The most contentious aspect of the government’s Bill C-34 social media ban for under-16s is that millions of Canadians will need mandated age verification to create social media accounts. The bill tacitly acknowledges that this raises privacy concerns, as it includes a mandatory consultation with the Privacy Commissioner and leaves the future Digital Safety Commission to set the necessary standards. But as I wrote in June, the problem is that the government plans to bring the ban into force before the Commission even exists, meaning the age verification will proceed without established standards or the privacy consultation the bill itself requires. The United Kingdom, which is pursuing a similar ban with a spring 2027 start date, has adopted the opposite approach by asking Ofcom, its regulator, to assess what effective age verification would look like before Parliament sets the rules. The resulting report, released this week, is the most candid regulatory account of a social media ban to date. Ofcom identifies four methods capable of establishing whether someone is 16 or over and it finds that each of them requires using photo ID either directly or as the backstop given the ineffectiveness of age estimation for younger users.

The report distinguishes between what technologies work for under-16s and for those under-18. For under-16 cohort, Ofcom identifies four approaches: photo ID matching, digital identity services, banking-based checks, and facial age estimation. The three additional methods it accepts for those under-18 (credit card checks, mobile operator checks, and email-based age estimation) do not work for those under-16. Ofcom also notably rejects using parental consent as a model, citing evidence that “some parents may provide incorrect age information for the purpose of assisting children to circumvent age restrictions.”

Ofcom’s summary explains why photo ID is essentially unavoidable for teenagers:

16- and 17-year-olds are more likely than over-18s to need access to a photo ID and those without would likely need to take steps to obtain one to access age-restricted services. This is because, of the methods identified in this rapid assessment for highly effective age assurance at 16, photo ID is either required as part of the method itself, or as the likely backstop for other methods, such as facial age estimation.

All require documents, except for facial age estimation. However, since even the best algorithms have an error rate of nearly two years for teenagers, a 15 year old can easily be estimated as being 17. Therefore, Ofcom establishes a “challenge age” set above the threshold that goes beyond age estimation, concluding that the challenge age “would likely need to be over 18 for the 16 age gate, meaning 16- to 17-year-olds would likely need to prove their age using age verification.” In other words, teenagers will require verification that relies on photo-based documents.

Ofcom estimates that 94 per cent of people aged 16 and over in the UK hold a passport or a drivers licence, but those numbers drop dramatically in less affluent areas and leaves around 150,000 16 and 17 year olds without any relevant document. The regulator also acknowledges that many adults will have to prove their age to use social media services, since the only way to keep under-16s out is to age verify everyone. While it insists that age verification “can be delivered in a way that protects users’ privacy and complies with data protection law,” the system is still likely to require many adults to provide identity documents, conduct facial scans, or hand over financial and account data to verification vendors.

Once the system is fully established, Ofcom admits that “no age assurance method is completely robust against circumvention by children” and predicts that circumvention rates will rise once the social media ban is in place, resulting in more account sharing and more adult-assisted workarounds. In fact, its own research found that a quarter of children had used a VPN in the previous six months. To counter circumvention, it hopes to rely on user reporting, location tracking to detect VPN usage, and age inference models that profile user behaviour to identify accounts that belong to underage users. This despite the fact that the UK’s privacy regulator warns that inference “should not be used to make up for a weak or non-existent age gate.”

None of this will surprise anyone who has paid attention to the age verification issue, as it is widely accepted that the technologies carry real privacy risks. Yet the difference between the Canadian and UK approaches shows how seriously each country takes those risks. When the UK government announced its ban in June, it immediately asked Ofcom to assess the technology and committed to regulations, detailed guidance, and an impact assessment before the ban takes effect. While Canada’s Bill C-34 contains the structure for a comparable process, the government’s stated plan is to bring the ban into force before any of the safeguards or standards exist.

The government’s Charter statement defends the age verification requirement by pointing to the Section 27(2) conditions on collecting and destroying personal information and to the continued application of privacy law. But the Ofcom study shows what a proper assessment involves and points to the need to do the work before the ban takes effect. To do otherwise invites a constitutional challenge, since it would require tens of millions of Canadians to verify their age to use social media services without technical standards, the required privacy consultation, or an operational Commission to assess compliance.