On 25 July last year, an obscure regulatory deadline became a start date for money. The Protection of Children Codes made under the Online Safety Act 2023 came into force that Friday, bringing Ofcom's Online Safety Act age verification duties into effect, and within weeks a small cluster of London and Bromsgrove-based companies had gone from compliance vendors to a genuine investment thesis.
We wanted to know whether that thesis holds up, so we went back through the funding rounds, the enforcement data and the government's own numbers on the sector Online Safety Act age verification has created almost by accident.
What we found is a market growing on compliance-driven demand, built faster by regulators than by any venture round.
When Regulation Became a Market
Start with timing.
Verifymy, a London company founded in 2019 by Ryan Shaw, closed a £2.07 million seed round on 1 September 2025, five weeks after Online Safety Act age verification duties took legal effect. Its flagship product infers a user's age from an email address rather than a document scan, a method it argues clears Ofcom's highly effective age assurance bar without the friction of self-declaration, the tick-box method Ofcom has explicitly ruled out.
Yoti tells a longer version of the same story. The Hackney firm, founded in 2014 by Robin Tombs, raised £20 million in debt funding from HSBC and existing shareholders in January 2024, taking its total funding past £166 million.
Its facial age estimation technology now runs biometric verification checks for clients including Meta, Sony PlayStation and the Government of Jersey, and the company says it processes more than 6.5 million age and identity checks a month.
Most of that infrastructure predates Online Safety Act age verification enforcement. What has changed since is the demand pulling biometric verification into markets, retail alcohol sales, pub entry, gambling, that the Protection of Children Codes never directly touched but reshaped anyway.
The Infrastructure Behind the Checks
Luciditi, based in Bromsgrove and operating under Arissian Ltd, took the opposite route into the same demand. It became the first provider certified across all five roles of the UK's Digital Identity and Attributes Trust Framework, the DIATF accreditation scheme that determines which companies government and industry trust with a stranger's date of birth. Its Age Proof product works as a digital ID wallet, issuing a QR-code credential that proves a customer is over 16 or 18 without disclosing the document underneath.
It has since paired with Yoti to build an interoperable digital ID wallet network spanning seven million users, a scale that suggests this sector is consolidating around shared infrastructure rather than splintering into competing standards.
Open banking has found its own niche within the same Digital Identity and Attributes Trust Framework.
OneID, an FCA-regulated provider, verifies age through a user's existing bank account rather than a photograph, a method Ofcom's January 2025 guidance lists alongside facial estimation as capable of meeting the highly effective age assurance standard. It is a smaller, quieter business than Yoti or Verifymy, but it points to how many different technical routes the same legal duty has funded.
A Sector Taking Shape Under Pressure
None of this happened in a vacuum. The Office for Digital Identities and Attributes, known as OfDIA, published its Digital Identity Sectoral Analysis Report in July and counted 275 firms now providing digital identity products and services in the UK, generating an estimated £2,027 million in annual revenue and £1,037 million in gross value added. That is growth, but it is uneven growth. Employment across the sector fell by six per cent over the same period, concentrated among larger and mid-sized firms, which reads less like a boom and more like a market working out which model survives contact with a live regulator.
Ofcom has kept that contact live, and in its first year of enforcement, it opened investigations touching roughly ninety services and issued a run of escalating fines: £1 million plus £50,000 against AVS Group in December, £800,000 plus £30,000 against Kick Online Entertainment in February, £1.35 million against 8579 LLC the same month, £520,000 against 4chan in March.
The ICO has run a parallel track under its own Children's Code, fining Reddit £14.47 million and MediaLab, owner of Imgur, £247,590 for age-check failures that overlapped with data protection breaches.
On 25 March, Ofcom and the ICO issued a joint statement making clear that satisfying one regulator no longer excuses ignoring the other.
That coordination is the part of the story most coverage misses; it is easy to read the fines as proof the sector is troubled.
We think they are closer to proof of a market being built to order. Every penalty against a platform without effective checks functions as a subsidy for the companies selling effective ones, and the providers behind this piece's funding rounds treat the enforcement calendar the way other industries treat a product roadmap.
The Harder Question Is Whether It Works
What none of them can yet fully prove is that the checks work everywhere they are required to. Ofcom's own Use of Age Assurance Report, published in July, found real progress: the share of children who were asked to prove their age and met a highly effective check nearly doubled, from 25 per cent in July 2025 to 43 per cent by January 2026, and a sample of 32 services logged more than 69 million checks in the second half of 2025, a twenty-three-fold jump on the six months before. Nearly all of the top ten pornography sites now gate. Nearly none of the sector's harder problems are solved.
The same report found social media platforms still failing to enforce their own stated minimum ages, and flagged that a meaningful share of search results still route children straight to sites running no checks at all.
Ofcom has now promised Parliament a rapid assessment, due in October, of what counts as highly effective Online Safety Act age verification for stopping under-16s specifically, a narrower standard than the over-18 threshold most of this sector was built to meet. For the companies whose funding rounds we have just tallied, that assessment is either the next growth phase or the first real stress test this sector has faced.
Which one it turns out to be will depend on how many of them can move as fast as the regulator now expects.
Also read: Why GoCardless Bet Early on UK Agentic Payments
Sources: Ofcom, including its Use of Age Assurance Report 2026; the Information Commissioner's Office; the Department for Science, Innovation and Technology's Office for Digital Identities and Attributes Digital Identity Sectoral Analysis Report 2026; Biometric Update; Fintech Futures; Lewis Silkin; Linklaters; TechRound; company statements and disclosures from Verifymy, Yoti and Luciditi.
