Kids in the UK are doodling mustaches on their faces to sneak past digital bouncers. A fresh report from Internet Matters reveals the absurdity. Nearly half of surveyed children—46%—call these age checks easy to dodge. Just 17% find them tough. Drawing facial hair with an eyebrow pencil fools facial age estimation. Holding up a video game avatar during scans works too. Fake birthdays. Borrowed IDs. Simple tricks that shred the illusion of safety under the Online Safety Act.
The Act, enforced by Ofcom since key provisions kicked in last July, demands ‘highly effective’ age assurance for porn sites and platforms hosting harmful content. Platforms like Reddit, Discord, Bluesky, and even Spotify now gatekeep with biometrics or ID uploads (Electronic Frontier Foundation). Apple rolled out checks for UK iPhone users in March, prompting credit card scans or ID submissions to tweak content restrictions (BBC). Gaming giants followed. PlayStation locks voice chat, multiplayer, and messaging behind Yoti face scans or government ID for PS5 and PS4 users. Xbox demands verification for Microsoft accounts.
But effectiveness? Questionable. Internet Matters polled over 1,000 kids and parents. Only 32% admitted bypassing checks recently. Yet 49% still stumbled on harmful content in the past month—feeds pushing violent clips, like one 14-year-old’s tearful encounter with an assassination video on Snapchat. Age gates don’t stop algorithms from serving trouble. And parents? Seventeen percent help kids evade them. Nine percent look away. One mum caught her 12-year-old son penciling a mustache to pass as 15 on Roblox. ‘I did catch my son using an eyebrow pencil to draw a mustache on his face, and it verified him as 15 years old,’ she told researchers.
Rachel Huggins, CEO of Internet Matters, pulls no punches. ‘Stronger action is needed from both government and industry to ensure that children can only access online services appropriate for their age and stage and where safety is built in from the outset, rather than added in response to harm,’ she said in the report (The Register). She flags the prime minister’s recent huddles with social media execs as ‘a timely opportunity for positive change.’ Ofcom echoes the call. ‘This report underlines why the Online Safety Act matters. Without protections like robust age checks, children have been routinely exposed to risks they didn’t choose,’ a spokesperson stated (The Independent).
Critics see deeper cracks. Privacy groups warn of surveillance creep. The Electronic Frontier Foundation labels the Act a threat that ‘restricts free expression by arbitrating speech online, exposes users to algorithmic discrimination through face checks.’ Data breaches prove them right. Discord’s vendor leak in October 2025 spilled 70,000 government IDs uploaded for age verification alone. Yoti, a go-to provider for PlayStation and Spotify, faced fines over data mishaps. Open Rights Group blasts the incentives: platforms grab cheap, invasive tech, repurposing biometrics for marketing (Open Rights Group). Kids end up siloed—support forums for eating disorders or suicide now age-gate, blocking peer help. A 15-year-old griped: support sites ‘have all been censored.’
Regulators push back. On March 12, Ofcom wrote major platforms—Meta’s Facebook and Instagram, Roblox, Snapchat, TikTok, YouTube—demanding stricter enforcement by April 30 (Lewis Silkin). The ICO joined with an open letter urging beyond self-declaration. Their March 26 joint statement ties online safety to data protection, stressing minimal collection. Facial estimation beats ID uploads for privacy, they say—over 80% of adults pick it when offered (TransUnion). Government insists: platforms get only a yes/no on age, no personal details unless essential (UK Government).
Still, circumvention thrives. VPN downloads spiked 1,800% post-porn site rollout. Black markets hawk underage Roblox accounts to predators. A 13-year-old noted the irony: ‘Adults can very easily use a face they searched on the internet… so there might be adults in kids’ age groups trying to groom them.’ Parents confess defeat. ‘Our kids are all clever and savvy and they can get around stuff,’ one mum said. Systems misfire too. A 12-year-old boy scanned as 15, chatting with older Roblox users against rules.
The Act’s reach expands. Proposals eye VPN age checks via the Children’s Wellbeing and Schools Bill—every user proving age to anonymize traffic (Biometric Update). Social media bans for under-16s loom, echoing Australia’s cutoff. Platforms scramble. Some block UK access outright, like niche mental health sites citing verification costs. X users vent frustration. ‘The Online Safety Act has led to mental health support and addiction support having to close access to UK users,’ one posted. Another: ‘Sony has had major data leaks before, and Yoti has been fined for data problems.’
Ofcom’s codes now empower fines up to 10% of global revenue or £18 million. Porn providers rolled out checks July 25, 2025. Category one services—think TikTok, Instagram—face children’s access assessments by summer. But as a 14-year-old put it: ‘The more you restrict it, the more people are going to want to get past that age restriction.’ Enforcement chases its tail. Kids adapt faster than code. Adults trade privacy for access. And harmful content slips through anyway.
So what’s next? Huggins wants safety ‘built in from the outset.’ Regulators demand better tech. Critics push data minimization, global standards. Platforms balance compliance and backlash—PlayStation users call consoles ‘almost unusable.’ The mustache dodge endures as Exhibit A: good intentions, porous execution. UK families watch feeds for the next breach. Or the next pencil prank.
WebProNews is an iEntry Publication