A new report, commissioned by the Department for Science, Innovation and Technology (DSIT) and conducted by BMG Research, has shed light on the widespread issue of children bypassing online age restrictions. The study underscores the significant challenge in implementing effective age verification systems, revealing that a substantial number of young people actively seek and share methods to circumvent digital controls.
Dr Hisham Al-Assam, Associate Professor in Computing at the University of Buckingham, lauded the report as a crucial step towards a more realistic understanding of online child safety. He emphasised that, from a cybersecurity perspective, the findings align with the broader principle that any security control inherently creates incentives for workarounds, especially when users perceive restrictions as unfair. Dr Al-Assam highlighted that this behaviour is not unique to children but is a fundamental aspect of cybersecurity, necessitating that future age restriction assessments consider both blockage effectiveness and resilience against bypass attempts.
The study also exposes a notable disparity between political aspirations and technical realities concerning age verification. Dr Al-Assam pointed out that public discourse often suggests age verification can reliably prevent underage access while simultaneously safeguarding privacy. However, achieving both objectives simultaneously in practice is complex. Enforcing strict age checks could require millions of British adults to surrender sensitive personal data, such as passports or biometric scans, to technology companies, while tech-savvy teenagers may simply bypass these barriers.
Professor Alan Woodward, Professor of Cybersecurity at the University of Surrey, commended the report's robust methodology, describing it as a "well-designed survey." He noted that the study's large, nationally representative sample and consistency with independent estimates from Ofcom and Childnet lend significant credibility to its headline figures. Professor Woodward reiterated the report's finding that approximately four in ten children claim to have circumvented an age check, underscoring the scale of the challenge.
Crucially, the report does not suggest that age-based restrictions are inherently unworkable. Instead, it argues that success should be measured by the resilience of these systems against determined users. Modern tools like VPNs, proxy services, AI-generated identities, deepfakes, and online communities that rapidly share circumvention techniques mean that any technical solution will face continuous pressure. Dr Al-Assam hopes the report will prompt policymakers to evaluate future proposals not just on their stated intentions, but also on their technical resilience, their impact on privacy, and the potential unintended consequences for millions of law-abiding users.