Age Assurance: A Targeted Regulatory Trajectory Emerges

The Global Online Safety Regulators Network (GOSRN) (whose members include Ireland, the UK, Australia, Fiji, France, the Republic of Korea, Slovakia, South Africa and the Netherlands) published a coordinated statement entitled "Age Assurance & Online Safety Regulation" on 23 January 2026.

This update builds on several developments we have previously examined, including our deep dive into the European Commission's Child Online Safety Guidelines (here) and our analysis of the EDPB's approach to age assurance (here), both of which highlight the increasing regulatory scrutiny in this area.

While the statement does not introduce new or binding legal obligations, it sends an unequivocal message about the regulatory direction of travel: age assurance is a central, baseline component of online safety governance and not an optional extra.

Key takeaways from the GOSRN Statement

Below, we break down the key themes and what they mean in practice for organisations operating in the digital services space.

1. Effectiveness is the focus
   The statement reinforces a shared global regulatory priority that protecting children online is non‑negotiable. The conversation has shifted from whether age assurance should be implemented to how effective such measures are in practice. Although the current laws do not prescribe a single model for age assurance, organisations whose services may be accessed by minors should treat the implementation of robust, fit‑for‑purpose age assurance systems as essential. Organisations that have not yet begun planning or implementation should prioritise doing so.
2. Age assurance is not a tick‑box exercise
   GOSRN acknowledges that jurisdictions will continue to adopt different age assurance approaches. This may be interpreted as recognition that a single global minimum age threshold may not be realistic or indeed desirable. Crucially, the statement positions age assurance as part of a continuous safety ecosystem that requires ongoing monitoring, updating and evaluation throughout the user journey. Much like data protection compliance, this is a living, evolving obligation, and organisations will need to be agile by continually assessing and refining their age assurance measures regularly (as appropriate and necessary).
3. Balancing online safety measures with privacy and data protection obligations
   The statement emphasises that while robust age assurance is essential, it must be implemented in ways that respect privacy and adhere to applicable data protection laws. Data protection obligations should not be viewed as a barrier to age assurance. Instead, privacy‑by‑design must be at the heart of age assurance solutions from the outset.
4. Laying the groundwork for stronger, more coordinated enforcement
   By articulating shared expectations, the GOSRN is preparing for increased cooperation and more consistent enforcement across jurisdictions. Regulators are likely to share information, coordinate investigations and align decision‑making. This heightened collaboration means fewer places for non‑compliance to go unnoticed. Organisations should anticipate more scrutiny and closely coordinated supervisory activity in the years ahead.

International momentum behind age assurance

Global developments in online safety continue to accelerate, and the GOSRN statement comes at a time when age assurance is already attracting significant international focus. Australia announced a minimum social media age of 16, and the UK is actively considering similar proposals. Several major platforms have also confirmed plans to roll out enhanced age‑detection technology across Europe in the coming weeks.

Momentum is also building in Ireland. The Minister for Tourism, Culture, Arts, Gaeltacht, Sport and Media, Patrick O'Donovan, has indicated that online safety will be a central priority during Ireland's 2026 EU Presidency. During recent parliamentary questions in the Dáil, he also confirmed that work is underway to establish the timeline for piloting a national age‑verification tool for online services.

What's next?

Although the GOSRN statement does not change existing legal obligations, it provides a clear, coordinated signal of what regulators expect soon. For organisations operating digital services, now is the time to:

• assess the extent to which your digital service may expose children and young people to harmful content and contacts;
• identify gaps in your age assurance readiness; and
• build privacy‑compliant, scalable solutions capable of meeting heightened regulatory scrutiny.

Contributed by Clodagh McCarthy

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.