The need for age assurance has been much discussed in the context of the EU Digital Services Act (DSA) and the UK Online Safety Act (OSA) and the organisations to which they apply, and even more so in light of the UK government’s announcement on 15 June of a social media ban for under 16s. However, there has been less attention on the need for a much broader range of websites and apps to introduce age assurance in order to comply with their obligations under the GDPR. Most of the discussion from a privacy perspective has instead related to the need for age assurance technologies themselves to comply with privacy laws. This is of course important, but it has camouflaged the wider point that privacy laws themselves may mean that age assurance is required in order for the website/app to be GDPR compliant, regardless of the position under the OSA or DSA.