acthub.beta

OFCOM’s guidance about children’s access assessments (“CAA guidance”)

Made under Online Safety Act 2023
Sections46
universal formatas at 12 Jun 202572 references

OFCOM’s guidance about children’s access assessments (“CAA guidance”)

Children’s access assessments

Guidance

Published 24 April 2025

Contents

Section

1. Overview ............................................................................................................................. 3
2. Duties about children’s access assessments ...................................................................... 6
3. Stage 1: is it possible for children to access the service or part of it? ............................. 12
4. Stage 2: is the child user condition met? ......................................................................... 15
5. Carrying out a new children’s access assessment ............................................................ 24

Annex

A1. Recording the outcome of children’s access assessments .............................................. 28
A2. Case studies ...................................................................................................................... 31

Section 1 Overview

1.1 This guidance assists providers of services regulated by the Online Safety Act 2023 (“the Act”) in complying with their duties in the Act about children’s access assessments.
1.2 All regulated user-to-user (“U2U”) and search services (together “Part 3 services”1) are required to carry out children’s access assessments.2
1.3 A children’s access assessment is a process for establishing whether a service is likely to be accessed by children.3 A child is defined in the Act as a person under the age of 18.
1.4 We anticipate that most Part 3 services that are not using highly effective age assurance are likely to be accessed by children within the meaning of the Act.4
1.5 You may already have assessed whether a service is likely to be accessed by children as set out in the ICO’s Children’s code for the purposes of complying with data protection regulation.5 Please note that the requirements of data protection law are different, and you will need to carry out a separate children’s access assessment, although you may be able to draw on similar evidence and analysis for both.
1.6 This guidance will help service providers understand their duties relating to children’s access assessments and how they can carry out children’s access assessments.6 Carrying out children’s access assessments should be a straightforward exercise for most providers.
1.7 Part 3 services that conclude they are likely to be accessed by children will be in scope of the children’s safety duties in the Act. This means that they must:
• carry out children’s risk assessments (for more details, see the Children’s Risk Assessment Guidance7); and • take steps to comply with the relevant safety duties protecting children (for more details, see the Protection of Children Codes8).
1.8 Figure 1 provides a high-level overview of each stage of a children’s access assessment:
1 Section 4(3) of the Act. 2 As required under section 36 of the Act. 3 Section 35 of the Act defines a “children’s access assessment”; Section 37 of the Act explains the meaning of “likely to be accessed by children”. 4 Section 35(2) of the Act.
5 Information Commissioner’s Office (ICO), 2023. Likely to be accessed by children guidance. Nothing in this guidance should be taken to comment on the data protection law requirements. 6 Ofcom is required under section 52(3)(b) of the Act to produce guidance for Part 3 services to assist them with complying with their duties relating to children’s access assessments. 7 Children’s Risk Assessment Guidance 8 Protection of Children Code of Practice for user-to-user services; Protection of Children Code of Practice for search services
Figure 1: Carrying out a children’s access assessment
This guidance was originally published on 16 January 2025. This updated version was published on 24 April 2025. We have replaced references to the draft versions of the Children’s Risk Assessment Guidance and Protection of Children Codes of Practice with references to the final versions, and have updated and simplified the sub-section ‘When do services need to carry out the first children’s access assessment?’ to reflect that the original deadline of 16 April 2025 has now passed.

Section 2 Duties about children’s access assessments

What are children’s access assessments and what do Part 3 services need to do?

2.1 All providers of Part 3 services must carry out children’s access assessments.
2.2 A children’s access assessment is an assessment of a Part 3 service:
• to determine whether it is possible for children to access the service or a part of the service (stage 1), and • if it is possible for children to access the service or a part of the service, to determine whether the child user condition is met in relation to the service or a part of the service (stage 2).
2.3 In this guidance, all references to ‘services’ also include any part of a service that must be assessed as to whether it is likely to be accessed by children.
2.4 The outcome of this assessment determines whether a service is to be treated as ‘likely to be accessed by children’. There are two other cases when a service will be considered as ‘likely to be accessed by children’. These cases are set out in paragraph 2.35.
2.5 All Part 3 services that are ‘likely to be accessed by children’ must:
• carry out children’s risk assessments (for more details, see the Children’s Risk Assessment Guidance 9); and • take steps to comply with the relevant safety duties protecting children (for more details, see the Protection of Children Codes of Practice10).
2.6 Regarding stage 1 of the assessment, providers are only entitled to conclude that it is not possible for children to access the service if they are using age verification or age estimation (“age assurance”) with the result that children are not normally able to access the service.11
2.7 Regarding stage 2 of the assessment, the child user condition is met in relation to a service if:
• there is a significant number of children who are users of the service; and/or • the service is of a kind likely to attract a significant number of users who are children.12
2.8 A child is any person under the age of 18. References to children are to children in the United Kingdom.
9 Children’s Risk Assessment Guidance 10 Protection of Children Code of Practice for user-to-user services; Protection of Children Code of Practice for search services 11 Section 35(2) of the Act. 12 Section 35(3) of the Act.
2.9 For the purposes of the child user condition, the reference to a ‘significant number’ includes a reference to a number which is significant in proportion to the total number of UK users. In considering whether a service has a significant number of users who are children, services must base their assessment on evidence about who actually uses the service rather than who the intended users of the service are.13
2.10 A “user” is defined in the Act.14 It does not matter whether a user is registered to use a service. For U2U services, it is not necessary for users to post or upload content – merely viewing (or otherwise encountering) user-to-user content on a service counts as actively using that service.
2.11 In this guidance we consider children’s access assessments in two stages:
• Stage 1: is it possible for children to normally access the service? • Stage 2: is the child user condition met?
2.12 Not all service providers will need to carry out both stages 1 and 2 above. If it is not possible for children to normally access your service, you do not need to go on to consider whether the child user condition is met in relation to your service.
2.13 The Act states that children’s access assessments must be suitable and sufficient.15 This means:
• You must complete the relevant stages of the children’s access assessment outlined in the Act. • In certain cases, your assessment must be supported by evidence.16
2.14 If you conclude that the child user condition is not met, you should be able to demonstrate the steps you took to reach this conclusion and what evidence you relied on.
2.15 Figure 2 shows the process service providers will follow to carry out their children’s access assessment and the factors they will need to consider at each stage:
13 Section 35(4)(b) of the Act. 14 Section 227(1) of the Act. 15 Section 36(6) of the Act. 16 Further detail on whether you need to record evidence is set out in paragraphs 2.26-2.31 and Annex 1 of this guidance.
Figure 2: Children’s access assessments process
Source: Ofcom

Which services need to carry out children’s access assessments?

2.16 All providers of Part 3 services are required to carry out children’s access assessments to determine whether a service, or part of a service, is likely to be accessed by children.
2.17 If you provide more than one Part 3 service, you must carry out separate children’s access assessments for each service.
2.18 If only part of your service is a Part 3 service, you must still carry out children’s access assessments in respect of that part of your service.17
2.19 Part 3 services include:
• User-to-user services: services on which content is generated directly by users to be uploaded or shared on that service and which may be encountered by other users;18 and • Search services: services that are, or comprise, a search engine.19
2.20 Some parts of your service may require a different degree of assessment. For example, if you conclude that children are not normally able to access part of your service, then the assessment is complete for this part of the service, but you will need to consider whether the child user condition is met in relation to other parts of the service that children can access.
17 This may be because part of your service publishes or displays regulated provider pornographic content and is in scope of the Part 5 duties. It is not necessary to complete a children’s access assessment for a service that is only in scope of the Part 5 duties relating to regulated provider pornographic content. 18 Section 3(1) of the Act. 19 Section 3(4) of the Act.

When do services need to carry out the first children’s access assessment?

2.21 The timing for carrying out the first children’s access assessment depends on when a service comes within the scope of Part 3 of the Act.20
2.22 If your service was already operating as a Part 3 service on or before 16 January 2025, you were required to complete your first children’s access assessment by 16 April 2025.
2.23 If you started operating a new Part 3 service after 16 January 2025, you must complete the first children’s access assessment for this service within three months of the first day of operation.21 In this case, you will have to complete the illegal content risk assessment22 and the children’s access assessment concurrently.
2.24 If your service was operating prior to 16 January 2025 but did not meet the definition of a Part 3 service at that time and has since undergone a change that brings it into scope of Part 3, you must complete your first children’s access assessment within three months of the day when your service came into scope.23 Examples of changes that could bring a service into scope of Part 3 could include introducing user-to-user functionalities or making the service available in the UK. In this case, you will have to complete the illegal content risk assessment and the children’s access assessment concurrently.
Source: Ofcom

Keeping a written record of children’s access assessments

2.25 You must keep a written record of children’s access assessments. Written records can be made and kept in a durable medium of your choice (for example, on a computer or using any storage device such as a CD-ROM, USB memory stick, cloud storage, a network drive or a paper copy), which is capable of being provided easily and quickly to Ofcom if required.
2.26 Your assessment must be recorded in an easily understandable form.24 We consider that this will be achieved by:
• Ensuring that the written record is legible and in as simple and clear language as possible. • Keeping your written records in English (or for service providers based in Wales, in English or Welsh). • Ensuring you have dated your written record, reflecting when the record was made.
2.27 You must make and keep a written record of every children’s access assessment that you have carried out. This will ensure that you are able to show how you have complied with the duties about children’s access assessments.
20 Part 1 of Schedule 3 to the Act: Timing of Illegal Content Risk Assessments and Children’s Access Assessments. 21 Paragraph 4, Part 1 of Schedule 3 to the Act. 22 Risk Assessment Guidance and Risk Profiles 23 Paragraph 4, Part 1 of Schedule 3 to the Act 24 Section 36(7) of the Act.
2.28 If you conclude that your service is likely to be accessed by children, it is sufficient to record your outcome using the template in Annex 1.
2.29 If you conclude that children cannot normally access your service because you are using highly effective age assurance, you should keep a written record of the evidence that you have relied on in reaching this conclusion. Further detail on highly effective age assurance is available in Section 3 of this guidance.
2.30 If you conclude that the child user condition is not met, you should keep a written record of the evidence that you have relied on in reaching this conclusion. Further detail on the child user condition is available in Section 4 of this guidance.

What happens if you do not complete a suitable and sufficient children’s access assessment?

2.31 If we suspect that a service has failed to carry out a suitable and sufficient children’s access assessment properly or at all, then we may consider taking enforcement action in line with our Online Safety Enforcement Guidance.25 Where appropriate, we may first engage with a service to ensure it understands what it needs to do to meet the duties about children’s access assessments.
2.32 In the event that we decide to open an investigation and find that a service has contravened its obligations, we have the power to impose a penalty of up to 10% of qualifying worldwide revenue or £18 million (whichever is the greater) and require remedial action to be taken.
2.33 Remedial action may include Ofcom requiring the service to comply with the children’s risk assessment duties under sections 11 and 28 of the Act, the children’s safety duties in sections 12 and 29 of the Act, and any other relevant duties in the Act. The intention of the Act is that services will be required to comply with the relevant safety duties protecting children in circumstances where Ofcom has determined that they are to be treated as likely to be accessed by children, even if the service in question has concluded that it is not likely to be accessed by children.26

Additional cases when your service will be considered ‘likely to be accessed by children’

2.34 The Act clearly states that there are three cases when a service is to be treated as ‘likely to be accessed by children’, and therefore in scope of the children’s safety duties.27
2.35 In addition to a provider concluding that a service is to be treated as likely to be accessed by children following completion of a children’s access assessment, a service will also be treated as likely to be accessed by children if:
25 Online Safety Enforcement Guidance 26 Sections 135(4) and 135(5) of the Act. 27 Section 37 of the Act.
• You fail to carry out your first children’s access assessment. In this case your service will be treated as likely to be accessed by children from the date by which your first children’s access assessment should have been completed.28 • Following an investigation into a failure to comply with any of the children’s access assessment duties, Ofcom determines that your service should be treated as likely to be accessed by children.29 In this case, your service is to be treated as likely to be accessed by children from the date of, or specified in, the confirmation decision given to you as the provider of the service.30
2.36 Therefore, if you fail to complete a children’s access assessment, your service will be considered likely to be accessed by children and will be subject to the relevant children’s safety duties. If your service fails to comply with the relevant duties, then we may consider taking enforcement action in line with our Online Safety Enforcement Guidance (see paragraphs 2.32-2.34 above).
28 Section 37(4) and 37(5)(a) of the Act. Your service will continue to be considered as ‘likely to be accessed by children’ until you have completed your first children’s access assessment, and if the outcome of this first assessment is that your service is not likely to be accessed by children. 29 This refers to an investigation into a failure to comply with a duty set out in section 36 of the Act. See sections 135(4) and (5) of the Act. 30 Sections 37(6), 37(7) and 135(5) of the Act.

Section 3 Stage 1: is it possible for children to access the service or part of it?

3.1 The Act says that service providers may only conclude that it is not possible for children to access a service if that service uses a form of age assurance which achieves the result that children are not normally able to access that service or part of it.31
3.2 We consider that, in order to secure the result that children are not normally able to access their service (or a part of it), service providers should deploy highly effective age assurance and implement effective access controls to prevent users from accessing the service (or relevant part of it) unless they have been identified as adults.32 If you are deploying highly effective age assurance,33 you may conclude that it is not possible for children to access your service. This includes where you already have highly effective age assurance in place, or where you have adopted our recommended age assurance measures as set out in the Protection of Children Code for U2U services.34
3.3 To understand what constitutes highly effective age assurance, service providers should refer to our Guidance for Part 3 services on highly effective age assurance.35 The same principles apply when assessing age assurance in the context of children’s access assessments. You will need to consider the Guidance for Part 3 services on highly effective age assurance in full should you wish to carry out an in-depth assessment of whether a particular form of age assurance is highly effective for the purpose of this stage of the children’s access assessment.
3.4 Some service providers may be in a position to assess the age assurance they already have in place to decide if they meet the relevant criteria to be considered highly effective and assess the efficacy of any requisite access controls. Other service providers may need to make enquiries of third-party providers to ascertain the basis for assurances that their age assurance meets the relevant criteria, e.g., that it is technically accurate.
3.5 Figure 4 shows the process for determining whether it is possible for children to access a service:
31 Section 35(2) of the Act. 32 We use the term "access controls" to describe a technical mechanism(s) which prevents users who have not been age assured, or having been age assured, did not meet the requirements of the age assurance process, from accessing a service (or part of it) or certain content.
33 Section 12(6) of the Act explains that this is age verification or age estimation of such a kind and used in such a way, that it is highly effective at correctly determining whether or not a particular user is a child. 34 Our draft Protection of Children Codes are discussed at Volume 5 of our May 2024 Consultation. The draft Code for U2U services is published as Annex 7 to our May 2024 Consultation. We will update this guidance with references to final versions of our Protection of Children Codes when they are published. 35 Guidance on highly effective age assurance for Part 3 services
Figure 4: Overview of Stage 1 - Can children normally access my service?
Source: Ofcom

Services that deploy highly effective age assurance and have effective access controls meaning children cannot normally access the service or part of it

3.6 If children cannot normally access your service or part of it because you have highly effective age assurance and effective access controls in place, you do not need to go on to stage 2. You can conclude that the service or that part of it is not likely to be accessed by children.
3.7 You must now record the outcome. You may use the template at Annex 1. Please see paragraphs 2.26-2.31 where we set out requirements for record keeping.
3.8 In the absence of any significant changes to your service, you must carry out another children’s access assessment within a year of carrying out your first children’s access assessment. You should continue to monitor your service to consider whether you need to repeat your children’s access assessment sooner than that. The circumstances in which you will need to carry out a new children’s access assessment in less than a year are set out in Section 5.

All other services

3.9 You will need to move onto stage 2 of the children’s access assessment if any of the following apply:
• You do not use any kind of age assurance on your service. • You use age assurance to prevent children from accessing the service or part of the service, but it is of such a kind that is not capable of being highly effective. For example, you rely solely on self-declaration, general contractual restrictions, or payment methods which do not require a user to be over 18. • The age assurance is not used or implemented in such a way that it is highly effective at correctly determining whether or not a particular user is a child. To be considered highly effective, the age assurance should be technically accurate, robust, reliable, and fair. • The age assurance does not ensure that children are not normally able to access your service. We expect service providers to identify and take appropriate steps to mitigate against methods of circumvention that are easily accessible to children, and where it is reasonable to assume that children may use them. • You use highly effective age assurance on your service but still allow children to access the service, or certain parts of the service. For example, your service uses highly effective age assurance to limit children’s access only to certain features, functionalities, communities or content, or if you do not use access controls alongside the age assurance process.
3.10 Our guidance on stage 2 (the child user condition) is set out in Section 4.

Section 4 Stage 2: is the child user condition met?

4.1 The child user condition is met if:
• there is a significant number of children who are users of the service; and/or • the service is of a kind likely to attract a significant number of users who are children.36
4.2 You must only conclude that the child user condition is not met if you have evidence that demonstrates that neither of the two criteria is met.
4.3 In this section, we provide further information on how we have interpreted the criteria of the child user condition, and the factors you should consider in reaching a conclusion. We also set out some factors that suggest your service has a significant number of children or is of a kind likely to attract a significant number of children. The factors provided are examples and the list is non-exhaustive. Some factors are likely to be more relevant to your service than others, and there may be other relevant factors that we have not listed in this guidance. In Annex 2, we work through some case studies to illustrate how a service may assess various factors when determining whether the child user condition is met.
4.4 You should consider both criteria and take a holistic view of how to approach this stage of the assessment and whether the child user condition is met. It can be challenging to accurately determine if a user is a child unless you use highly effective age assurance. You may therefore prefer to focus your assessment on those factors which would indicate that your service meets the second criterion of the child user condition: whether your service is of a kind likely to attract a significant number of children. For many services this is likely to be the most expedient way to reach a conclusion that they are likely to be accessed by children.
4.5 If you conclude that the child user condition is met, you do not need to gather additional evidence or keep a detailed record of the evidence you have relied on to support this conclusion. You must record your outcome. You may use the template in Annex 1. You will now need to carry out a children’s risk assessment.
4.6 Figure 5 shows the stage 2 process to assist you in determining whether the child user condition is met and the next steps you must take once you have determined whether the service is likely to be accessed by children.37
36 Section 35(3) of the Act. 37 The Act does not specify a particular order or sequence in which the two criteria of the child user condition should be considered. The approach we present above is a suggested approach, and you may wish to consider the criteria in an order that is most appropriate for your service.
Figure 5: Stage 2 of the children’s access assessment (the child user condition) and next steps
Source: Ofcom

Significant number of users who are children

4.7 The Act does not further define what is meant by a “significant number” of users who are children, although it does say that “significant” can include a number that is significant in proportion to the number of UK users38 of a service.39 In other words, a significant number of children can refer to an absolute number or a proportion of users.
4.8 What constitutes a significant number of children for the purposes of a children’s access assessment is likely to depend highly on the nature and context of your service, taking into account a number of factors and characteristics. You should err on the side of caution when carrying out this assessment given the clear intent of the Act to ensure that regulated services are designed and operated in a way that secures a higher standard of protection of children than for adults.40
4.9 A significant number of users who are children means a number or proportion that is material in the nature and context of your service. Even a relatively small number or percentage of children could be a significant number.
4.10 If you allow children to access your service but deploy highly effective age assurance with a view to giving them an age-appropriate experience, you will likely be able to accurately access the age of your users and by extension the number of users on your service who are children.41 To assess whether that number is material in the context of your service you will also need to consider the factors set out in paragraphs 4.21-4.39.
38 Section 227 of the Act says that a UK user of a service means an individual who is in the UK. It also makes clear that a user does not need to be registered to use the service in question to be counted as a user for the purposes of determining whether there is a significant number of UK users. 39 Section 35(4)(a) of the Act. 40 Section 1(3)(b)(i) of the Act. Note that conversely, self-declared age data may be relevant for establishing that the child user condition is met, as users who declare that they are children are likely to be children. 41 See Section 3.
4.11 For all other services, Ofcom recognises that it can be challenging to accurately assess the number of children on your service. You may have other evidence to suggest that there is not a significant number of children using the service. However, some sources of information are not appropriate for establishing the number of users on your service who are children, for example:
• Self-declaration of age: If you allow users to self-declare their age, you should not rely on this data alone to conclude that you do not have a significant number of users who are children, as the Act states that measures which require users to self-declare their age (without other methods) are not to be regarded as age assurance.42 • Online payment methods: You should not rely on data from online payment methods which do not require a person to be over the age of 18, for example debit cards or any other card where the card holder is not required to be 18.
4.12 You should also ensure that you are taking into account all relevant and reliable sources of data. Some sources of evidence may not accurately capture all users on your service, and by extension, the number of users who are children. For example, this includes:
• User traffic data from only one type of device (desktop, mobile, or tablet): You should not rely on data from only one type of device if your service can be accessed using multiple different types of devices. • Data that only counts registered users: if your service allows access by unregistered users, you should not rely only on data about registered users. This data source may not be a reliable indicator of the number of children on your service.
4.13 As part of your assessment of whether you have a significant number of children on your service, the list of factors set out in Table 6 may assist you. To assess whether that number is material in the context of your service you may consider the full suite of factors set out below, paying particular attention to the factors highlighted in Table 6. There may be other factors that are relevant for your assessment.

Services of a kind likely to attract a significant number of users who are children

4.14 The concept of “significant number” also features in the second criterion, which is whether a service is “of a kind likely to attract a significant number of users who are children”. Therefore, the above guidance on significant number also applies here, which means that a service does not have to be of a kind likely to attract a large number of children to meet this criterion. A service of a kind likely to attract a relatively small number of children could still meet this criterion.
4.15 The Act does not say what kind of services are likely to attract children. Some service providers actively design their services for, or target their services at, children. This could be older children above a certain age (for example services targeting teens), or younger children on a service with no minimum age limit. If you include information in your terms of service or publicly available statements that makes clear that children are permitted to use your service (subject to certain conditions) and how they may do so, or if your commercial strategy includes obtaining revenue from children and parents (whether through
42 Section 230(4) of the Act.
advertising, in-service payments or other ways), it is reasonable to assume that your service is likely to attract a significant number of users who are children.
4.16 If you consider this to be the case for your service, you may conclude that the child user condition is met. You do not have to carry out detailed further analysis to reach this conclusion.
4.17 Additionally, if a service has a wide range of types of content this will usually mean that the service is more likely to have some type of content that appeals to children and therefore meet this criterion of the child user condition. If a service only has a narrow range of content, they should assess whether this content is likely to appeal to children, for example evidence suggests that children are attracted to dating and pornography services.43
4.18 Your service may be of a kind likely to attract children for several reasons, including whether your service has the potential to benefit children, the content on your service, the design of your service, the functionalities it offers, and your commercial strategy.44 Some factors will be more relevant to your service than others, and there may be other relevant factors and types of evidence that we have not listed here.
4.19 Even if your service does not actively target children or seeks to limit access to children below a certain minimum age, it may still be of a kind likely to attract a significant number of children. In the context of the Act, a child is anyone under 18, so even if your service does not allow children below a certain age, if your service is still likely to attract a significant number of children above that minimum age requirement then this would be sufficient to meet this criterion of the child user condition. For example, if your service is likely to attract a significant number of children between 15-17, this would be sufficient to meet this criterion, even if you are confident there are no younger children on the service.
4.20 The following sub-section sets out the factors in more detail.

Factors to consider when assessing whether the child user condition is met

4.21 We have set out in Table 6 below a non-exhaustive list of factors that you should take into account when carrying out your assessment of whether the child user condition is met.
4.22 You should consider the factors set out below and any other factors that may be relevant for your service. This list will help you make an informed decision by suggesting sources of evidence you could consider.
4.23 In Annex 2, we work through some case studies to illustrate how a service may use these factors when determining whether the child user condition is met.
43 See for example Annex 3 of Ofcom’s Age Assurance and Children’s Access Statement. 44 Services may consider a range of functionalities, as illustrated in the Children’s Risk Profiles included in the Children’s Risk Assessment Guidance for content harmful to children. You do not need to consult the Risk Profiles to make this decision as risk is not a consideration at this stage. The Risk Profiles, however, may be a useful resource.

Table 6: Factors to consider when assessing whether the child user condition is met

Non-exhaustive list of individual indicative factors
Is my service of a kind likely to attract a significant number of UK users who are children?
• Whether my service provides benefits to children.
• Whether the content on my service is appealing to children.
• Whether the design of my service is appealing to children
(colours, presentation, features and functionalities).
• Whether children form part of my business model, marketing
strategy and growth plan.
• Evidence from internal sources (e.g., reporting and
complaints of users under 18 and statistics on account
removal of users under 18).
• Evidence from external and independent sources (e.g.,
market research and quantitative evidence from third parties
that track child media consumption).
Does my service have a significant number of UK users who are children?
• Whether children form part of my commercial strategy (e.g., information provided to or by advertisers such as number of clicks on ads that show an interest in child-focused advertising, and evidence from my business growth strategy). • Evidence from internal sources (e.g., reporting and complaints of users under 18 and statistics on account removal of users under 18). • Evidence from external and independent sources (e.g., market research and quantitative evidence from third parties that track child media consumption).
4.24 Below we unpack these factors, reflecting why these factors may be relevant for your assessment.

Your service has the potential to benefit children

4.25 Children may benefit from using your service. Based on the nature of your service, the content you publish and the functionalities you provide, accessing your service may provide benefits and opportunities for children. This is because children use the internet to access services and information for a variety of reasons, including entertainment and educational purposes. You should consider whether your service may be more appealing to children because it makes certain opportunities and benefits more accessible to them. For example, the types of benefits may include, but are not limited to:
• Providing educational value for children. • Entertaining or allowing children to be creative.
• Enabling children to express themselves. • Facilitating the sharing of advice and support between children. • Providing a supportive environment for child users, where some may feel a sense of belonging. • Facilitating children connecting with others, including to build friendships or relationships.
4.26 In the context of this assessment, you should consider whether your service may provide benefits to children and may therefore be more appealing.

The content on your service appeals to children

4.27 Many types of content are particularly appealing to children. Some types of content that appeal to children are set out in Table 7 below. If your service hosts, displays or makes accessible content of this nature, it may suggest that you are likely to attract a significant number of children.
4.28 The content set out below covers both U2U and search services. U2U services host, display and make such content accessible to children. Search services make this content accessible to children and may display this content within the search results.

Table 7: Content that appeals to children

Content type
Indicative examples
Entertainment and popular culture
Music, videos, humour/funny content. Influencers, celebrities, music, film,
TV, books, comics, cartoons, animation.
Content created by children may particularly appeal to other children.
Creative activities
Art, music, singing, photography, videography, drawing, painting, cooking, drama and acting, crafts, creative writing, beauty and makeup and fashion. Content created by children may particularly appeal to other children.
Games and sports
Gaming, sports, esports and sports personalities.45
Making connections,
Content about friendships, relationships, and other personal bonds. Content of a sexual nature.
friendships, dating, and
relationships
Self-improvement, lifestyle and careers
Content about future careers and finance.
Content from lifestyle influencers.
Health, challenges and support
Content about relationships, physical, mental and any other personal issues and challenges. Content enabling engagement with other individuals experiencing the same challenges as above. Content proposing to offer support, guidance or advice for the above. Content about wellness, health and fitness
Content type
Indicative examples
Education, learning and knowledge
Content enabling the development of new skills.
Content to help with schoolwork and homework (looking up information).
Content providing advice on further education and careers.
Motivational content around self-improvement.
Financial content (making money and becoming financially independent)
Current affairs and engaging in civil activity
Consuming content through non-traditional media. News about music and musicians, celebrities, and other influencers. Petitions Informal political commentary
45 By esports, we mean electronic sports, often in the form of multi-player games with the ability to communicate between players.
4.29 The indicative examples set out above are not intended to be an exhaustive list; your service may still be of a kind likely to attract a significant number of children if it does not include any of the content types listed in Table 7. Conversely, some services may have content which would fall into one of the above categories but may not be of a kind likely to attract a significant number of children because of the specific nature of the type of content in question. For example, while older children may be interested in making money and becoming financially independent, it is less likely that they will be interested in a forum discussing re-mortgaging or pensions.

The design of your service appeals to children

4.30 The colours used on your service and the presentation of your service may attract children. Bright, bold colours and characters that capture their imagination, cartoons, graphics, storylines, and other interactive features all play a role in attracting children. You should consider whether the colours and overall appearance of your service is visually appealing to children.
4.31 The functionalities provided by your service may be of a kind likely to attract children or encourage use by children (both independently and with adult supervision) if those functionalities augment or improve their online experience. Some functionalities are appealing to children and used by children, for example, the ability to make a user profile, making connections with other users, and direct messaging. Social media services are an example of a service type that contains these functionalities.
4.32 Some functionalities enable children to create and post their own content online.
4.33 There may be other functionalities and features that appeal to children. You should consider whether your service has any design features that may attract children and encourage access, whether independently or with adult supervision.

Children form part of your commercial strategy

4.34 If children form part of a service provider’s commercial strategy this strongly indicates that there is likely to be a significant number of children on the service or that your service is likely to attract a significant number of children. It may be useful for service providers to
consider their business model, marketing strategy and growth plan when thinking about their commercial strategy.
4.35 Children may form part of the commercial strategy if you actively target children as part of your audience, for example by advertising your service as one for children or by including content types or designing it in a way that is likely to attract children (see Table 7). It is also relevant to consider whether you allow advertising, promotions or competitions targeted at children on your service, as their nature, design and content may be likely to particularly appeal to children. If your service’s revenue stream is linked to attracting children onto a service, it is reasonable to assume that your service has a significant number of users who are children.
4.36 Your service may also unintentionally target children, for example if it is advertised on other services that are targeted at children, or that are known to be accessed by children, as this may encourage children onto your service.46
4.37 Service providers may also be able to draw on advertising data to demonstrate that services are, or are not, of a kind likely to attract a significant number of children.
4.38 Your service’s performance may also be relevant, particularly the rate of growth in relation to users and/or revenue. If your service has a fast-growing user base it may reflect an increased likelihood of children engaging with your service. If a service is growing in users overall, this user base may include children too, given that children engage with services online in a way that is similar to adults. A rapid user base expansion can therefore encompass a growth in children’s engagement.
4.39 Children may also be attracted to new and innovative services, as they are typically early adopters of technology. Therefore, your growth strategy may also be a relevant source of information. A relevant consideration is how you plan to expand your business and whether children form part of the strategy.

Additional evidence

4.40 Beyond the factors set out above, you may also consider other sources of evidence. For example:
• Evidence from internal sources, including information set out in your terms of service or publicly available statements; the number of complaints (if any) that you have received relating to children accessing your service (e.g., reports flagging users below the age permitted on your service; and any actions taken previously in connection with children to enforce your terms, for example the number of accounts previously removed of users below the age permitted on your service). • Evidence from external/third party sources demonstrating that your service is not likely to attract children. This may include market research and quantitative evidence from third parties that track child media consumption, for example media trackers.
46 Marketing your service on other services that are targeted at children, through AdTech providers in the open display market, is also relevant to this assessment.

Recording the outcome

4.41 Having carried out the children’s access assessment you must now record the outcome. You may use the template at Annex 1.
4.42 If you conclude that the child user condition is not met, in order to carry out a suitable and sufficient assessment, you should record the methodology you used and the evidence that you have relied on in reaching your conclusion, in line with the record keeping requirements set out in paragraphs 2.26-2.31. You should consider the factors listed above when you are thinking about what evidence you need to support your conclusion. As set out in our guidance on highly effective age assurance, you may find it helpful to keep a written record of how you have taken privacy into account when implementing highly effective age assurance.
4.43 If you conclude that the child user condition is met, you only need to record your outcome to meet your requirements for a suitable and sufficient children’s access assessment. You do not need to collect supporting evidence.

Section 5 Carrying out a new children’s access assessment

5.1 This section does not apply if, having carried out the children’s access assessment, you have concluded that your service is likely to be accessed by children.
5.2 If you make changes to your service that mean it may no longer be likely to be accessed by children (for example, if you implement highly effective age assurance), then you can carry out a new children’s access assessment to determine whether your service no longer has to comply with the safety duties protecting children. In particular, you can carry out a new children’s access assessment if you have implemented highly effective age assurance in line with our recommendations in relation to age assurance, although you do not have to.47
5.3 If you have concluded that your service is not likely to be accessed by children, you will need to carry out children’s access assessments of the service not more than one year apart. In addition, there are various circumstances that will mean you need to complete a new children’s access assessment.48 In this section we explain when you may have to carry out a new children’s access assessment.

Annual assessment

5.4 If your most recent children’s access assessment concluded your service was not likely to be accessed by children, you must carry out a new children’s access assessment no later than 12 months following the completion of the first assessment, and annually thereafter.49 The process for carrying out new children’s access assessments is the same as the process for carrying out the first children’s access assessment, as set out in Sections 2-4 of this guidance.

Circumstances that trigger a new assessment

5.5 If you have concluded that your service is not likely to be accessed by children, there are three circumstances in which you must carry out a new children’s access assessment even if it has been less than 12 months since your last one:
• before making any significant change to any aspect of the service’s design or operation to which such an assessment is relevant. • in response to evidence about reduced effectiveness of age assurance. • in response to evidence about a significant increase in the number of children using the service.
47 See Protection of Children Code for user-to-user services. 48 Sections 36(3)and (4) of the Act. 49 Sections 36(3) of the Act.

Before making any significant change to any aspect of your service’s design or operation

5.6 If you are planning to make a significant change to any relevant aspect of the service design or operation of your service, you must carry out a children’s access assessment before you make the change.50
5.7 What amounts to a significant change can vary across the wide range of services likely to be accessed by children. Below we have set out examples of the types of significant changes that may increase the likelihood of children accessing your service.
5.8 A change targeted at the user base may mean changing your terms of service or publicly available statements to reduce your specified minimum user age, allowing younger children on the service than before. Other examples include developing a new marketing strategy that targets children or allows advertising for children. A change that affects a substantial portion of your service’s user base may result in children accessing your service or may change your service’s user base by attracting more children. It is important that you consider whether the impact of such a change, targeted at the user base, may result in children gaining access or your service becoming more attractive to children.
5.9 Similarly, a change to your service, or a new element (for example hosting a new type of content), may make your service more appealing to children, or easier to access. This may not be your intention: as set out in Section 4, children are attracted to a wider range of services, including services where they are not the intended user base.
5.10 A change in ownership may also result in a change in the direction of the service which may affect whether children are accessing the service. Your service’s revenue model, its growth strategy and ownership are all integral parts of your service’s commercial strategy. If users under 18 become part of your service’s growth strategy, and you reflect this in the way the service is marketed, this will likely directly result in children using the service.
5.11 These examples are illustrative and not exhaustive. There may be other circumstances which may represent a significant change, which are unique to your service. It is for you to assess and determine what other circumstances may be relevant.

In response to evidence about reduced effectiveness of age assurance

5.12 If your most recent children’s access assessment concluded that it is not possible for children to access the service or part of it because you have highly effective age assurance in place, you will need to carry out a new children’s access assessment in response to evidence about reduced effectiveness of your age assurance and access control methods on your service.51 This would mean that your age assurance and access control methods are no longer highly effective at correctly determining whether or not a particular user is a child and therefore preventing children from being able to normally access your service.
5.13 Effectiveness in the context of the children’s access assessment should be considered in relation to the technical accuracy, robustness, reliability and/or fairness of the age assurance methods.
50 Section 36(4)(a) of the Act. 51 Section 36(4)(b) of the Act.
5.14 Reduced effectiveness may relate to:
• The reduced effectiveness of the technical operation of age assurance methods or processes. The reduced effectiveness of the age assurance may potentially affect a service’s ability to correctly determine whether or not a particular user is an adult or a child. • The reduced effectiveness of access control methods which prevent children from gaining access to a service. The reduced effectiveness of the access control method may potentially affect a service’s ability to prevent children from normally being able to access the service.
5.15 Both of these considerations contribute to whether you conclude that it is not possible for children to access your service.
5.16 Table 8 sets out some examples of evidence of reduced effectiveness of age assurance, against the four criteria of highly effective age assurance.

Table 8: Examples of reduced effectiveness of age assurance

Criteria
Example
Technical accuracy
Children (or some children, for example those with a particular protected
characteristic) are inaccurately being identified as adults.
Robustness
Children are circumventing age assurance or access controls.
Reliability
Children are able to access a service that they previously could not gain access to,
while using the same information.
Fairness
Age assurance methods or processes are discriminating against a particular protected characteristic. For example, an AI model that is systematically biased against a particular protected characteristic.
5.17 Evidence of a reduction in technical accuracy, robustness, reliability and/or fairness may therefore trigger a new children’s access assessment. However, not all changes will necessarily mean the service needs to carry out a new children’s access assessment. This is because not all evidence will be considered as relevant. For example, one-off technical failures that do not relate to children that result in a decline in accuracy.
5.18 Evidence of reduced effectiveness could come from user reports, post-signup age checks, media reports, independent research, and vendor updates/warnings, as well as other sources not listed here.

In response to evidence about a significant increase in the number of children using the service

5.19 You must also carry out a new children’s access assessment in response to evidence about a significant increase in the number of children using your service.52
5.20 Any increase in users that are children is relevant as it may be evidence that your service is of a kind likely to attract a significant number of children. As discussed in Section 4, what may be a significant increase for your service, may not be for another, and it is up to you to determine whether there is a significant increase.
52 Section 36(4)(c) of the Act.
5.21 If you are made aware of evidence demonstrating that there is an increase in the number of children using your service, you should carry out a new children’s access assessment. This is because the increase may reflect a significant increase. Indicators of a significant increase could include those from the internal and/or external sources as set out in Section 4. Given that there are many possible threats to the effectiveness of an age assurance process, it is possible an increase in total UK users may reflect a significant increase in child users.53
53 If a service has highly effective age assurance and blocks under 18s from accessing, then any increase in general users is not relevant.

A1 Recording the outcome of children’s access assessments

Approach

A1.1 You must keep a written record of children’s access assessments in a format that is easily understandable.54
A1.2 Below we have set out the steps you should take in order to keep a written record of your assessment. We have also explained whether you will need to record evidence.
A1.3 The record of the outcome of your children's access assessment must be in English or, for services in Wales, it can be in Welsh.

Stage 1: Can children normally access the service or part of it?

A1.4 If you do not use highly effective age assurance, no evidence is required, and you ought to move on to stage 2 of the assessment.
A1.5 If you are using highly effective age assurance to correctly determine whether or not a particular user is a child, with the result that it prevents children from being able to normally access your service or part of it, you must record evidence of the highly effective age assurance and access controls used. You should be able to demonstrate that you have considered the criteria that underpin highly effective age assurance as set out in our guidance on highly effective age assurance, and explain why the age assurance process used is highly effective.55

Stage 2: Is the child user condition met?

A1.6 If you determine that the child user condition is met, it would be sufficient for you to simply record that outcome without requiring evidence. You can use the template below if you wish.
A1.7 If you conclude that the child user condition is not met, you must record this decision. You must be able to justify your decision-making, demonstrating the steps you have taken to reach your decision. You must record evidence against both criteria of the child user condition.

Timing

A1.8 You should also record the date that you completed your assessment and the expected deadline for your next children’s access assessment (within 12 months or sooner in some cases, as set out in Section 5).
54 Section 36(7) of the Act. 55 See Guidance on highly effective age assurance for Part 3 services.

Template

This template may assist you in carrying out a children’s access assessment. You are not required to use this template, but it may help guide you through the process.
Stages of children’s access
Record
Action
assessments
Outcome
Stage 1: Can children normally access the service, or part of the service?
You should
☐ Yes
Record the outcome. You do not need to record any evidence.
only conclude
Move on to stage 2 of the assessment.
that children
☐ No
Record all the evidence you have used and how it demonstrates that your age assurance is highly effective. Record the date you completed your children’s access assessment. Carry out a new assessment within 12 months and: • before making any significant change to any aspect of the service’s design or operation; • in response to evidence about reduced effectiveness of age verification or age estimation that is used on the service, or • in response to evidence about a significant increase in the number of children using the service.
cannot
normally
access the
service or part
of it if you have
highly effective
age assurance
in place to
prevent
children from
normally being
able to access
the service or
that part of it.
Stage 2: Is the child user condition met?
Is my service, or part of my service, of a kind likely to attract a significant number of children?
☐ Yes
Record the outcome of your children's access assessment (the
child user condition is met, and your service is therefore likely to
be accessed by children).
Record the date you completed your children’s access
assessment.
You do not need to record any evidence. Move on to the
children’s risk assessment.
☐ No
Record the steps you have taken and the evidence you have used to reach this outcome. Move on to consider the other criterion of the child user condition.
Is there a significant number of children who are users of my service, or part of my service?
☐ Yes
Record the outcome of your children’s access assessment (the
child user condition is met, and your service is therefore likely to
be accessed by children).
Record the date you completed your children’s access
assessment.
You do not need to record any evidence. Move on to the
children’s risk assessment.
Stages of children’s access
Record
Action
assessments
Outcome
☐ No
Record the steps you have taken and the evidence you have used to reach this outcome. Make sure you have considered both criteria of the child user condition. Record the date you completed your children’s access assessment. You must carry out a new assessment within 12 months and: • before making any significant change to any aspect of the service’s design or operation, • in response to evidence about reduced effectiveness of age verification or age estimation that is used on the service, or • in response to evidence about a significant increase in the number of children using the service.

A2 Case studies

A2.1 These case studies are non-exhaustive, hypothetical examples of services not aimed at children assessing whether their service is likely to be accessed by children.
A2.2 The examples demonstrate how a provider can use the list of factors provided in this guidance to determine whether the service is likely to be accessed by children in practice. All services are different; service providers should make their own assessment based on the context and specific nature of their service.

SME retirement forum

A micro-business sets up a forum where users can discuss retirement plans.
Such a service would not be targeted at children, and this would likely be reflected in its business plan and marketing, therefore the service may conclude that children do not form part of the service’s commercial strategy. The service provider may also consider that the service does not provide a benefit to children, that the content would not appeal to children, and that the design is not attractive to children. The content on the forum is about retirement plans and would therefore appeal to adults. The service provider in this case may therefore conclude that the service is not of a kind likely to attract a significant number of users who are children.
Such a service may also have user data to suggest that there are not a significant number of children on the service. For example, the service’s total user base is 5,000 UK monthly users. It has never deleted any accounts due to reports of the user being a child, or received complaints or reports about users who are children on the service.
The provider concludes that the child user condition is not met. The provider records the date, the outcome, the steps taken, and the evidence used to justify their conclusion.

Community forum

A service is offering an online community forum on travel, building friendships and overcoming challenges. The service is targeted at adult users who are 40 and over. The articles and discussion on the forum relate mainly to travel for women over 40. The other content on the forum discusses new job opportunities for women seeking a career change. Such a service would not be targeted at children, and this would be reflected in the content of the service. The service provider may also consider that the service does not provide a benefit to children, that the design is not attractive to children, and the advertising on the service is targeted at an older adult demographic. The provider considers that the size of its user base allows it to profile it accurately using internal information. It may analyse a range of user data, which suggest that existing users are highly unlikely to be children. It may also look at publicly available statistics on children’s access to services similar to its own. The service also considers whether there have been any reports of users being children, or any under-age accounts being blocked. It has never deleted any accounts due to reports of the user being a child, or received complaints or reports about users who are children on the service.
The provider concludes that the child user condition is not met. The provider records the date, the outcome, the steps taken, and the evidence used to justify their conclusion.

Sport service

A service is offering an online site for information and discussion on local sporting activities. The service does not have an age limit on users, but it targets senior citizens in London. Such a service would not be targeted at children, and this would be reflected in the content of the service. This service provides information to users on sports and other social activities across London targeted at senior citizens. The service provider may also consider that the service does not directly benefit children. In addition, although the service has particular features that children like to use, given the nature of the content and the purpose of the service, the provider may find that it is unlikely that the service will appeal to children. The provider may also consider the marketing strategy for the site. They target an older demographic only and advertising data reflects engagement with adult users. Consequently, the provider may conclude that children do not form part of their commercial strategy. The provider concludes that the child user condition is not met. The provider records the date, the outcome, the steps taken, and the evidence used to justify their conclusion.

Large dating service

A large dating service states in its terms of service that users must be over 18 and asks users to declare their age during registration. The service states publicly that it is not targeted at children and it does not have children on its service. The service provider is initially confident that its service will not be considered ‘likely to be accessed by children’. As the service does not have highly effective age assurance in place, the provider moves on to consider the child user condition. The provider reads through the guidance provided by Ofcom. The provider considers the list of factors provided across both criteria of the child user condition. The provider decides to start their assessment with the second criterion (whether the service is “of a kind likely to attract a significant number of children”). The provider has reviewed available evidence and information on whether children are attracted to their service or similar ones. Publicly available evidence suggests that children, particularly older children, are interested in making connections and building relationships. Research and media reports indicate that this is part of what makes a dating site appealing to children. The provider also acknowledges that some of their sites’ functionalities, such as the ability to create a user profile and to direct message other users are functionalities that are attractive to children. The provider is also aware of news reports of children who have gained access to similar services. Despite the provider’s intention, terms of service, and commercial strategy, it is evident that services similar to theirs appeal to children. In addition, the provider has also received complaints about children using the service. The provider has reason to believe that some children have given false ages. In light of this information and recognising that ‘significant’ is context-specific and can mean a relatively small number, the provider concludes that the child user condition is met. The provider records the outcome. The provider does not need to record any evidence. The provider moves on to the children’s risk assessment.

Search engine

A search engine provides links to other websites and information. The service’s publicly available statement does not have a minimum age requirement for users. No account is needed to access the service. However, there is an option to create an account. The provider reads through the guidance provided by Ofcom. Under stage 1 of the assessment, the provider notes that children can normally access the service. This is because the service does not have highly effective age assurance in place. The provider moves on to stage 2 of the assessment. In order to complete the assessment swiftly, the provider decides to start with the second criterion (whether the service is ‘of a kind likely to attract a significant number of children”). It is publicly known that the service is used by children. The provider also recognises that their service provides benefits from children, for example for educational and entertainment purposes. The provider concludes that the child user condition is met. The provider records the outcome. The provider does not need to record any evidence. The provider moves on to the children’s risk assessment.