Ofcom has opened an investigation into whether TikTok is meeting its legal duty to prevent children encountering harmful content, placing the performance of the platform’s age inference technology under formal scrutiny.

The inquiry concerns TikTok Information Technologies UK Limited and its obligations under section 12 of the Online Safety Act. Services likely to be accessed by children must use proportionate systems to prevent or reduce exposure to specified harmful material, while access to primary priority content must be controlled through age assurance that Ofcom considers highly effective.

Those duties took effect on 25 July 2025. Ofcom’s investigation follows a review of protections used by major platforms, research into children’s online experiences, and a separate assessment suggesting that some age inference models may fail to identify a significant proportion of under-18s correctly.

TikTok estimates age through account information and behavioural signals rather than relying solely on the date of birth entered at registration. Such models can identify some children who provide a false age and avoid imposing identity checks on every adult user, although performance depends on the data used, confidence thresholds, and the treatment of uncertain cases.

Opening an investigation does not establish that TikTok has broken the law. Ofcom expects its initial evidence gathering to last at least three months and plans to publish an update in October.

The regulator can impose fines of up to £18 million or 10% of qualifying worldwide revenue where a breach is established. Beyond the potential penalty, the case could define what evidence platforms must hold when an age assurance system is proprietary, probabilistic, and largely invisible to users.

Protection depends on the whole chain

Age assurance is often reduced to a comparison of accuracy percentages, yet a platform’s protection depends on what happens before and after the classification. A model may identify most users correctly while leaving a large absolute number of children unprotected on a service with millions of accounts.

False positives create a different problem by restricting adults and sending them into appeal procedures that may require documents, facial estimation, or other sensitive evidence. Platforms therefore have to choose thresholds that balance child protection, privacy, user access, and operational cost rather than maximising one measure in isolation.

A stronger process might combine behavioural inference with identity documents, mobile network information, facial age estimation, payment data, or reusable digital identity services. Each additional source can improve confidence, while also increasing the quantity of personal information collected and the consequences of misuse or a security breach.

The TikTok inquiry raises governance questions familiar across other forms of algorithmic decision making. Machine learning systems are used to assess fraud, credit, employment applications, customer treatment, and access to services, yet compliance cannot rest on a supplier’s statement that a model performs well.

Organisations need testing data, performance broken down by relevant groups, documented thresholds, change controls, human review, and records showing what happened when a decision was challenged. An overall accuracy figure can conceal poor performance for a smaller demographic group or a model that degrades as user behaviour changes.

TikTok will also have to demonstrate that age classification connects effectively with the product’s content controls. Identifying an account as belonging to a child achieves little when recommendations, search, direct messaging, livestreaming, or advertising continue to expose that account to restricted material.

Ofcom can therefore examine the path from inference to platform behaviour rather than treating the age check as a separate gateway. That approach will be important because many safety failures occur when information is generated correctly but fails to change what the wider system does.

The Online Safety Act allows platforms to follow Ofcom’s codes or use alternative measures capable of meeting the law. Flexibility gives services room to develop their own systems, although it also requires evidence that a bespoke approach achieves the required outcome. Technical sophistication does not compensate for weak performance.

Regulation will have to remain proportionate because no age estimation system will classify every user correctly. An impossible standard could push platforms towards intrusive identity checks across large parts of the internet, while a weak standard would permit formal compliance without protecting the children the legislation covers.

The eventual findings will influence how platforms document model performance, how technology suppliers sell age assurance, and how much information users must provide before a service decides which content and functions they can access. Ofcom’s first task is narrower: establishing whether TikTok’s controls work well enough to satisfy the law already in force.