Summary

  • Ofcom's 29 October report lists WhatsApp as 13+ in Apple's store, PEGI Parental Guidance Recommended in Google Play and PEGI 3 in Microsoft's store. A suitability label can change with the shop, even under the same PEGI system.
  • All eight stores in Ofcom's selected sample asked users to declare an age at account creation. That declaration was the main input for their child-account and download controls; the stores are currently outside the Online Safety Act's regulated-service duties.

Which age is a parent meant to trust when the same app has three? Ofcom's statutory report gives a remarkably ordinary example. WhatsApp carried 13+ on the Apple App Store, a PEGI parental-guidance warning on Google Play and PEGI 3 on the Microsoft Store. The latter two are both PEGI labels. A family's download setting can therefore meet different labels for the same product. The labels describe store suitability, not the service's minimum account age.

The inconsistency reaches the gate. Ofcom asked eight selected app-store providers how their systems work, used child-account testing and surveyed children and parents. The evidence was gathered mainly from November 2025 through August 2026. All eight asked for an age or date of birth when an account was created. That answer drove account type, consent requests and protections. In testing, a child who declared an adult age could download an 18-rated app from stores relying on self-declaration. The test is a demonstration of the control's dependency, not a measurement of every child's behaviour.

There is a second dependency upstream of the label. Developers supply content and feature information when submitting apps. Stores combine that information with automated and human review to assign ratings. Six of the eight said every submission received some human review, though the depth varied. A store can examine an app before release; it cannot inspect every future conversation or user-generated post at that point. Ofcom found most sampled stores did not monitor apps continuously after release.

The stakes are practical. A parent can approve a download on the strength of a label that another shop would render differently. A child account can inherit the wrong protections because its age was typed rather than established. Ofcom's report does not say an underage download equals exposure to harmful content, and it keeps the current legal duty for that content with the regulated app service. The store still decides what its shelf says and what its gate does. Those two decisions need a shared, auditable age signal if they are to bear the weight placed on them.

Ofcom's report can inform a future government decision on regulating app stores. No store duty was created by publishing it. The next fact that would change this assessment is a rule defining who must verify the child's age, who must maintain the app-risk label, and how a conflicting label is corrected.