About 150,000 teenagers have no photo ID, the backstop check behind Ofcom's plan for the under-16 social media ban. The number comes from a school survey supplied by the company that just made the card free.
Estimated reading time: 7 minutes
In short. Ofcom published two reports on 29 October 2026 to inform Parliament's debate on the under-16 social media ban, due in regulations "before the end of 2026" [2]. The first names photo ID as "required as part of the method itself, or as the likely backstop" for three of the four age-check methods it recommends, and puts the number of 16 and 17 year-olds with neither a passport nor a driving licence at "around 150,000" [1] (p.20), a figure its own footnote says is "estimated from a non-representative sample survey conducted in schools with 8,459 respondents", supplied by CitizenCard, the one company that happened to start giving its PASS-accredited card to 16 and 17 year-olds for free the same month [1] (pp.20-21). The second report, published the same day, found that app stores, used by three-quarters of children to go online, "are not currently regulated services under the Act" and "did not consistently use any age assurance method" [3] (p.3), with Ofcom stating plainly it has "not made any specific recommendations" on changing that [3] (p.32). Two documented mistakes: four stars.
This site has already found gaps around the edges of the under-16 social media ban: a parents' guide page whose "last updated" stamp predated the government's own announcement [5], and a fact sheet that promised research on children using VPNs to dodge age checks and then never mentioned the research once it existed [6]. Today's pair of documents is different. These are not administrative slips on the edges of the policy; they are Ofcom's own evidence base for the central mechanism, published at the Secretary of State's request specifically "to help inform Parliament's consideration of the Government's forthcoming detailed rules for the ban" [2]. Read past the headline findings, and the evidence underneath both documents is thinner than the confidence of the announcement suggests.
The number the whole backstop rests on
Ofcom's rapid assessment identifies four methods it considers "currently capable of being highly effective" at checking whether someone is 16 or over: photo ID matching, banking-based checks, digital identity services and facial age estimation [2]. Photo ID sits underneath most of that list, not just one branch of it: it is the method itself for photo ID matching, the document typically needed to open the bank account a banking check relies on, and "either required as part of the method itself, or as the likely backstop" when facial age estimation's margin of error triggers a second check [1] (p.20).
How many 16 and 17 year-olds can actually produce one matters, then, more than almost any other number in the assessment. Ofcom's own data here is solid as far as it goes: 2021-22 Census figures put passport ownership at 89% for both 16 and 17 year-olds, and August 2026 Department for Transport data puts provisional driving licence ownership at 19% for 16 year-olds and 65% for 17 year-olds [1] (p.20). But those two figures overlap, and the question that actually measures the gap, how many hold neither, is one the Census and the DfT data cannot answer. Ofcom says so itself: "we do not know the exact number of young people who have neither a passport nor (provisional) driving licence." What follows is not official data but a single outside estimate: "evidence provided to us by CitizenCard suggests that around 150,000 16- and 17-year-olds across the UK hold neither" [1] (p.20). The footnote attached to that sentence is the only place the method appears: "Estimated from a non-representative sample survey conducted in schools with 8,459 respondents aged 16 and 17" [1] (p.20). The one figure that quantifies how many teenagers the backstop fails is a convenience sample from a single body, not a figure Ofcom has independently verified.
That body is also the one supplying the fix. The same section records that "since 1 October 2026, CitizenCard has offered their PASS-accredited photo ID card to 16- and 17-year-olds in the UK for free," a change made, in Ofcom's words, "to facilitate the accessibility of proof of age ID in support of the social media ban announcement", and concludes from it that "there will not be an additional cost burden on 16- and 17-year olds outside of Scotland to obtain photo ID when the regulations come into force" [1] (pp.20-21). CitizenCard describes itself as a non-profit, and nothing here suggests bad faith in the offer. But it is still a single company's unilateral, reversible pricing decision, not a condition written into the regulations and not a government funding commitment. Nothing in the assessment binds the card to stay free once the regulations are in force and the attention that prompted the gesture has moved on.
The gateway nobody is regulating
Published the same day is Ofcom's "Report on the use of app stores by children" [3], which Ofcom's own publication page describes as a companion to the age assurance assessment: "Alongside this report, we have published our rapid assessment of highly effective age assurance at 16 to inform parliamentary debate on the draft social media ban regulations" [4]. Its opening line sets the boundary plainly: "App stores are not currently regulated services under the Act" [3] (p.3). Its own survey finds that this is not a marginal gap: among children aged 8 to 17 who go online, "three quarters (75%) said they most commonly did this using apps that they downloaded from an app store, while two in ten (20%) said they most commonly used a web browser" [3] (p.22). The access route most children actually use sits outside the regime the age-check assessment is designed for.
Ofcom's analysis of what that unregulated layer currently does is unambiguous: "All of the app stores we analysed relied on children declaring their age. While a small number used additional checks in limited circumstances, they did not consistently use any age assurance method to correctly establish if the user was a child" [3] (p.3). The report documents what that looks like in practice: in its discovery-controls testing, "Call of Duty (PEGI 18) was encountered by a five-year-old's account searching on the Microsoft store", and "one app store promoted the dating app Tinder (aged 17 and over) as an 'essential' app to a 14-year-old's account" [3] (p.29).
Given all of that, the report's own next step is strikingly open-ended. "The question of whether there should be any new regulation for providers of app stores, and what form it should take, are questions for the UK Government. Therefore, we have not made any specific recommendations on this. If the Government decides to explore potential new regulation using their powers in the Act to regulate app store providers, we would be happy to support them in designing any new framework" [3] (p.32). The power to bring app stores into scope already sits in the Online Safety Act. Whether to use it is framed as entirely open, with no date and no commitment attached, while the regulations for the ban itself are due "before the end of 2026" and enforcement begins in 2027 [2].
The claims, tested
| The document's own words | What the evidence actually shows | Verdict |
|---|---|---|
| "An estimated 94% of people aged 16 and over in the UK have either a passport or driving licence" [1] (p.20) | The 6% gap this implies is not Ofcom's own data; the one estimate of how many hold neither document, "around 150,000", comes from "a non-representative sample survey conducted in schools" run by a single outside body [1] (p.20) | The scale of the accessibility problem the backstop exists to solve is an estimate from one interested party, not verified national data |
| "There will not be an additional cost burden on 16- and 17-year olds outside of Scotland to obtain photo ID when the regulations come into force" [1] (p.21) | That conclusion rests entirely on CitizenCard's own voluntary decision, from 1 October 2026, to stop charging 16 and 17 year-olds [1] (pp.20-21) | A single company's reversible pricing policy, not a regulatory guarantee, is standing in for a funded solution |
| Age checks will be required of "regulated services" to deliver the ban [2] | Three-quarters of children say apps downloaded from an app store are how they most commonly go online [3] (p.22), and app stores sit entirely outside that regulated perimeter [3] (p.3) | The access route most children use is not covered by the mechanism the ban depends on, and Ofcom has made no recommendation to change that |
The mistakes, counted
The headline accessibility figure is one company's survey, not verified national data (1). Ofcom's own passport and driving licence ownership figures come from the 2021-22 Census and August 2026 Department for Transport data [1] (p.20). The figure that actually measures the scale of the problem, how many 16 and 17 year-olds hold neither document, comes instead from "a non-representative sample survey conducted in schools with 8,459 respondents", supplied by CitizenCard, which also happens to be the party that then removed the fee for its own card [1] (pp.20-21). Ofcom's conclusion that the policy will carry "not an additional cost burden" depends on that single company continuing a decision nothing in the regulations requires it to keep.
App stores handle most of children's internet access and remain unregulated, with no recommendation to change that (2). Three-quarters of children say apps from an app store are their main way online [3] (p.22). Ofcom's own testing found a PEGI 18 game reaching a five-year-old's account and a 17-plus dating app recommended to a 14-year-old's [3] (p.29). Ofcom nonetheless states it has "not made any specific recommendations" on bringing app stores into scope, leaving the decision, and any timetable for it, entirely to government [3] (p.32).
Credit where due
Both weaknesses are disclosed by Ofcom itself, in its own footnotes and its own words, not uncovered by digging. The regulator did not need to publish the "non-representative sample" caveat; it did [1] (p.20). It did not need to state outright that app stores sit outside the Act and that it has made no recommendation on them; it did that too [3] (pp.3, 32). The four age-check methods the assessment identifies are also a genuine narrowing from the seven Ofcom already recognises as highly effective for adults, done honestly rather than papered over: fewer choices exist at 16 than 18, and the assessment says so plainly before explaining the consequences [2].
Verdict
Four stars, two documented mistakes. Ofcom has done something genuinely useful here: it has put two pieces of evidence in front of Parliament before the regulations are drafted, rather than after, and it has been candid about where that evidence is thin. But candour about a weakness is not the same as fixing it. The single number that measures how many teenagers the photo ID backstop will fail to reach comes from one company's school survey, and the access route most children actually use to go online is left entirely outside the system the ban is built on, with no date for when, or whether, that changes.
The star score counts two documented mistakes. First, the one figure that measures how many 16 and 17 year-olds lack any form of photo ID, the backstop method behind three of Ofcom's four recommended age checks, comes from "a non-representative sample survey conducted in schools" supplied by CitizenCard, not from the Census or Department for Transport data Ofcom uses elsewhere in the same assessment; the "no additional cost burden" conclusion then rests on that same company's voluntary, reversible decision to waive its own fee. Second, app stores, which three-quarters of children say is how they most commonly access the internet, remain outside the Online Safety Act's regulated perimeter, and Ofcom's own report states it has made no recommendation on changing that, leaving the decision and any timetable to government. Two falls in the 1 to 3 band: four stars; the bands are on the ratings page. This piece makes no finding about the conduct of any named individual; CitizenCard's non-representative sample size and the app store regulatory gap are described using Ofcom's own words, read directly off its published reports. All sources below were fetched directly on 29 October 2026; none returned an error.
Sources
- Rapid assessment of highly effective age assurance at 16, Ofcom, published 29 October 2026
- How age checks at age 16 can work to underpin UK's social media ban, Ofcom, published 29 October 2026
- Report on the use of app stores by children, Ofcom, published 29 October 2026
- Report on the use of app stores by children, Ofcom publication page, published 29 October 2026
- Ofcom's guide for parents promises an under-16 social media ban from 2027, Tracked Changes, 8 October 2026
- The government's fact sheet on banning social media for under-16s promised a VPN research update, Tracked Changes, 19 September 2026