What UK Online Safety Act age verification duties mean for platforms hosting AI imagery of real people: duties, Ofcom powers and what to build.
Photo via Unsplash
If you run a platform where users see AI-generated imagery of real people, the UK Online Safety Act age verification duties are not a future problem. Ofcom has enforcement powers, the age-assurance expectations are live, and the penalties are calculated on worldwide revenue.
This deep-dive sets out which duties actually bite, what "highly effective" means in practice, and what a compliant architecture looks like when the content in question is generated rather than uploaded. It is written from the perspective of building one — LikeWard's age assurance gate and reporting route exist because of the analysis below.
Key takeaways
- Scope is about links with the UK, not where you are incorporated.
- Age assurance must be highly effective: accurate, robust, reliable and fair. A date-of-birth box is none of those.
- Fines reach £18m or 10% of qualifying worldwide revenue — plus business disruption powers aimed at your payment providers.
- Synthetic content is not out of scope. The Act cares what users encounter.
- Provenance records make the reporting and removal duties tractable rather than forensic.
The Online Safety Act 2023 regulates two broad categories: user-to-user services, where content generated by one user may be encountered by another, and search services. A third set of duties applies to services publishing pornographic content.
A likeness marketplace usually lands in the first category and often the third. A fan commissions an image; the image is stored, viewable, sometimes shareable. That is user-encountered content, whatever produced the pixels.
The jurisdictional hook is "links with the United Kingdom". A significant number of UK users, or the UK as a target market, is enough. Founders sometimes assume a US entity and US hosting keeps them out. It does not, and Ofcom has said so repeatedly.
Four, in rough order of how much engineering they imply:
Illegal content duties. Take proportionate steps to prevent users encountering priority illegal content, and to remove it swiftly once aware. For a generation platform this argues strongly for refusal before production rather than moderation afterwards — you cannot let something be encountered and then claim you prevented it.
Children's safety duties. If children can access the service, assess and mitigate the risk of harmful content. The cheapest mitigation is often making the service genuinely inaccessible to children, which routes straight back to age assurance.
Risk assessment and record-keeping. Written, kept current, produced on request. This is the duty most often skipped by small teams and it is the easiest one for a regulator to check, because either the document exists or it does not.
Reporting and complaints. An easy-to-find, easy-to-use route for users and affected non-users to report content. That last part matters: the person depicted may have no account. LikeWard's takedown route accepts reports with no account and no API key for exactly this reason.
The Act does not name approved vendors. Ofcom's framing is outcome-based, resting on four properties: technically accurate, robust, reliable and fair.
| Method | Meets the bar? | Practical note |
|---|---|---|
| Self-declared date of birth | No | Fails every one of the four criteria. |
| Credit card check | Generally capable | Age-gated instrument; watch fairness for the unbanked. |
| Facial age estimation | Generally capable | Needs published accuracy data and bias testing. |
| Photo ID verification | Generally capable | Highest friction; strongest evidence. |
| Mobile network operator check | Generally capable | Depends on the operator's own age flag. |
| "Are you 18?" checkbox | No | Not assurance in any sense. |
Table: age-assurance approaches against Ofcom's four-part test. Capability is not the same as compliance — an approach only qualifies if implemented and evidenced properly.
Two implementation points worth stating. First, assurance is about the account, not the request — checking once and then trusting a session forever is a gap. Second, fairness is a real criterion, not a footnote: an approach that works poorly for particular groups is a problem, not an acceptable trade.
On LikeWard, generation refuses with age_verification_required when the requesting account is unverified. It is a fail-closed default: no verification, no output, regardless of what the creator has licensed.
The Act brought intimate image abuse offences into the priority illegal content regime, and the UK has continued to legislate in this area since — the direction of travel is unmistakably towards treating synthetic intimate imagery of an identifiable person as equivalent to the real thing.
For platform builders the practical reading is simple. "It was AI-generated" has never been a defence anyone should have relied on, and it is decreasingly one now. Design as though a synthetic image of a real person carries the same duties as a photograph of them, because that is where the law has been heading for three years.
This is why LikeWard's four platform prohibitions — minors contexts, non-consensual framing, deceptive news contexts, criminal contexts — are non-waivable. No creator can license them, no boundary set can enable them, and they are evaluated before every other rule including the age gate.
The headline is £18 million or 10% of qualifying worldwide revenue, whichever is greater. Senior managers can face liability for specific failures around information notices.
But the fine is not the sharpest instrument. Ofcom holds business disruption powers: it can require payment and ancillary service providers to withdraw from a non-compliant service, and seek access restrictions in serious cases.
Our compliance desk's summary:
"A fine is a number you argue about for two years. Losing your acquirer is a Tuesday afternoon. Every operator we talk to understands the second one immediately."
That connects directly to the card networks' own documented-consent requirements, which we cover in the card network consent rules guide. The regulatory and commercial pressures point at the same artifact.
Concretely, for a generation platform:
If you serve both markets, you are meeting the UK's age-assurance and risk-assessment regime and the US TAKE IT DOWN Act notice-and-removal duty, which is enforced by the FTC on a 48-hour clock. We covered that in the TAKE IT DOWN Act compliance guide.
The good news is that the same underlying record satisfies both. The bad news is that neither regime accepts a policy document as evidence of capability. You need the pipeline to exist.
Treating age assurance as a signup step. It is an ongoing property of the account, and re-verification points matter.
Assuming synthetic content is a different category. It is not, and arguing that it is will not go well.
No route for non-users to report. The depicted person frequently has no account. If reporting requires one, your reporting duty is not met.
Moderating after generation. Once a user has encountered it, prevention did not happen.
No written risk assessment. The cheapest duty to discharge and the most commonly missing.
Relying on the creator's consent as a complete answer. Consent addresses whether the depiction was permitted. It says nothing about whether a child accessed the service or whether reports get answered.
Next in this cluster: the card network consent rules guide for the commercial side of the same requirement, the age verification law round-up for what is changing elsewhere, and content provenance explained for the record-keeping that makes all of it workable. LikeWard's own position is summarised on the compliance page.