Enforcement programme into age assurance measures on UK-established, adult video-sharing platforms

We are still assessing the age assurance measures of certain notified and non-notified adult VSPs. So, we have extended the enforcement programme for another three months.

During this time, we intend to:

• conclude our assessments of notified smaller adult VSPs and, where necessary, take steps to drive improvements to their age assurance measures;
• continue our investigation into Secure Live Media Ltd;
• conclude our assessments of certain other potentially in scope non-notified VSPs; and
• aim to understand any further challenges faced by these platforms in implementing sufficiently robust age assurance measures on their sites.

Since opening the enforcement programme, Ofcom has undertaken extensive engagement and information gathering to understand age assurance measures in use across the adult VSP sector and to determine if there are compliance concerns that merit further action to address potential harm.

Key updates to this work include:

Notified smaller adult VSP providers

• we have been engaging with some of the notified smaller adult VSP providers to understand the measures they have in place to protect underage users from adult content and identify required improvements;
• several have already taken steps to improve their access controls for underage users;
• where we identify a need for further improvements, we will set a deadline by which these providers must bring themselves into compliance. Should they fail to meet this deadline, we may consider further enforcement action.

Non-notified adult platforms

• we have identified a number of non-notified adult platforms that may fall in-scope of the UK VSP regime and appear not to have appropriate age assurance measures in place;
• we opened an investigation into Secure Live Media Ltd (believed to be the provider of adult VSP CamSoda) on 16 May 2023 to determine whether they have failed to notify Ofcom and take appropriate measures to protect under-18s from videos containing pornographic content on their site;
• we are continuing to engage with a number of other sites to determine whether or not they are required to comply with the UK VSP regime. One platform we contacted, which appeared to have insufficient access control measures, chose to close down the service following our engagement.

General understanding

• we are engaging with adult platforms across the sector, which has developed our understanding of the challenges platforms face when considering implementing any age assurance measures and the respective merits of different methods available to them;
• these learnings will be instrumental as we assess further platforms in the VSP regime and within the Online Safety Regime when the new legislation comes into force.

Next steps: As one of Ofcom’s key priorities is to make sure that people live a safer life online, we will continue to address potential harms arising from age assurance concerns. With this in mind, Ofcom will extend the current programme of monitoring and enforcement for a further three months. During that time, we will continue:

• ongoing engagement with notified adult platforms;
• our enforcement investigation into Secure Live Media Ltd;
• further engagement with other non-notified adult platforms, with possible enforcement action for non-compliance; and
• driving improvements ahead of the Online Safety regime within the adult sector.

We intend to publish an update following that period.

From time-to-time Ofcom may open a programme of work, or “enforcement programme”, to examine a problem or concern that relates to a particular group of stakeholders, or to a whole sector.

One of our priorities for the second year of the VSP regime is to promote the implementation of robust age assurance, so that children are protected from the most harmful content. In October 2022, we published our report on the first year of VSP regulation. The report highlighted that many platforms that specialise in videos containing pornographic material (or “adult VSPs”) do not appear to have measures that are robust enough to stop children accessing pornographic material.

Today Ofcom is opening an enforcement programme into age assurance measures across the adult VSP sector.

Our objectives for this programme are:

1. to assess the age assurance measures implemented by notified adult VSPs, to ensure they are sufficiently robust to prevent under-18s from accessing videos containing pornographic material;
2. to identify whether there are other platforms in the adult VSP sector that may fall in scope of the VSP regime but:
   • have not yet notified their service to Ofcom, as required under the VSP framework (see more below); and
   • may not have appropriate measures in place to protect under-18s from pornographic content; and
3. to understand from providers of adult VSP services the challenges they have faced when considering implementing any age assurance measures. This will also help us build a picture of what measures work and are proportionate to expect from different VSPs, in line with our strategic priority of driving forward the implementation of robust age assurance.

The programme will seek to determine the scale of any compliance concerns in respect of notified and non-notified adult VSPs. We will then decide whether any further action (including enforcement) is needed, and how best to address potential harm.

Regulatory framework

Since 1 November 2020, Ofcom has had powers to regulate UK-established VSPs under the framework set out in Part 4B of the Communications Act 2003. This framework sets out to protect users of VSP services from specific types of harmful material in videos, including safeguarding under-18s from potentially harmful material, such as pornographic content.

Under the framework, providers are legally obliged to submit a formal notification of their service to Ofcom should they meet the definition of a VSP and fall within UK jurisdiction. Providers are responsible for self-assessing whether they need to notify their services to Ofcom as a VSP based on specific legal criteria. More information is available in our published guidance (PDF, 512.2 KB) on notification.

Ofcom has developed regulatory guidance (PDF, 860.3 KB) for VSP providers on measures to protect users from harmful material, which include systems for obtaining assurance as to the age of potential viewers. Our guidance recognises there may be different means of achieving age assurance, but platforms are required to apply the principle that material with the most potential to harm the physical, mental, or moral development of under-18s must be subject to the strictest access control measures. The guidance also describes several forms of age verification that we would not consider to provide appropriate protection from pornographic content (such as self-declaration tick-boxes).

Ofcom's enforcement programme

Following our review of responses to formal information requests issued to all notified VSPs, we highlighted in our VSP report that age assurance measures currently implemented by many adult VSPs may not be sufficiently robust in stopping children from accessing pornographic material. We are also concerned that there may be other adult VSPs within UK jurisdiction that:

1. have not notified to date; and
2. may not have taken appropriate measures to protect children from harmful content.

Ofcom’s priority is to make sure that people live a safer life online. We need to address potential harm arising from our concerns around age assurance, and foster improvements across the adult VSP sector. One of our main objectives for the second year of the VSP regime is to promote the implementation of robust age assurance, thereby protecting children from the most harmful content online (including pornography). The enforcement programme we have opened today will help us meet this objective.

If Ofcom becomes aware of a platform within UK jurisdiction that is not protecting its users appropriately, we could take enforcement action even if it has already notified to us. Failing to notify when in scope of the VSP framework could also lead to enforcement action. We therefore encourage all providers to review the guidance we published on 10 March 2021, Video-sharing platform – who needs to notify to Ofcom?

Video-sharing platforms that are not currently regulated in the UK are likely to be ‘user-to-user services’ (as defined in the Online Safety Bill), and so would be subject to regulation when the new legislation comes into force if they have a significant number of UK users, or if the UK is one of their target markets.

We expect this programme to run for four months initially. We will assess the level of compliance across the adult VSP sector, and publish an update on progress at the end of the period. We may decide to open formal investigations following our assessment.