The regulatory regimes under the OSA and data protection laws operate from different perspectives, so complying with one does not necessarily mean compliance with the other. Both regimes have extra-territorial effect and businesses outside the UK are potentially within scope, if their services are available to UK users and they have sufficient links to the UK. Facial age estimation is emerging as the developing market standard for age assurance.