Apple adds UK adult checks and age-range sharing

Apple has introduced age verification features for UK Apple ID users in response to new safety regulations. The implementation of these tools is part of the broader Online Safety Act, which aims to protect children online and regulate digital platforms more strictly.

• Apple now asks UK users to confirm that they are 18 or older before certain services, settings and 18+ app downloads become available.
• A separate Declared Age Range API can give apps an age band rather than a birth date; app developers still retain their own legal and safety duties.

Two mechanisms, not one universal identity check

Apple's UK changes are best understood as two connected but distinct controls. The first is adult confirmation at Apple Account level. Apple's UK account requirements say an adult may have to confirm being 18 or over to use certain services, features or actions. The second is the Declared Age Range API, introduced with regulatory features in iOS and iPadOS 26.4, through which an app can receive an age category without receiving the user's date of birth.

This is narrower than a rule requiring every user to upload identity documents before using an iPhone. Apple's adult-confirmation guidance says a person who does not confirm can continue to use the device. Confirmation is required to turn off certain safety settings or download and purchase apps rated 18+. A prompt can appear when an account is created, after a software update, when safety settings change or when an adult-rated app is requested.

How confirmation works

Apple lists several routes: an eligible credit card, a passport, a driving licence and specified UK proof-of-age cards accredited under PASS. Debit and gift cards are not supported for this purpose. Existing account and purchase history may also help establish adult status. A child under 13 cannot create an account alone and instead depends on a parent or guardian using Family Sharing.

The default restrictions are also more precise than the original account suggested. Web Content Filter and Communication Safety are enabled for children and teenagers, and for adults who have not confirmed their age. Apple is therefore not merely detecting a user as under 18 and then switching filters on; it also treats an unconfirmed adult account conservatively until confirmation occurs.

What apps receive—and what they do not

Apple's Age Range for Apps privacy notice says the shared output is a range, not a date of birth. The calculation can use the birth date associated with the Apple Account, country or region and Family Sharing role. Users can configure whether an app must ask first, always receives the range or never receives it; parents or guardians control sharing for younger family members. Shared settings sync with end-to-end encryption.

That design reduces the amount of personal information exposed to each app, but it does not remove the trust question. When a document is used, Apple says the image is handled by Apple and its service providers only long enough to confirm age and prevent fraud, then deleted. The account layer still becomes a consequential point for eligibility, family status and access decisions, so accuracy, appeals, accessibility and service-provider handling remain material.

The UK legal boundary

Ofcom's age-assurance guidance requires in-scope services that allow pornography or certain content harmful to children to use highly effective age assurance. It describes verification, estimation and combined techniques and assesses whether methods are technically accurate, robust, reliable and fair. Those statutory duties attach to regulated services according to their function and content; Apple's device and account controls are not a universal substitute for each service's compliance.

Apple explicitly tells developers that they remain responsible for applying their own age restrictions and checking users where law requires it. Ofcom welcomed the launch, as Telecoms.com and the Guardian reported, but welcome does not transfer all Online Safety Act obligations to Apple. The ICO and Ofcom joint statement also underlines that child-safety duties and data-protection law must be satisfied together.

Why it matters

Apple now controls an important assurance layer between an account, a device and participating apps: when adult confirmation is requested, which methods count, which safety defaults remain enabled and which age category an app may receive. Developers control how their services interpret the signal and remain accountable for access rules. Regulators define effectiveness and privacy expectations, while users and parents make sharing choices inside Apple's framework.

The practical tests are therefore measurable: false acceptance and rejection rates; whether supported methods exclude people without credit cards or specified identity documents; how quickly errors can be appealed; whether developers treat a range as one input rather than blanket proof of compliance; and whether document handling matches Apple's deletion promise. The change is significant, but its importance lies in the allocation of control and responsibility—not in an unsupported claim that every UK Apple user must identify themselves.