Smile, Then Delete: How to Pick UK Age Checks That Ask for Less

Why you're being asked to prove your age

Since the Online Safety Act started to bite, age checks have moved from the edge of the internet to the middle of it. Ofcom's codes have pushed services to introduce age assurance for content that is not suitable for children, and by 2026 the prompt is familiar: a selfie, a passport photo, a bank card, or a digital identity wallet.

The privacy question is not whether age checks should exist. It is what happens to the data you hand over, and whether the service really needs all of it. A proof-of-age check should answer one question: are you old enough? It should not become a miniature identity interview.

The main flavours of age check

There are roughly five routes you will see.

Facial age estimation uses a selfie and an algorithm to estimate your age. Good versions run on your device, delete the image quickly and do not create a reusable face template. Less good versions upload the image, keep it for 'security' and share it with unnamed partners.

ID upload asks for a passport, driving licence or similar document. It is accurate, but it is also the most revealing option. You are handing over your name, date of birth, photo, document number and sometimes your address.

Credit card or bank account checks prove you are over 18 by checking a financial product. They reveal less about your face, but they still link the check to a financial relationship.

Digital ID wallets and reusable age tokens are the ones to watch. A trusted provider verifies you once and issues a proof that you are over 18, without passing your date of birth or document image to every site you visit.

What happens to your selfie

A selfie scan sounds casual. It is still personal data, and if the provider uses it to identify you rather than simply estimate your age, it can be biometric data with extra legal protection.

The best privacy design is local. The image is processed on your phone, a yes-or-no result is sent to the site, and the image is discarded. The next best is a cloud service with a clear, short retention period and no secondary use. The worst is a service that keeps your selfie 'to improve the model' or 'for fraud prevention' without saying how long that lasts or who gets to see it.

Ask three questions: where is the image processed, how long is it kept, and is it used for anything other than the age check? If the privacy notice cannot answer those in plain English, treat that as a warning.

What happens to your ID

Uploading a passport to a website you visited five minutes ago is a big ask. A reputable age-verification provider should check the document, confirm it is genuine, and then delete it or store it only as long as necessary. Some services keep a hash or a verification token rather than the document itself. That is better.

The red flags are familiar. The site asks for your full address when it only needs your age. It wants a phone number for marketing. It keeps your ID 'for account security' with no deletion date. It shares data with 'trusted partners' you have never heard of. It asks you to upload a document and a selfie and then hands you a cookie banner that makes opting out feel like a puzzle.

Under UK GDPR, the provider needs a lawful basis, a clear purpose and a retention period. It should be able to explain whether it is acting as a controller or a processor. If it is handling biometric data, it should have a data protection impact assessment and a strong reason for doing so.

Over-collection is the thing to spot

The least revealing age check is the one that collects the least. You do not need to become a privacy lawyer to spot over-collection. Look for a service that asks for more than your age, keeps data longer than the check, or makes you create an account when a one-off token would do.

Watch out for checks that require social media login, access to your contacts, or a scan of your driving licence when a simple age-estimation selfie would work. Watch out for sites that use age verification as a data collection exercise. If the privacy notice is longer than the check itself, that is not a good sign.

Picking the least revealing route

Start with the method that reveals the least. A local, on-device age estimation that deletes the image is usually better than an ID upload. A reusable digital ID token is often better than repeating the same check on every site. A credit card check may be less sensitive than handing over your passport, depending on what you are trying to protect.

Use an alias email if you can. Say no to marketing. Check the retention period before you upload anything. If a service offers a choice, pick the option that does not store your document. If it does not offer a choice, ask why.

None of this is about dodging age checks. It is about making them proportionate. You can prove you are old enough without handing over the family album.