and what happens right at the 16-to-18 boundary, are covered in how accurate is age verification, and what happens at the 16-to-18 boundary.

Under 16 and 13: where the rules come from

Most platforms set their minimum age at 13, and that number does not come from UK law. Thirteen comes from platform terms of service, shaped by the US Children’s Online Privacy Protection Act. Separately, the Data Protection Act 2018 sets 13 as the age at which a child can consent to an online service on their own behalf (s.9). That is a data-consent age. It does not restrict access, and the two should not be run together.

The weakness is enforcement. Platforms largely apply the 13 minimum through self-declaration, a date-of-birth box or a tick to confirm age. It is trivial to get past, which is precisely why the “different thresholds need different methods” argument matters. A number is only as strong as the check behind it.

A statutory under-16 minimum for social media does not yet exist in the UK. Australia has legislated one, through the Online Safety Amendment (Social Media Minimum Age) Act 2024, in force from 10 December 2025, and it stands as international precedent while UK law has not moved. The direction of travel in the UK, and what a future under-16 requirement could mean for age checks, is covered in the hub piece, the social media age limit: what’s changing and how age checks would work.

Threshold, legal basis and method fit at a glance

Why the method has to match the threshold

Ofcom sets out seven age assurance methods it considers capable of being highly effective: open banking, photo ID matching, facial age estimation, mobile network operator age checks, credit card checks, digital identity services, and email-based age estimation. Self-declaration is not on the list.

Ofcom also gives four criteria a method has to meet. In its words, a method should be “technically accurate, robust, reliable and fair” (Ofcom, “Age checks to protect children online”). Those criteria are the reason one method does not fit every threshold.

Where the law draws a hard line at 18 with liability attached, the sensible choice is a method that confirms a real identity or a genuine over-18 status: open banking, photo ID matching, a digital identity service, or a credit card check. Facial age estimation earns its place at wide gaps and low-friction first-line filtering, and near a hard 18 line it works with a challenge-age buffer and a fallback route. Mobile network operator checks give a binary over-18 signal. Email-based estimation offers the lowest assurance of the seven. Match the method to the duty and the check holds. Apply one method everywhere and it will be too heavy for a first-line filter or too light for a criminal-liability threshold.

The person being verified gets proportion in return. A 13-year-old opening an app should not face a bank-grade identity check, and someone depositing money to gamble should not be waved through on a self-declared date of birth.

Where multi-method routing fits

Getting this right across a whole user base means having more than one method available and the logic to choose between them. That is the case for orchestration.

OneID, a UK digital verification services provider, runs one API across bank-verified identity, document authentication, on-device facial age estimation via Regula, liveness, mobile network operator age checks, reusable digital wallet credentials and international electronic IDs, with fallback routing between them. It covers five of Ofcom’s seven highly effective methods: open banking, photo ID matching, facial age estimation, mobile network operator checks and digital identity services. As a DVS-certified provider, it can apply a light first-line check where the risk is low and step up to a confirmed-identity check where the law demands it, all from a single integration. The threshold decides the method. The routing makes that decision every time without sending every user down the heaviest path.

Two further questions follow naturally from here. Whether a person can prove their age without handing over their full identity is covered in can you prove your age without handing over your ID?. And the difference between the terms themselves, age assurance, age verification and age estimation, is set out in age assurance vs age verification vs age estimation.

Frequently asked questions

Why can’t one age check cover every threshold? Because the legal duty changes with the number. An 18+ gambling or alcohol sale carries criminal liability and needs a decisive pass or fail, while a 13 platform minimum rests on terms of service. A single method is either too heavy for the low-risk case or too light for the high-liability one.

Is there a UK law banning under-16s from social media? Not currently. A statutory under-16 minimum for UK social media does not yet exist. Australia has legislated one, in force from 10 December 2025, which stands as international precedent. In the UK no statutory under-16 minimum is in force yet, though the direction of travel points that way.

Why do platforms use 13 as a minimum age? The 13 minimum comes from platform terms of service, shaped by the US Children’s Online Privacy Protection Act, rather than UK statute. Separately, the Data Protection Act 2018 sets 13 as the age a child can consent to an online service. Most platforms enforce their 13 rule through self-declaration, which is easy to bypass.

What age do you have to be to gamble online in the UK? Eighteen. For online, remote gambling the minimum age is 18, and operators must verify a customer’s age before they deposit money or place a bet. The Gambling Commission removed the previous grace period with effect from 7 May 2019.

What is changing for tobacco and vape age checks? Tobacco and vapes are sold at 18 today. From 1 January 2027, the Tobacco and Vapes Act 2026 introduces a rolling age of sale, making it illegal to sell tobacco to anyone born on or after 1 January 2009. Over time this moves the sale of tobacco beyond a fixed 18 line.

Which methods does Ofcom consider highly effective? Seven: open banking, photo ID matching, facial age estimation, mobile network operator age checks, credit card checks, digital identity services, and email-based age estimation. Self-declaration is not among them. Ofcom also expects each method to meet its four effectiveness criteria.