Methodology

How we select sources, record uncertainty and review corrections. Verification dates describe source checks, not page edits.

What this site is, and is not

It is a transparency register. For each online service it answers one question: does it check your age in the UK, how, through which vendor, and what does it say it keeps. Every row is a dated quotation with a link.

It is not a guide to avoiding checks, and it is not a ranking. It carries no VPN recommendations, comparisons, links or codes, and no instructions of any kind for evading a check. Reporting what Ofcom or the government has said about VPNs, in a news context, is the only place the word appears.

Sources, in order of authority

1. Primary: the service's own help or policy page, the vendor's own policy page, Ofcom or the ICO. Only a primary source may supply a retention quotation; the validator that runs before every build rejects a retention quote from anything else.
2. Secondary: press and trade reporting. Allowed for a gate status or a method, always labelled "secondary source (press)" on the page, and never presented as the company's own words. Where a secondary source quotes the company, the page says so and names the outlet.

Where a source could not be checked, the relevant entry records the limitation. The sources page lists the URLs used.

The retention rule

Every retention statement on this site is one of exactly two things:

• a quotation of the service's or vendor's published wording, with the URL it came from, the date the source itself carries where it has one, and the date we checked it; or
• the line "No published retention period found (checked 6 September 2026)." with the date we looked.

The site never paraphrases retention into a claim about what a company does or does not do with an image. If a company has not published a period, the absence is the fact, and the absence line is what appears. A build check fails the site if a retention cell is anything other than a sourced quotation or that line.

Scope of retention statements

A retention claim applies only to the service, method, data type and time period supported by its source. A service-specific FAQ is not a provider-wide default. Image deletion and biometric-data retention may describe different data and need not contradict each other. Unverified policy limits are not presented as defaults.

No scores, no adjectives

The facts panel on every page contains only published statements, dates and links. There is no privacy score, no star rating and no "safe" or "risky" label, because a score is an opinion and the facts panel is not the place for one. If a mechanical score is ever added it will be computed deterministically from the facts panel by a published rubric, with the inputs shown on the page, and it will sit in a separately labelled panel. Questions such as "is Yoti safe" are answered on the vendor page with the vendor's retention wording, its certifications, regulator actions and published incidents, and nothing else.

What this site never publishes

• Anything that describes, recommends or links to a way of defeating or evading an age check. That includes VPN products, comparisons, codes and affiliate placements. A build check scans every file in the built site for a fixed list of phrases associated with that kind of content and fails the build on a single match; the same check runs on every data record and on the agent tools' descriptions and outputs.
• The inverse list. People do search for services with no check. This site answers with the neutral status "no active age check as of [date]" on the relevant entry, never with a list titled that way.
• Names of individuals at any service or vendor. Companies, policies, certificates and regulator actions only. A regulator's statement attributed to a named public official is the one exception.
• User-generated content of any kind: no comments, reviews, ratings or forum. Corrections go by email to the editor and are published by the editor with the source.

Adult-service entries

Entries for adult services record the age-assurance facts only. The domain appears as text, the page carries no outbound link of any kind (source URLs are shown as text), there is no screenshot and no description of the content. No advertising or affiliate placement appears on those pages. A build check enforces all of this.

Freshness

• Every entry carries the date a human last read its sources.
• Older than 60 days: the date turns grey and reads "unverified since".
• Older than 120 days: the row is moved to the bottom of the index.
• The badges are computed when the site is built, so badges reflect the last build date shown in the footer. A rebuild does not mean the sources have been checked again.

Upkeep

Nightly, automated (planned): every source URL is fetched, stripped to text and compared with the last copy. Any change goes to a review queue. Nothing automated ever changes a gate status, a vendor or a retention quotation; a human reads the page and makes the edit, and the changelog records how it was detected.

Weekly, by hand (about ninety minutes): re-read Ofcom's enforcement programme page and the ICO's news page and add entries; work the review queue; rebuild.

Regulatory publications and reported source changes require editorial review before the records are updated.

Corrections and right of reply

Every entry ends with a "Correct this entry" link. Corrections are answered within a week. A verified correction changes the entry, is logged in the changelog with its source and the label "user_tip", and appears in the feeds. Services and vendors are welcome to correct their own entries: point us at the policy page and the wording is replaced with the quotation, dated. Nothing sent through the form is published. The process is described on the corrections page.

Privacy architecture

• The site is static HTML. There are no accounts, no cookies of our own, no analytics and no third-party scripts anywhere. Pages are served with a Content Security Policy of script-src 'self' and connect-src 'self', so nothing on a page can send a request anywhere but this origin.
• The only script that talks to the server is the correction form, which posts to this site's own endpoint and stores nothing. If that endpoint is unavailable the form opens your own mail app instead.
• This directory publishes information about companies, not individuals. It does not process personal data of people who verify their age.

Full wording is on the privacy page.

Agent tools (WebMCP)

The index, service, vendor and timeline pages register four read-only tools under the draft WebMCP specification, so that an assistant browsing on your behalf can read the same facts: get_service, list_services, get_vendor and get_timeline. Every tool carries readOnlyHint: true; none takes any personal data, none submits, saves or emails, none links to an adult service, and every answer includes "Quoted from published sources on the dates shown; not legal advice." The same wording check that runs on the pages runs on the tools.

WebMCP is a proposed browser standard. Support depends on the browser, version, enabled features and assistant. No universal assistant compatibility is claimed. The HTML and JSON datasets remain available without WebMCP. See data documentation for pagination and response formats, and Chrome’s documentation for current browser requirements. Special AI files do not guarantee search visibility.

If you use an AI assistant to read this site, your assistant's provider may retain what you ask it. This site never receives it.

Known conflicts and open points

Shown on the relevant pages as "still being verified" rather than hidden. Until resolved, the facts panel records only what a published source says.

• 4chan: Whether 4chan has introduced any age assurance since Ofcom’s decision of 19 March 2026 is not recorded on any page read: 4chan’s pages describe none, and Ofcom’s latest statement read (June 2026 bulletin) says further action may follow “should non-compliance continue”.; The disclaimer that 4chan’s FAQ says appears on a first visit to any board was not read; the boards were not opened. Only the rules, FAQ and legal pages were read, and they contained no age prompt.; No 4chan page read mentions the United Kingdom, Ofcom or the Online Safety Act. Ofcom’s 19 March 2026 news page says: “As in other industries, companies that provide an online service to people in the UK must comply with UK laws.”; The only data statement found is in 4chan’s FAQ: “4chan collects and stores user information for postings. Once a post is pruned or deleted, it is removed from our web server.” It states no retention period and does not concern age checks, so the absence line applies. 4chan’s Legal page contains only DMCA and TAKE IT DOWN Act notice procedures.; Ofcom’s March 2026 total is £520,000 (three penalties); its June 2026 bulletin gives a running total of £540,000, which includes the £20,000 information-request fine of October 2025.; This register’s enforcement page previously cited Ofcom’s pornography enforcement programme page for both 4chan fines; that page does not mention 4chan. The entries now cite Ofcom’s 4chan investigation page and news pages..
• Amazon Prime Video: No Amazon page about the UK Online Safety Act or the Media Act 2024 was found for Prime Video; the record rests on the absence of any check in Amazon’s UK Prime Video help pages and the Prime Video Terms of Use.; The Prime Video Terms of Use say the provider “may be, depending on your location, Amazon.com Services LLC, Amazon Digital UK Limited or one of their affiliates”; the legal-home page that identifies the UK provider was not read.; Whether Prime Video will be designated a Tier 1 service under Part 4 of the Media Act 2024 is set by Government regulations; Ofcom’s consultation page (14 May 2026) does not name services.; Amazon Fire TV devices “have their own parental controls settings”, managed on the device; those pages were not read. Amazon’s age checks for restricted retail purchases are outside this record..
• Apple devices: Exact ID-image retention duration is not published.; Historical rollout date remains based on the earlier press report.; Ofcom’s investigation into Aylo, opened 22 September 2026, examines how Aylo integrated Apple’s age-check signals on iOS; Ofcom states it will not make a determination on how Apple operates its age checks..
• Bluesky: KWS retention line for the Bluesky deployment.
• Bumble: Press reports gathered for the research seed (July 2025) said Bumble began verifying all UK users’ ages through Yoti on 25 July 2025. No Bumble page read names Yoti or says that every UK member is checked; Bumble names Veriff for ID checks.; Which countries Bumble means by “in some countries we’re legally required to verify that members are 18+ before they can use certain features or, in some cases, the app at all”. Its pages do not list them.; Whether the photo verification uses age estimation technology. Bumble describes “an automated process and human moderators” and a scan that “can include the use of facial recognition technology”, so the route is recorded as an unclassified method.; How long Bumble itself keeps an ID image; only Veriff’s deletion period is stated.; When any UK check began: Bumble’s pages carry no date for it.; Bumble’s privacy policy page shows no last-updated date..
• Character.AI: UK scope: no Character.AI page read names the UK. Its 21 November 2025 blog post says the age assurance rollout began in the US “and that rollout will continue globally in the near future”; its 2026 help pages describe the check as applying to all users and say it “is being introduced step by step, so the pop-up might not show up for everyone right away”.; The 7-day deletion figure is Character.AI’s statement about Persona; Persona’s own policy for this deployment was not read. Persona’s Reddit FAQ says deletion is immediate, and OpenAI’s page says 7 days for ChatGPT (see those records).; Which “signals from third parties” feed the in-house estimate is not stated.; Character.AI says that if virtual currency or similar features launch it “may need to create very limited exceptions where we work with Persona to access an ID so we can help resolve things like fraud issues”.; Character.AI’s FAQ says a user who turns 18 may be asked for the selfie again (“If we’re not sure whether you’ve turned 18”), while another page says they should contact support to have verification attempts reset..
• ChatGPT: OpenAI’s help page (read 18 October 2026) still states no UK rollout date and no UK-specific requirement; Italy is the only country named. Whether the age-prediction system is running on UK accounts is not stated.; The help page carries a relative timestamp (“Updated: 4 days ago” as at 18 October 2026), not a date; 14 October 2026 is derived from it..
• Crunchyroll: Crunchyroll’s Terms of Service say it “may, directly or through other parties, take reasonable steps to verify the information you provide”; no page read describes any such step for UK accounts.; The Terms of Service page shows no effective or last-updated date.; The research seed (row 35) recorded a press claim that Crunchyroll would be regulated as a Tier 1 video-on-demand service under the Media Act 2024; no Crunchyroll or Ofcom page read names it, and the claim is not recorded here.; Crunchyroll’s help centre renders only with scripts: the article addresses in the old hc/en-us form redirect to the help centre home, and the “Why am I being asked to verify my age?” article opens only from the sidebar of another article. All five help articles were read in the browser pane on 18 October 2026..
• Depop: Depop says it checks “to make sure anyone signing up for a Depop account is at least 13 years old” but describes no check of the typed date of birth other than the ID route for corrections.; What Stripe requires of a UK seller setting up Depop Payments is not on Depop’s pages; Depop says a valid ID “may be required”. Whether that verification reaches Depop or stays with Stripe is not stated.; No retention period for identification documents is published; Depop’s privacy policy says “We will only keep your data for as long as we need it” and offers retention details on request.; No Depop page read mentions the Online Safety Act or Ofcom.; Depop’s help centre blocks automated reading (HTTP 403); the pages were read in the browser pane. The Terms of Service page carries three versions (headed “Updated 2 July 2026”, effective 22 July 2026 and 29 March 2026); the age clauses are the same in each..
• Discord: October 2025 support-vendor breach (~70k IDs via 5CA/Zendesk) is a separate incident, not the age-check vendor.
• Disney+: Disney+’s help centre served its US articles when the UK (en-GB) addresses were opened on 18 October 2026, so the help-centre wording on parental controls and birthdates was read in its US version only; the UK Subscriber Agreement and Disney+’s UK explainer article were read as published for the UK.; The US help article “Why does Disney+ need my birthdate and gender?” says “By collecting your birthdate and establishing a billing relationship with you (on our site or through a third party), we are confirming your eligibility for Disney+.” and “The birthdate associated with the account/profile will not be linked to its content rating.” Whether the same wording applies in the UK is not confirmed.; A help article titled “Age verification on Disney+” exists in Disney+’s help centre, but it returned no content for the UK or US addresses on 18 October 2026.; Whether Disney+ will be designated a Tier 1 service under Part 4 of the Media Act 2024 is set by Government regulations; Ofcom’s consultation page (14 May 2026) does not name services..
• EA: Which countries other than Brazil require EA’s 18+ check is not stated; EA says only “in some countries”. No EA page read names the United Kingdom for an 18+ check.; EA’s age-check page says a check may also be triggered when travelling, so a UK player abroad could meet it; EA does not say which account countries it applies to.; EA does not say in words who runs the adult check: its age-check page sends failed checks to “the KWS support page”, and its child-account page names KWS as “our trusted partner” for confirming a parent is an adult. The adult-check rows therefore carry no vendor.; No retention period is published for the ID or facial scan used in the 18+ check; EA says only “Your information is stored securely and used only for age assurance.”; EA’s Privacy and Cookie Policy (23 June 2025) describes parental consent for children but not age assurance; the policy predates EA’s age-check pages..
• eBay: VerifyMyAge retention for this eBay deployment: data types, periods and any account or verification-result storage are unconfirmed..
• Epic Games and Fortnite: No Epic page read describes an 18+ age check for UK players of Fortnite or the Epic Games Store. Epic’s only 18+ check page is for Australia (“players in Australia must verify they are 18 or older to get or buy R 18+ content on the Epic Games Store”). In the UK, Fortnite content ratings are enforced through the parent’s Parental Controls PIN.; Epic’s “How to correct the date of birth on your Epic account” page says an adult must “complete age verification” but does not list the methods; the methods recorded here are those Epic’s Kids Web Services developer page lists as available in the UK, and Epic’s Parental Verification FAQ names only a credit-card authorisation or “checking some of your information against a public records database” for parents.; Which provider performs the “public records database” check for parents is not named on Epic’s page.; Epic’s Cabined Accounts page refers to “the age of digital consent in your region” without stating the UK figure.; Kids Web Services’ privacy policy gives no deletion period for face-scan images or ID scans; it says KWS stores the verified status against a hashed email and “never store[s] the verification details”, and that it requires its service providers to delete personal information “once it is no longer necessary”..
• Facebook: When the video-selfie and ID routes reached UK Facebook accounts: the UK-English Help Centre lists both routes but gives no date, and no Meta page read names the UK for them.; Whether Meta’s AI teen-placement technology is live on Facebook in the UK. Meta’s 5 May 2026 post said it was “expanding to Facebook in the US for the first time, followed by the UK and the EU in June”; no later Meta page read confirms the UK rollout.; Facebook’s Help Centre has a “How phone number age verification works on Facebook” article; read from the UK on 18 October 2026 it says only “This feature is not available in your location.” What the route involves, and where it is offered, is not stated.; Whether Meta’s “within 30 days” line also covers Yoti’s copy of the selfie image. Meta’s 5 December 2022 post on Facebook Dating says the image “is then deleted immediately”; Yoti’s own notice says it deletes the selfie as soon as an estimate is given.; What Meta told Ofcom about UK age assurance: Ofcom’s 21 May 2026 update says Meta “sent us a confidential letter” and “has not published its response”.; No Meta page specific to the UK Online Safety Act was found; the facts here come from Facebook’s UK Help Centre pages and Meta newsroom posts..
• Feeld: Feeld’s pages carry no date for the UK requirement; the help article’s metadata dates its first publication to 9 July 2025 and the FAQ ties it to the Online Safety Act. Press in the research seed gave 25 July 2025.; Feeld’s privacy policy page shows no last-updated date; the terms are dated 18 December 2025.; Feeld’s terms call Yoti’s selfie route “age estimation facial recognition technology”; its help article says the selfie is analysed “to determine your approximate age”. Which Yoti product is used is not stated.; Whether Yoti’s own retention terms (its age-verification privacy notice, see the Yoti page) apply in addition to Feeld’s “immediately deleted” line..
• Google Account and Google Search: Google’s Account pages (“How Google helps provide an age-appropriate experience” and “Access age-restricted content & features”) list no countries. The only Google page read that names the UK is YouTube’s age-estimation page, which says the model “is currently applied in several countries, including … the United Kingdom”. Whether the same account-level estimate drives SafeSearch for every UK account is not stated.; Google’s page carries a notice that it is “currently updating settings for Google Search services, which include Search, Maps, Shopping, Flights, Hotels, Translate, and News. These are rolling out gradually over the next few months.”; The selfie route is performed by Private ID, named on Google’s page as “Google’s partner that performs the verification”; this directory has no separate Private ID vendor record, and Private Identity LLC’s ACCS certificate is noted on the Google vendor page.; Google’s pages do not say what happens to SafeSearch for signed-out searches, or how long the under-18 estimate stays on an account after a failed or declined verification.; Ofcom’s July 2026 report comment on age inference is recorded on the Google vendor page; Ofcom has not named Google Search in any enforcement action read for this record..
• Hinge: When Hinge’s UK age check began. Hinge’s page says only that for UK accounts created before 25 June 2026 it ran a similar estimation on a profile photo; press (Biometric Update, February 2026) reported age verification for UK and Australian users from 5 February 2026. The first-observed date here is from that press report, not from a Hinge page.; How long the age-check result is kept is stated two ways: the Age Checks page says results are “stored in a secure format for 1 year”; the Face Check page says the age estimate is “saved until 90 days after your account is closed (or 2 years if the account is banned)”.; Hinge’s pages name no liveness or face-matching supplier; press in February 2026 named FaceTec. Hinge: “The technology used to estimate age is proprietary to Match Group.”; Whether UK accounts created before 25 June 2026 are later required to complete Face Check. Hinge says Face Check is rolling out “on a phased basis, where local regulations permit” and may be required after a profile location change.; Whether an ID check follows every UK age check or only some: Hinge’s page says “you may be prompted to complete an ID Check … for example, in the UK”..
• Instagram: Instagram’s pages do not say which countries have the video-selfie and ID routes (“This feature is only available in some countries.”). UK availability rests on Meta’s 13 October 2022 plan to expand “to the UK and EU before the end of the year” and a 7 November 2022 press report; no Meta page read names the UK for these routes.; Instagram’s video-selfie page says the check applies when changing an age from “under 16” to “over 16”; its “Confirming your age on Instagram” page says from under 18 to over 18. Which threshold applies to UK accounts is not stated.; Whether Meta’s “within 30 days” line also covers Yoti’s copy of the selfie image. Meta’s 23 June 2022 post says “Meta and Yoti then delete the image”; Yoti’s own notice says it deletes the selfie as soon as an estimate is given.; Whether Meta’s visual-analysis AI is live for UK accounts: Meta says it is “currently available in select countries”.; What Meta told Ofcom about UK age assurance: Ofcom’s 21 May 2026 update says Meta “sent us a confidential letter” and “has not published its response”.; No Meta page specific to the UK Online Safety Act was found; the facts here come from Meta’s general help pages and newsroom posts..
• Kick: Kick's FAQ says method availability varies by jurisdiction but does not list which methods, including AgeKeys, are offered to UK viewers.; The FAQ carries no date for the start of the UK gate; first_observed is still unrecorded..
• Minecraft: No Minecraft or Microsoft page read gives the date the UK requirement began; press (NME, 19 January 2026) reported it for February 2026. The first-observed month is from that report.; Minecraft’s page names Java Edition chat only; whether Bedrock Edition chat, Realms or other social features are restricted for unverified UK accounts is not stated.; Which partner, Yoti or Verifymy, handles which method: Microsoft names both without saying.; Minecraft’s page says “Microsoft account holders within the United Kingdom”; Microsoft’s FAQ describes the consequences for adults who do not verify. Whether child accounts are prompted is not stated.; No Mojang page names Yoti; the attribution in press rests on Microsoft’s partner list..
• Mumsnet: No Mumsnet statement later than the staff reply of 31 July 2025 was found; the reply says the regulations are “still evolving” and that Mumsnet is “keeping a close eye on developments”.; The staff reply is a post in a user discussion thread; only the staff reply is quoted here, and the thread is user-generated content that may change.; Mumsnet’s privacy policy carries no overall effective date; its “Updates” list ends at 20 May 2022.; Whether Ofcom has engaged with Mumsnet is not recorded on any Ofcom page read.; Mumsnet’s Talk guidelines page could not be located at the addresses tried (404); the terms and privacy policy were read..
• Netflix: No Netflix page about the UK Online Safety Act or the Media Act 2024 was found; the record rests on the absence of any check in Netflix’s UK help pages and on its “How to verify your age” page, which with the UK selected says the information “is not available for United Kingdom”.; The Terms of Use served to a UK visitor on 18 October 2026 (Last Updated April 10, 2026) name Netflix, Inc. and Delaware law; a UK-specific version was not reached, so the 18+ clause is quoted from the version served.; Whether Netflix will be designated a Tier 1 service under Part 4 of the Media Act 2024 is set by Government regulations; Ofcom’s consultation page (14 May 2026) does not name services.; Netflix’s “How to manage your account-level PIN” page also says the information is not available for the United Kingdom; profile-level Profile Lock PINs are described instead..
• Nintendo: No Nintendo page about the UK Online Safety Act or age verification was found; the record rests on the absence of any check in Nintendo’s UK account, child-account, parental-controls and GameChat pages.; Whether Nintendo applies any age assurance to Nintendo Switch Online features beyond the parental-controls requirement for under-16s on GameChat.; Press commentary gathered for the research seed noted no UK programme; no primary statement either way from Nintendo was found..
• OnlyFans: Retention for the fan-side check from OnlyFans’ own pages; the method is now sourced to Ofcom’s decision and the provider to Yoti’s case study..
• Pinterest: Pinterest names no verification provider: its help page says “our trusted third-party partner” and “Our verification partner regularly conducts routine audits”.; No retention period for the selfie or ID is published on Pinterest’s help page or in its privacy policy (effective 30 April 2025); the policy says only that Pinterest may “Conduct age verification, as appropriate. This may include facial age estimation and matching your face against a government ID.”; How Pinterest decides to deactivate an account “because you haven’t met the age requirement” is not described beyond user reports (“If you believe an account on Pinterest doesn’t meet our age requirements, please report the account”).; No Pinterest page about the UK Online Safety Act was found; the help pages read are not country-specific (the en-gb versions were used). Pinterest’s teen-safety page names the UK only for ad personalisation: “If you’re under 18 in the EU or UK, note that you’re automatically opted out of all ad personalisation settings.”; Pinterest’s privacy policy page says an updated policy takes effect on 12 November 2026; the preview was not read..
• Pornhub, YouPorn, RedTube: Per-method retention statement; Outcome of Ofcom’s investigation, opened 22 September 2026, into whether the Apple-signal process is highly effective..
• Replika: Whether the 2023 blog’s description (age gate plus a reaction to mentions of being under age) is still how Replika finds under-18s is not confirmed by a dated 2026 page; the current Privacy Policy names age verification as a purpose without describing it.; What “confirm your age” involves after a birthday change is not stated on the help article.; No Replika page read mentions the United Kingdom, the Online Safety Act or Ofcom.; How Luka responded to the Italian authority’s 2025 compliance order, and whether any Italy-specific check exists, is not on Replika’s pages; the help centre search for “age verification” returns only the birthday article.; Replika’s help centre blocks automated reading (HTTP 403); the article was read in the browser pane. The blog, terms and privacy pages fetched normally..
• Riot Games: Whether UK players are in a region where Riot requires adult age verification is not stated; Riot’s pages name Brazil and the US only. The seed’s claims of a Brazil rollout on 23 March 2026 (press) and of Yoti for the UK are not on any Riot page read.; Riot says players prove their age “through a variety of means” but names only a credit card and a government ID.; The minimum age for a UK player’s own account is given only as “the age of eligibility under GDPR or other region-specific rules”, not as a number.; No deletion period for ID images or card data is published for Riot’s deployment; the KWS policy quotations describe what KWS keeps in general.; Riot’s Privacy Notice carries no visible last-updated date on the page read..
• Snapchat: Any change after the 30 April 2026 report to Ofcom.
• Telegram: Primary Telegram statement on how the face scan is processed and what is kept; Telegram’s developer page describes only the bot mechanism..
• Threads: UK availability: Threads’ video-selfie page says the feature “is only available in some countries” and no Threads page read names the UK.; Which threshold applies: the video-selfie page says under 16 to over 16; the “Confirming your age on Threads” page says under 18 to over 18.; Retention of an ID submitted on Threads is not stated on the Threads page; Instagram’s equivalent page says 30 days.; Whether Meta’s AI age inference on Instagram (see the Instagram record) determines Threads restrictions. Meta says Threads uses the age from the connected Instagram or Facebook account; no Threads page describes inference.; Threads was not named in Ofcom’s 12 March 2026 letters, which went to Facebook and Instagram among others..
• Vinted: What prompts Vinted to ask a member to verify their age is not stated on its help page; the page says only that the request is “a standard check to ensure you meet our minimum age requirements”.; No retention period for age-verification documents is published. Vinted’s privacy policy gives 3 days for documents sent to confirm account ownership and says KYC documents for payment providers are not stored by Vinted; neither line names age checks.; Whether the document is reviewed by Vinted staff or by software is not stated; the page routes it through Contact us (Customer Support).; No Vinted page read mentions the Online Safety Act or Ofcom. The terms and privacy policy render only with scripts and were read in the browser pane; the two help pages were fetched normally..
• WhatsApp: What “Verify you’re an adult” involves when a parent sets up a parent-managed account; the page does not say.; Whether parent-managed accounts are available in the UK: WhatsApp says they are “rolling out gradually and may not be available in your region”.; Whether WhatsApp receives an age range from Apple’s or Google’s app store for UK accounts; the page says this depends on “legal requirements where you live”.; No WhatsApp page specific to the UK Online Safety Act was found..
• X and Grok: X's own page publishes no retention period for any method and names no vendor, saying only that “third party providers will also be bound by strict data protection standards”. The vendor and 30-day figures on this record's method notes come from July 2025 press.; X’s page (checked 18 October 2026) describes the selfie and ID options as open to any user whose age it cannot otherwise settle, with no Premium requirement stated; the July 2025 press report of a Premium-only paywall is not reflected in X’s current wording.; The page carries no published or revised date..
• Xbox: Exact UK rollout date and current account-specific feature restrictions.; Microsoft’s FAQ (24 August 2026) names Yoti and Verifymy as partners and lists facial age estimation and document upload, but not which partner handles which method or region, and it no longer lists the mobile-provider and credit-card checks from the July 2025 announcement.; Separate retention periods for verification results and support-case records..
• Yoti (vendor): AEPD appeal outcome (Yoti said on 10 March 2026 it had begun an appeal to the Spanish High Court).; The AEPD resolution text carries no signature date; 10 March 2026 is the date of Yoti’s published response and of press reports. The 25 March 2026 date in the research is the date of the separate Ofcom/ICO joint statement..
• Epic Kids Web Services (vendor): Not on the ACCS public registry (33 entries, checked 18 October 2026)..
• k-ID (vendor): Facial estimation is delegated to Privately (named in k-ID’s privacy policy); Privately SA holds its own ACCS Age Assurance certificate (valid to 14 Apr 2029) but its accuracy figures are not captured here..
• Persona (vendor): A vendor-wide retention period has not been verified. The quoted FAQ applies only to Reddit; it is not a default for other services.; Discord dropped Persona 24 Feb 2026 after the exposure report.
• Google (vendor): Google’s page names Private ID as the partner performing selfie age estimation; Private Identity LLC, not Google, is the entry on the ACCS registry (checked 18 October 2026). The 2023 Google certificate reported by press was not re-read..
• VerifyMy (vendor): Facial age estimation and ID retention policy not read; the quoted statement is the Google email-check policy only.; Retention for the eBay / VerifyMyAge deployment is not established here; Verifymy’s eBay pages (re-read 18 October 2026) say only that collected data is encrypted and never sold. The Google statement must not be applied to eBay..
• Apple (vendor): Exact ID-image retention duration is not published.; Retention source re-read 18 October 2026 (page republished 18 September 2026, wording unchanged); the historical incident and regulatory reports were link-checked but not re-read..
• OneID (vendor): No named UK consumer-service customer found (news page re-read 18 October 2026).; OneID’s about page says it is independently certified for age assurance under the Age Check Certification Scheme, but OneID does not appear on the ACCS public registry (33 entries, checked 18 October 2026)..
• Veratad (vendor): Veratad’s policy gives no fixed retention period for UK users; the quoted wording is its general statement, and deployer-specific periods (Discord via k-ID) are set by the deployer..

Handling incomplete evidence

Missing retention statements and unresolved policy questions are labelled on the relevant record. A missing record or certification is not evidence that a service, policy or certification does not exist. Source monitoring can identify changes, but editorial review is required before factual claims change.

How the site is funded

At launch, nothing on the site is paid for. If that changes, the advertising and affiliate disclosure will change first: any affiliate link will be labelled "Ad" beside the link, will never be for a VPN product, and will never appear on an adult or gambling entry. Display advertising, if added, will run only on service and guide pages, never on the correction form, and never for VPN creatives that mention age checks.