decrypted · 30 october 2026 · vulnerabilities and patching · supply chain · uk policy and law · surveillance and privacy

Ofcom's age-check shortlist: the question is what gets kept

On Thursday Ofcom narrowed the ways social media firms may check that a user is 16, ahead of the government's under-16 ban. Four methods survive. None is foolish on its own. The Secure by Design question is what each one leaves behind once the check is over, and Ofcom's published material does not yet answer it.

What Ofcom shortlisted

Ofcom's rapid assessment found four methods currently capable of being highly effective at 16: matching a photo identity document to a live image of the user, a bank-based check using the bank's own age record with the user's consent, a reusable digital identity, and facial age estimation. Estimation has a margin of error of a few years at 16, so Ofcom suggests a Challenge 25 style approach: estimate first, then verify properly anyone close to the line.

The government says its first regulations will arrive before the end of 2026, with the ban in force next year.

Who gets left out

Ofcom estimates that 94% of people aged 16 and over hold a passport or driving licence, and that around 150,000 sixteen and seventeen year olds have neither. That figure leans on a survey of 8,459 pupils that Ofcom itself calls non-representative. Free proof-of-age cards are one route in. It accepts, as The Register reports, that the risk of circumvention cannot be entirely eliminated.

The design question

Think of a good age check as a bouncer who glances at your licence and says yes or no. A poor one photocopies it, files it and keeps the copy.

Ofcom says age checks at 16 will involve processing personal data, and concludes they can be delivered in a way that protects privacy and complies with data protection law. It will keep working with the Information Commission. The pages I read give no retention periods. Photo matching means passports and live face images passing through third-party providers, which is why Big Brother Watch calls the plan a national ID system by the back door. The security point is simpler: a provider holding large stores of passport images is a target, and the safest copy is the one that does not exist.

What Secure by Design would ask for

A yes or no, nothing more. The platform should receive "over 16" and not the document or the face.
Deletion as the default. Evidence is discarded once the result is issued, with the rule written down and audited.
No single point of failure. Ofcom's separate app store report says a layered approach avoids exactly that. It found app stores rely on self-declared age and are not currently regulated under the Online Safety Act.

What this means for you

If you run a service with young users, or supply one, the age check will probably be bought in. Opinion, not advice: put deletion, sub-contractors and breach notification in the contract before launch, and do not build your own store of identity images.

Also this week

Cisco's second exploited VPN zero-day since August. Cisco said on 28 October that attackers are exploiting CVE-2026-76418 in the remote access SSL (the older name for the browser padlock encryption) VPN service of Secure Firewall ASA, Cisco's long-running firewall line, and FTD, its newer firewall software. Cisco scores it CVSS 8.6. An unauthenticated attacker can force the device to reload, because of logic errors when secondary authentication is configured on a tunnel group. Cisco says it became aware of exploitation in October and offers no workaround beyond disabling that setting. Fixed releases include ASA 9.24.1.27 and 9.24.10.1, and FTD 7.7.14, 7.6.7, 10.0.3 and 10.1.1, so check your version against the advisory today. BleepingComputer links it to an earlier exploited flaw in the same service, CVE-2026-20349, and cites Shadowserver counting more than 51,000 Cisco ASA SSL VPN devices exposed online. A crash is not a breach, but a firewall that reboots on demand is one your branch offices and home workers lose. The design lesson is that your VPN login page is the one door you cannot hide, so know who owns its patching and how quickly they act.

Amadeus breach reaches Japan Airlines. Japan Airlines says Amadeus, which runs its reservation, ticketing and check-in systems, told it on 23 October of unauthorised access. About 92,000 customers are affected, around 2,000 of them with passport numbers and similar details. BleepingComputer reports access ran from 10 August 2023 to 23 September 2026, and that other airlines are affected. I have not seen that second claim confirmed elsewhere, and I have not seen UK impact reported. If the dates hold, an intruder sat inside one supplier for three years. That is the supply chain lesson in miniature: one supplier, many customers' data. UK firms should ask critical suppliers for log retention in months, a notification deadline in hours, and the right to read the incident report.

Sources

If you want help working out what your suppliers actually keep, get in touch.