Substack will start asking users in the UK for age verification, bringing the newsletter platform in line with new compliance obligations under the Online Safety Act. The move adds an identity gate to certain posts and community features, putting Substack alongside a growing list of services that are implementing checks before letting people see potentially harmful or adult content.
What UK users will see under Substack’s age verification
Readers in the UK may see a message informing them that posts or community spaces cannot be shown if they are within categories that this law protects. Substack says material reported as adult or potentially dangerous can be blurred until the viewer completes an age check. This could be in the browser and Substack app, and it could also include chats, direct messages, commenting or Notes.
Impacted content, the company said in a guidance statement, might include sexually explicit material, graphic violence, targeted hate content, bullying or harassment, and posts that encourage self-harm. Substack says that in most cases, it verifies whether paid subscribers are of age based on their payment information, and some users may already be verified through age determined from other platforms. If readers disagree that a blurred post falls below the legal threshold, they can request a manual review.
How Substack’s UK age verification process will work
Substack describes a method that is built on age-verification practices already followed across the industry. Users could be required to do a selfie for facial age logging, with a photo of government-issued ID used as an alternative if the check has no success. The company says it will hold onto an age estimate to ease future checks, a process that raises privacy concerns even as it may ease friction for returning readers.
In the UK, the Information Commissioner’s Office promotes data minimization for age assurance, while Ofcom — the new online safety regulator — has signalled that high-risk content should be subject to meaningful checks.
And for those services that host or link to porn, Ofcom can fine them up to 10% of global turnover should they fail to do so. Substack doesn’t market itself as an adult site, yet the content there and its users’ contributions make it eligible for scrutiny where that content intersects with what the law defines as pornographic.
Market solutions from the UK market, age-assurance vendors like Yoti and iProov are to be found broadly across the UK marketplace, while the Age Check Certification Scheme audits against British standards. Substack has not publicly disclosed their specific vendor relationships, although the described process reflects a well-established method which was reviewed by UK regulators.
Why Substack is making the move now under UK safety law
The platform has been cautious about age-verification laws, saying they could create friction and danger for free expression. It says it will still respect national laws and put in place necessary safeguards. The UK regime is one of the broadest, imposing obligations on services that host user-generated content to keep children from finding inappropriate material and block access to adult content.
Other major platforms have already moved. YouTube age-gates some videos and features, adult sites have implemented verification or, in areas outside of the UK, cut access altogether under rules found within local laws. Substack’s move is a reminder of how the UK’s rules are influencing product decisions well outside traditional social networks.
What this means for creators and free speech on Substack
For newsletter writers, the immediate effect is audience friction: posts categorized as adult or potentially harmful will reside behind an age wall (which could be used as a defense against publishers aging up their content to reach wider audiences — though you can just lie and pretend), reducing casual reads and shareability. If you’re a creator of mature content — legal but sensitive issues — you may want to rethink your tagging strategies and reader onboarding processes. Community areas, like chats and comments, can also be reined in; some publications may see engagement fall as a result of this.
The policy may also have implications for controversial categories that have brought criticism upon the platform in the past. There have been reports of extremist and hateful content lurking inside some Substack publications. Under the UK regime, posts that violate the law’s definitions might be grayed-out for non-verified users, limiting their reach within Britain.
Civil society groups, including the Open Rights Group, have long cautioned that age checks can lead to privacy risks and stifle lawful speech. Regulators argue that privacy-protecting age estimates and strong data governance can reduce the risk, while providing genuine protections for children. The balance between safety and anonymity, which UK debates have been grappling with ever since the Age-Appropriate Design Code, remains the central tension.
What UK users should do now to navigate age verification
UK readers will be required to complete an age check when attempting to access flagged posts or interactive areas. Keep a government ID on hand if the selfie-based check has trouble verifying your age. Check the service’s privacy materials to know what data is kept and for how long, and learn how to ask that it be deleted. If anything is blurred by mistake then follow the manual review method stated by the app.
For creators, the practical measures involve:
- Auditing archives to identify potential content that could spark restrictions.
- Ironing out definitions of labels and categories in new YouTube videos — and clarifying them to get ahead of any issues with the new rules.
- Informing subscribers about the possibility of verification prompts.
Staying current with evolving, enforced Ofcom guidance will be important to steer clear of inadvertent breaches and to continue reaching UK audiences.
Substack’s move is indicative of how regulatory burdens are shaping the creator economy. Age checks are coming not just to explicit sites but to mainstream publishing tools, and the long-term test is whether platforms can fulfill duty-of-care obligations without violating reader trust and the open, low-friction experience that made newsletters so transformative in the first place.
