Investigation into Aylo’s compliance with the duty to prevent children from encountering pornographic content through the use of age assurance

Background

Section 36 of the Online Safety Act 2023 (‘the Act’) requires providers of regulated user-to-user services to carry out ‘children’s access assessments’, in order to determine whether their service is likely to be accessed by children. Children’s access assessments must be suitable and sufficient, and providers must carry out an assessment in the circumstances and timeframes set out in the Act, including before making any significant change to the service’s design or operation or in response to evidence about reduced effectiveness of age assurance that is used on the service. For more information, see our Children’s Access Assessment Guidance.

The duty to carry out a children’s access assessment came into effect on 16 April 2025. 

Where a service is likely to be accessed by children the duties on providers of regulated user-to-user services in Section 12 of the Act apply. These duties include the requirement to implement highly effective age assurance to prevent children of any age from encountering pornographic content by means of the service. For more information, see our guidance on highly effective age assurance for providers of user-to-user services.

The duty to implement highly effective age assurance for user-to-user services came into effect on 25 July 2025. 

Ofcom has produced guidance for providers of user-to-user services that sets out what constitutes highly effective age assurance, which is available here. Paragraph 3.6 of our guidance states that “regardless of where the age assurance occurs in the ecosystem or whether it is implemented by the service provider or by a third-party, it is the responsibility of the regulated user-to-user service provider to ensure that age assurance is implemented in such a way that it is highly effective at determining whether or not a user is a child”.

Our guidance is also clear that should services opt to use wider system-level age assurance, they must ensure the initial age check and the process to share the information with the regulated service (e.g. through age tokens) is highly effective.  

Investigation

On 22 September 2026, under our enforcement programme to protect children from encountering pornographic content through the use of age assurance, we opened an investigation into Aylo Freesites Ltd (‘Aylo’) in relation to its adult service Pornhub.

We are concerned that Aylo may not have conducted sufficient due diligence and testing before implementing a new age assurance process on Pornhub in May 2026. As a result, we are concerned that the age assurance process that Aylo has implemented may not be highly effective at correctly determining whether or not a particular user is a child and therefore there is a risk that children are able to encounter pornographic content by means of the service. 

The process relies on signals from a third-party (Apple) that suggest UK iOS/iPadOS users attempting to access Pornhub may have completed Apple’s age checks. Ofcom’s investigation will examine how Aylo integrated these signals as part of an age assurance process and whether it conducted the necessary due diligence and testing before adopting this process. Given the relevant duties under the Act apply to the service provider, this investigation will consider Aylo’s implementation of its age assurance process and will not make a determination on how Apple operates its age checks. 

Ofcom’s investigation will examine whether there are reasonable grounds to believe that the provider has failed, or is failing, to comply with its duties under section 12 of the Act, to prevent children of any age from encountering pornographic content through the use of highly effective age assurance.  

The investigation will also examine whether Aylo has failed, or is failing, to comply with its duties under section 36 of the Act relating to children’s access assessments. 

Ofcom’s Online Safety Enforcement Guidance sets out how Ofcom will normally approach enforcement under the Act. This includes our approach to information gathering and analysis and the procedural steps we must take to fairly determine the outcome of the investigation.
We will provide an update on the investigation in due course.