DOI: https://doi.org/10.58248/RR106 

What is facial age estimation? 

Facial age estimation (FAE) is a machine learning technology that uses AI to estimate a person’s age from a facial image. It estimates age in three steps:  

  1. Capture: an image of the face is taken or uploaded. 
  2. Feature extraction: the image is converted into a numerical representation of the face. 
  3. Estimation: the numerical representation is matched against patterns from faces of a known age to give an estimated age or age range. 

FAE sits within the broader category of ‘age assurance’, the umbrella term used by Ofcom and the Information Commissioner’s Office (ICO) for techniques that establish or estimate age.  

These also include facial recognition, which identifies people from other images of them in and databases, and age verification, which confirms age against a trusted source, such as a passport. FAE does neither of these things and instead specifically analyses a person’s face.  

There is no method that establishes an exact age, so services build in a margin of error by setting a ‘challenge age’ above the threshold they need to check. For example, a service that needs to confirm a user is over 18 commonly applies a challenge age of 25 to reduce the chance that people under the age of 18 are admitted. 

Where is facial age estimation used in the UK? 

The use of age checks in the UK increased following the Online Safety Act 2023, which requires platforms hosting harmful content, such as “pornography, or content which encourages self-harm, suicide or eating disorder content”, to implement “highly effective age assurance” to prevent access to children. Dedicated pornography sites have had to comply since January 2025, with broader duties taking effect in July 2025.  

Ofcom does not say how a platform must verify a user’s age, but if it does not do so, Ofcom can impose significant penalties (up to £18 million, or 10% of worldwide turnover, whichever is greater). 

Ofcom recognises FAE as one of several “highly effective” age assurance methods. It has already been deployed by platforms such as Instagram, Sony PlayStation, and OnlyFans, and has also been trialled in retail settings like supermarket self-checkouts for age-restricted purchases. 

FAE providers are usually private firms. However, the ICO’s UK Age Check Certification Scheme can accredit their technologies. 

How accurate is facial age recognition? 

FAE provides an estimate rather than a definitive age, and the accuracy varies depending on the system or algorithm used, image quality, and demographic factors such as age, sex and ethnicity.  Independent testing by the US National Institute of Standards and Technology (NIST) in 2024 shows that no single system performs consistently well across all circumstances . 

Home Office and NIST testing indicates FAE systems are better at judging whether someone is above or below an age threshold than estimating an exact age, with accuracy lowest around 16 to 18 years. The ‘Mean absolute error’, the gap between a person’s estimated and actual age, in estimating age from visa photos has improved from 4.3 to 3.1 years, but it remains around 2.5 years at the critical 16 to 18 boundary according to Home Office guidance, with consistently higher error rates for female faces (PDF).   

One supplier, Yoti, reports a mean absolute error of 1.2 years for ages 6 to 12, and 1.3 for ages 13 to 17. However, a 2026 Department for Science, Innovation and Technology study said that “even with 1–2 years average error, this means that there are cases where a 12-year-old could be mistaken for 14, or a 16-year-old for 18”.  

The same study said that the main barrier to improving accuracy and fairness was limited high‑quality, representative data, and noted the market is unlikely to resolve this alone.  

How is facial age recognition regulated? 

Because FAE processes facial images, it falls under the UK GDPR and Data Protection Act 2018. While identifying someone via facial data counts as “special category” biometric data, FAE generally does not because it does not identify individuals, it just estimates their age.  

Ofcom and the ICO say that age assurance must be necessary, proportionate and data-minimising (PDF), and that privacy risks increase if images are stored or reused. 

In practice, organisations must: 

  • establish a lawful basis, with parental consent where required 
  • ensure fairness and transparency, including age-appropriate transparency notices 
  • demonstrate accountability through Data Protection Impact Assessments (DPIAs)  

The ICO has published DPIA guidance and examples for the Children’s Code. 

Where used by public authorities, FAE also engages human rights law, which states that any interference with privacy (Article 8) or expression (Article 10) must be lawful and proportionate. While courts have not tested these principles for FAE, a 2020 ruling found covert use of facial recognition to identify individuals was unlawful.  

The Equality Act 2010  may also apply if FAE technologies perform less well for certain groups.  

Oversight of FAE technologies remains fragmented, with no single governing law. Instead, regulation spans data protection, human rights and equality law, alongside oversight bodies such as biometrics commissioners.  

A government consultation on a new framework for law enforcement use of facial recognition, intended to consolidate this patchwork, ended in February 2026. Also, the Ada Lovelace Institute has called for a comprehensive legal framework for biometric technologies.  

Could facial age recognition be used in immigration enforcement? 

The use of FAE is being explored for asylum age assessments where officials must decide if an unaccompanied person is a child or adult. This decision will shape their care and legal process. These decisions are made following established case law  and the Nationality and Borders Act 2022. 

However, if a child is wrongly identified as an adult they could lose safeguarding protections, and if an adult is wrongly identified as a child they could pose safeguarding risks to other children placed with them.  

Even without FAE, age assessment is uncertain and often revised. For example, official statistics accredited by the Home Office say that of 6,400 cases in the year to March 2026, 43% were initially assessed as adults. Of those initially deemed to be adults in July to December 2025, 17% were later found to be children. A 2025 report by the Independent Chief Inspector of Borders and Immigration found inconsistent decision-making (PDF).  

The Home Office plans to test FAE in 2026, with possible advisory use from 2027, which is intended to supplement, rather than automate, decisions. 

However, the use of FAE for immigration enforcement is contested. In 2025, Human Rights Watch said FAE has “has not been independently evaluated in real-world settings”. In 2026, the CEO of the British Association of Social Workers said “‘the social work method’ is the best way to assess a young person’s age, given that AI estimation technology is fallible”.  

Some groups argue FAE should only be advisory (PDF).  

What are the ethical concerns? 

Some legal experts say there is a conflict between protecting children from harm, and protecting their rights. They say that interference with their rights to privacy or free expression must be lawful, necessary and proportionate. 

Others say that FAE could be less intrusive than technologies to identify a person or retain their image, rather than just estimate their age. Some researchers and organisations say that facial recognition systems (that could identify a person) may “give rise to considerable concern regarding data privacy and security”. The ICO expects consent, transparency and data minimisation to be central to any deployment. 

Bias is also a concern. The Home Office noted that FAE performance can vary by “ethnicity, skin tone, gender, place of birth and quality of input image”. There are similar concerns for facial recognition technologies, which have higher false-positive rates for Black and Asian faces, and for Black women in particular.  

In their Children’s Code, the ICO warned that there are risks from FAE to fairness and non-discrimination without appropriate testing, representative data, and a mechanism for users to challenge decisions. 

Finally, age assurance may affect free expression. While the Online Safety Act does not prohibit legal adult content, poorly designed or intrusive checks risk deterring adults legitimately accessing it.  

What is the future of facial age recognition ? 

The use of FAE is likely to expand as online safety rules are enforced and trials progress. Key developments include Ofcom’s enforcement decisions, Home Office testing in 2026, possible use along the UK border in 2027, and the outcome of the government’s facial recognition consultation, which ended in February 2026. But challenges remain, particularly due to limited data on effectiveness in real-world situations, particularly at the under-18 threshold and across diverse populations. 

Key questions for parliament 

Policy questions in the future include:  

  • What level of verified accuracy for FAE is sufficient? 
  • Should stricter standards apply in high-risk situations like immigration?  
  • Should independent audits be mandatory and published? 
  • What oversight is needed as the technology evolves? 

Acknowledgements 

  • Professor Subhajit Basu is a Professor of Law and Technology at the University of Leeds. 
  • POST is grateful to the author for kindly giving his time to produce this briefing.  
  • Questions about this briefing should be referred to Simon Brawley (post@parliament.uk), who acted as parliamentary lead for this work.