The Online Safety Act requires services to use highly effective age assurance to prevent children in the UK from encountering harmful content. ofcom’s guidance makes it clear that age assurance must be robust to prevent circumvention. Services must also take steps to mitigate against circumvention methods that are easily accessible to children. Providers that do not comply with their child safety duties by deliberately promoting the use of VPNs could face enforcement action under the Act.