Every age check on this site is pointed the same way. A customer arrives, the platform asks how old they are, and the argument is about which method proves it. That is where the law has been for three years, and it is where almost all the engineering has gone.
Last Thursday the United Kingdom started asking the opposite question. Not how old is the buyer. Who is the person doing the work, are they allowed to do it, and can you prove that the person who took the job is the person you checked.
Section 48 of the Border Security, Asylum and Immigration Act 2025 came into force on 1 October 2026. It pulls gig workers, individual contractors and the substitutes they send into the illegal working regime, with civil penalties of £45,000 for a first breach and up to £60,000 per worker after that. Two months after that, on 2 December 2026, member states have to have the EU Platform Work Directive in national law. That instrument then forbids the exact fraud check most platforms would build to satisfy the British one.
If you run a delivery fleet, a home services marketplace, a courier network or any product where one person performs work that another person ordered, you have a supply-side identity problem and the date has already passed. The penalties apply to arrangements running right now, this week, while most teams have not started.
What section 48 actually does
The change is small in text and large in scope. Section 48 amends the Immigration, Asylum and Nationality Act 2006 so that the word “employer” stops meaning only an employer.
The regime now reaches three new kinds of arrangement. Anyone engaged under a worker’s contract, meaning a non-employee who agrees to perform work personally for someone who is not their client or customer. Individual subcontractors brought in to help deliver someone else’s contract. And, written in plainly, online matching services that charge a fee or a commission to connect people offering a service with the people who want it. That last limb is a description of a gig platform.
The penalties were already severe and they did not change. £45,000 per illegal worker for a first breach. Up to £60,000 per worker for a repeat. Where the business knew or had reasonable cause to believe a person lacked the right to work, it is a criminal offence with a maximum of five years in prison and an unlimited fine. The Home Office published the draft Code of Practice on 30 June 2026 and it applies to checks completed on or after 1 October.
Two details matter more than the headline. First, liability can travel along a contractual chain, so a business that buys labour through an intermediary cannot assume the intermediary carries the whole risk. Second, the protection is a statutory excuse, not a good intention. You keep the penalty off your desk by holding evidence that the prescribed check happened, in the prescribed way, before the person started work.
The substitute clause is the hard part
Read the Code of Practice as an engineer rather than a lawyer and one requirement stands out. Where a worker is allowed to send a substitute, the platform has to run a right to work check on the original worker and on the substitute. The check cannot be handed to the worker to run on their own stand-in. And then this, which is the sentence that should worry your architecture team: the business must keep proportionate systems and processes to make sure the individual performing the work is the person whose right to work has been checked.
The Code names what those systems can look like. Identity cards. Facial verification. Biometric systems. Re-verification inside 24 hour periods.
That is not onboarding. Onboarding answers a question once, on the day someone signs up, and then the answer sits in a database and decays. What the Code describes is binding: proving at the moment work happens that the account, the credential and the human are the same three things they were when you checked. We wrote about this failure mode on the consumer side in the binding problem, where a verified adult passes the check and a child uses the session. The supply side is the same defect with money attached and a substitution feature that the platform itself built.
Account sharing on delivery platforms is not a theoretical risk either. It has been documented for years in the UK, it has driven Home Office pressure on the major food delivery apps, and it works for the same reason verified account resale works on the consumer side. A verified account is a valuable thing that can be lent to an unverified person, because nothing in the flow ever looks again.
You already collect the age. Then you throw it away.
Here is the part that connects this to everything else on this blog. A right to work check is a document check. The document carries a date of birth. You have already collected the age of every worker on your platform and, in most systems we have looked at, you have discarded it or buried it in a file you cannot query.
That matters because the right to work is not the only minimum the job has.
Alcohol is the clearest case. In England and Wales the person handing over a delivery of alcohol needs to be an adult, and local licensing policies routinely require delivery staff to be 18 or over, plus an age check at the door under a Challenge 25 style policy. In most of the United States the person handing over alcohol has to be 21. Driving entitlement has its own floors, which differ between a moped and a van. Under-18s have hard limits on working hours and night work that adults do not have.
So a 17 year old with an unrestricted right to work in the UK is legally allowed to work and legally barred from delivering a crate of beer at 23:00. Your dispatch system cannot tell the difference unless someone stored an age band next to the account and wrote a rule against it. Under United States federal law the mismatch is sharper still: the Fair Labor Standards Act treats driving as a hazardous occupation, so a 17 year old cannot lawfully drive as a main part of the job at all, whatever the platform’s terms say.
None of this is exotic compliance. It is the same shape as the age gate you already ship for buyers of alcohol, cannabis and vape deliveries, turned around to face your own supply. The cost of getting it wrong is not a fine from a media regulator. It is a licensing review, a labour inspectorate, and an injured teenager on a moped.
The fix is cheap if you do it at enrolment. Derive an age band from the document at the moment you verify it, store the band and the date you derived it, delete the document, and let dispatch read the band. That is the same split we argued for in the deletion request post: keep the decision, not the material it was made from.
The EU forbids the fraud check you would reach for
Now cross the Channel, because most platforms in scope operate in both places.
Ask any fraud team how they would stop one person from running four courier accounts, or from lending a verified account to a substitute. The answer is always the same. Take a selfie at enrolment, turn it into a template, and search every new selfie against the gallery of templates you already hold. One face, many records. It catches account farms, and it is the single most effective control against the substitution problem.
Directive (EU) 2024/2831 prohibits it. Article 7(1) lists what a digital labour platform must not process, and point (f) is specific: the platform may not process biometric data of a person performing platform work to establish that person’s identity by comparing that data to stored biometric data of natural persons in a database.
Read the clause carefully, because the distinction it draws is the whole design. Comparing one face to a database of many faces is identification, one to many, and that is the operation the Directive names. Comparing one face to the template taken from the document that this same person just presented is verification, one to one, and it is not a database search. A platform can still ask “is this the person on the licence you showed me” in the EU. It cannot ask “which of my 40,000 workers is this”.
Three more parts of Article 7 shape the build:
- Point (c) forbids collecting personal data about a person while they are not offering or performing platform work. Background checks that quietly wake the camera between shifts are out. Re-verification has to hang off the start of work.
- Point (e) forbids processing personal data to infer migration status. That sits uncomfortably next to the UK duty, and it is a reason to keep the right to work decision as a recorded outcome from a registered provider rather than something your model guesses from a document.
- The Directive also requires human oversight of significant automated decisions. Deactivating a worker’s account is significant. So a failed face match at the start of a shift cannot silently end someone’s income, which is exactly the design point we made about appeals and human override.
The timing is awkward in a way worth planning around. The transposition deadline is 2 December 2026, the Commission has ruled out moving it, and as of mid-2026 only Italy had a draft decree in parliament with Spain out to consultation. So you will be shipping against 27 national laws that mostly do not exist yet. Build to the text of the Directive, keep the biometric surface as small as you can defend, and assume a transposition can be stricter than the Directive but not looser.
An architecture that satisfies both
Put the two instruments side by side and the space of legal designs is narrow. The UK wants proof that the person working is the person checked. The EU says you may not get that proof by searching a face gallery. One shape survives.
Enrol once, one to one. At onboarding, read the identity document, run a liveness check on the selfie, and match the selfie to the document photo. Store the outcome, the method, the threshold, the policy version, the timestamp and a derived age band. Delete the document image on a short clock. Keep the face template if you need it for re-binding, and scope it to that one worker account.
Do not build a gallery. Store templates so that they can be compared to their own account and nothing else. Isolation at the database level, not a naming convention in application code. This is the difference between a credential you can check and a biometric database you can search, and it is the line Article 7(1)(f) draws.
Bind at the start of work, not in the background. When a shift or a job starts, take a selfie and match it one to one against the template enrolled for that account. Log the result. The Code of Practice already contemplates re-verification inside 24 hour periods, so a daily binding check is a defensible read of “proportionate”, and it lands inside the window where the EU allows you to collect anything at all.
Make substitution a real flow instead of a loophole. If your terms let a worker send a substitute, the substitute needs their own enrolment, their own decision record and their own age band, before their first job. Then dispatch has to enforce it: a job accepted on account A but bound to the face enrolled for account B is a refusal, logged, not a support ticket.
Catch the rest with signals that are not faces. Device fingerprints, payout account reuse, phone number churn, IP and behavioural patterns will find most account farms without touching the prohibited operation. This is the orchestration argument from layered age assurance applied to workers. When one route is closed by law, you widen the others instead of ignoring the requirement.
Write the evidence down as you go. A statutory excuse is a record, and the record has to survive a Home Office visit months later. Who was checked, by what method, against which document type, on what date, under which policy version, and who reviewed the failures. If your answer is “it is in the logs somewhere”, you do not have a statutory excuse. You have an archaeology project.
The catch-up list
The duty is live, so this is remediation rather than preparation. Work down it in this order.
- Map every engagement type you use. Employees, workers, individual subcontractors, agency labour, platform providers, permitted substitutes. Anything with a person and a payment.
- Fix the contracts. The Code expects written terms requiring checks on everyone engaged, limits on unauthorised subcontracting, audit rights, and a right to suspend where someone is working illegally.
- Confirm your verification provider is registered for the relevant UK right to work service. Digital identity checks only give you the statutory excuse through a registered provider.
- Ship the substitute registration flow. Until it exists, either turn substitution off or accept that you are running unchecked labour.
- Add shift-start binding. One to one, against the account’s own enrolled template, with a human review path for failures.
- Derive and store an age band at enrolment, then write the dispatch rules that use it: alcohol handover, night hours, vehicle class.
- Put a retention clock on document images and say what it is, out loud, in the worker privacy notice.
The honest limits
Section 48 is immigration law. It does not require an age check, and nothing in it mentions age assurance. What connects the two is mechanical rather than legal: the document that proves a right to work states a date of birth, and the Code’s duty to confirm that the person working is the person checked is the same engineering problem as binding an age decision to a session. We are reading two instruments that were not written together, and saying so is more useful than pretending they form a single scheme.
The one to one reading of Article 7(1)(f) follows the plain text of the clause, and the clause is unusually clear for a Directive. But as far as we can find, no supervisory authority has published guidance applying it to identity verification at platform onboarding. Treat it as a reading rather than a settled rule, and expect at least one national transposition to go further than the text.
Penalty figures and the commencement date come from the legislation and the published Code. The state of transposition across the EU moves week by week, so check your own markets rather than trusting a number in a blog post. None of this is legal advice, and a fleet operating in several jurisdictions should get a view on its own facts.
How Xident fits
One to one, by default, with no shared gallery. Xident verifies a face against the document the person presented. Face templates are isolated per customer at the database level and are not pooled into a cross-customer search index. That is the shape Article 7(1)(f) leaves open, and it is why the EU half of this problem does not need a different vendor from the UK half.
Decision records instead of retained documents. Every check returns outcome, method, threshold, confidence, policy version and timestamp. Document images are deleted within 24 hours of processing. An age band derived at enrolment is a field your dispatch service can read without ever touching an image again.
Per-shift binding you can afford. This is the part teams assume is too expensive, so here is the arithmetic. A document Verification on Growth is €0.20. A Check, which covers the returning-user path, is €0.02. Take 10,000 active couriers with one binding check at the start of each working day: 300,000 Checks a month. On Scale, at €499 a month with 150,000 Checks included and €0.01 for each one beyond that, the whole binding programme costs about €2,000 a month. One £45,000 penalty is close to two years of it. The full rates are on the pricing page.
A human in the loop where the law needs one. Failed binding checks route to review rather than deactivation, which is what the Platform Work Directive requires for decisions that affect someone’s work.
The free sandbox grants 1,000 Checks and 100 document Verifications as one-time allowances, not a monthly quota, which is enough to run a courier enrolment and a week of binding checks end to end before you commit to a design.
The short version
Your age assurance programme points at your customers. Since 1 October the UK asks the same class of question about your workers, their substitutes included, and backs it with £45,000 per head.
Check the worker and the substitute, and prove at the start of each shift that the person working is the person you checked. Do it one to one against their own enrolled template, because the EU Platform Work Directive closes the face-gallery search you would otherwise build, and closes it on 2 December. Derive the age band while you have the document open, then delete the document. Keep the record of the decision, because that record is your statutory excuse.
The document you already collect answers both questions. Most platforms just never read the second one.
Xident provides identity and age verification infrastructure built on one to one document matching, with face templates isolated per customer and decision records kept in place of images. The free sandbox includes a one-time allowance of 1,000 Checks and 100 document Verifications. Talk to us about binding a verified worker to the person who actually starts the shift.
