UK Online Safety Act: the age check games now face

Most studios reading about 2026 age rules assume the trigger is loot boxes or in-app purchases. Under the UK Online Safety Act, it is neither. A game falls into scope because it has a social surface — chat, voice, user-generated content, livestreaming, or a marketplace — and a likely audience of children. If that describes your game, a self-declared birthdate field no longer satisfies the law.

This post is about the UK Online Safety Act's age-assurance duties as they apply to games in 2026. It does not interpret the law for you — your counsel does that. It explains the scope test, the assurance bar, and the part of the work that is an architecture decision rather than a legal one.

Why the trigger is your social surface, not your store

The US state laws that landed in January 2026 hang on the app store and the purchase flow. The EU's planned consumer-protection rules target loot boxes and random items. The UK Online Safety Act works differently. Its children's-access duties attach to a service that lets users interact — text or voice chat, sharing clips or images, livestreaming, friend requests, or any space where strangers can contact each other.

That means a single-player puzzle game with no communication features is largely outside these duties, while a casual multiplayer game with an open chat channel is squarely inside them. The line is not how you make money. It is whether your game gives one user a way to reach another, and whether children are a likely part of your audience.

Ofcom, the UK regulator, made this explicit in early-2026 guidance: games with online social features should be running regular Online Safety Act risk assessments, especially where children are a likely audience. The risk assessment is itself an obligation, not a formality. You are expected to look at how a child could be exposed to harm through your social features and to document what you do about it.

What "age assurance" actually means

The phrase to internalise is age assurance. The Act does not accept a checkbox that says "I am over 18." Regulators have stated plainly that ticking a box to confirm age is no longer compliant. The duty is to put in place a mechanism that can reliably distinguish adults from minors.

Age assurance is a spectrum. At one end is hard age verification — a document or a credit check that proves a specific age. At the other is age estimation — a method that produces a confident age band without collecting an identity document. The Act does not force every service to the strictest end. It asks for a method proportionate to the risk your features present. A game with open livestreaming to strangers sits at a higher risk tier than one with a moderated, friends-only chat, and the assurance you are expected to apply scales with that risk.

The practical consequence is that high-risk features get the most restriction. Livestreaming and the ability for strangers to contact children are exactly the features regulators have moved to restrict for under-16s. If your game offers those, the safe path is to default them off for any account you cannot confidently place in an adult band — and to make that default a property of the account's age band, not a setting buried three menus deep.

The cost of getting the scope test wrong

The enforcement is not theoretical. Ofcom can fine a service up to 10% of its global annual revenue or £18 million, whichever is greater. By early 2026 it had already issued over £2.3 million across more than 90 investigations. A studio that decides its multiplayer game is "just a game" and therefore out of scope is making a legal bet against a regulator that is actively pursuing cases.

The honest difficulty here is not technical. Wiring an age-estimation provider or consuming a platform age signal is a known integration. The hard part is the same one every age rule shares: applying the minor-safe behaviour consistently across every surface. A game that age-gates its chat but forgets its livestream, or that sets safe defaults at signup but lets a later seasonal feature re-open public interaction, has a gap a regulator or a parent can find. The age band has to reach every feature that behaves differently for a minor, and it has to reach them all at once.

Why this belongs in your live systems, not your build

The reflex is to treat age assurance as a one-time gate you clear before release. That is necessary but not sufficient, for two reasons.

First, the rules are still moving. Ofcom continued publishing detail through the first half of 2026 about what is expected of services used by children, and the bar for what counts as adequate assurance for a given risk tier is being sharpened over time. A studio that freezes today's interpretation into a build will need an app release every time the guidance tightens.

Second, the scope can change inside your own roadmap. Add a public chat to a previously single-player game in a seasonal update and you may have just pulled yourself into scope. If the minor-safe behaviour — which social features default off, which interactions a flagged account can reach, how a child's data is handled — lives in your live configuration rather than your binary, you can respond to both a regulatory shift and your own feature change without shipping a release and waiting for players to update.

This is the same principle that age-aware offer design relies on. The behaviour that depends on the age band should be something you can change remotely. When a new duty lands or your risk tier shifts, it becomes a configuration change instead of a release cycle. See how it works →

The takeaway

The UK Online Safety Act does not ask whether your game sells loot boxes. It asks whether your game lets users reach each other and whether children are a likely audience. If both are true, you owe age assurance — a method that reliably tells adults from minors, not a checkbox — and a documented risk assessment of how your social features could expose a child to harm.

The studios that handle this well do two things. They make the minor-safe behaviour reach every social surface consistently, so there is no gap between the chat that is gated and the livestream that is not. And they put that behaviour in their live systems rather than their build, so the next tightening of Ofcom's guidance, or the next feature that pulls them into scope, is a setting they change rather than a release they scramble to ship.