Would You Upload Your Passport To Keep Scrolling? The UK May Ask You To

The UK is preparing to keep under-16s off certain social media platforms, and adults could find themselves reaching for a passport to get past the same gate.

Maya Thomas of privacy campaign group Big Brother Watch called the proposed passport and driving-license checks “a national ID scheme by the back door” in an October 5 statement.^[1]

The government has promised stronger age checks to enforce the restrictions, expected in spring 2027. Its official fact sheet says many adults may avoid a new check using existing account information, such as an account open for more than 16 years, a connected credit card, or an email address whose age has already been verified.^[2]

A passport contains considerably more than proof you’re old enough to watch TikTok. And the UK’s own privacy regulator has warned that demanding official documents can go further than necessary.

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

Asking for more than your birthday

The Office of Communications (Ofcom), the UK’s online safety regulator, already recognizes several ways to check whether someone is an adult. Its consumer guide to age checks describes methods involving identity documents, facial images, banking information, and credit cards.

These are existing options under the Online Safety Act, rather than a finalized list of requirements for the under-16 restrictions. They show what proving your age can involve:

A credit-card check is different from a credit check used to assess borrowing. It also has a limitation: Confirming someone is over 18 doesn’t provide an option for eligible 16- and 17-year-olds.

Depending on the system, the social media platform may receive only an age confirmation. But another company could still handle the documents or other information needed to produce it.

That makes the company behind the check, and what it keeps afterward, part of your privacy decision.

Australia shows why the checks could get tougher

In its March compliance update, Australia’s eSafety Commissioner reported that some platforms let under-16s repeatedly attempt age checks until they received a result saying they were old enough.

The regulator also noted that facial age estimation has higher error rates for children close to the 16-year threshold. Some platforms allowed double-digit attempts, despite their age-check providers recommending no more than five.

That creates pressure to ask for additional evidence when a result looks doubtful, potentially including a bank- or ID-based check.

Ofcom’s 2026 age-assurance report says no single method eliminates the risk of people getting around it. The regulator is preparing an assessment of how checks could establish whether users are over 16, due before Parliament by the end of October.

So the final process is still being developed. A passport upload is a possible method, rather than a confirmed requirement for every adult.

Age-related ID documents have already been exposed

There’s a reason to ask what happens to an ID image after you submit it: A data breach can expose the information you handed over.

In October 2025, Discord disclosed that approximately 70,000 users may have had government-ID photos exposed after an attacker compromised a third-party customer-service provider. Those photos had been used to review age-related appeals.

The incident involved customer support, rather than Discord’s current automated age-check system. Still, it demonstrates the risk when copies of identity documents enter a service’s support process.

Discord’s current age-check methods receive an age signal rather than users’ ID documents, and its age-assurance vendors delete verification data after the check.

You shouldn’t have to reveal everything to prove one thing

The UK’s Information Commissioner’s Office has already drawn a line around excessive collection.

“In many cases it may be excessive to see an official document,” the regulator says in its age-assurance guidance.

It explains that a less intrusive method may be sufficient, and that a service may need to record only whether someone meets the age threshold.

The guidance also says companies must explain what information they need, whether a third party will handle it, and whether they’ll retain it, including why and for how long.

Author Details

Thomas Kent

About the Author

Thomas Kent is a multi-disciplined reporter with over a decade of experience covering online platforms, digital trends, and consumer-facing tech. Tom focuses on digital privacy, data tracking, and user behavior, with a particular interest in how cookies, online surveillance, and platform design shape the modern internet experience. His reporting takes a research-driven, news-focused approach, translating complex technical topics into clear, accessible insights.