Ofcom has opened an investigation into Aylo – the service provider of Pornhub – under the UK’s Online Safety Act, to determine whether it has complied with its duties to prevent children from encountering pornographic content.
Robust age checks are a cornerstone of the UK’s Online Safety Act. Sites like Pornhub that host pornographic material must use highly effective age assurance to determine whether a particular user is over 18, in order to prevent children from accessing that content.
Our initial assessment
In May 2026, Pornhub deployed a new age assurance process for some users. This process relies on signals from a third party, in this case Apple, that suggest UK users trying to access Pornhub may have completed Apple’s age checks.
The Online Safety Act is clear that it is the service provider’s responsibility to ensure that any age assurance process is highly effective – no matter at what stage an age check occurs.[1]
Providers must also carry out a suitable and sufficient assessment of whether their service is likely to be accessed by children. They must do this before making any significant change to the design or operation of their service, or in response to evidence about reduced effectiveness of age checks.[2]
We are concerned that Aylo may not have conducted sufficient due diligence and testing before implementing its new age assurance process. As a result, we are concerned that Aylo’s process may not be highly effective at preventing children from seeing pornography.
What our investigation will examine
Ofcom has decided to open a formal investigation to establish whether Aylo has failed to comply with legal obligations under the Online Safety Act, in particular to:
- use highly effective age assurance to prevent children from seeing pornography; and
- complete a suitable and sufficient children’s access assessment.
As part of our investigation we will consider how Aylo implemented its age assurance process, and whether it conducted the necessary due diligence before deployment. Our investigation will not make a determination on how Apple operates its age checks.
George Lusty, Ofcom’s Director of Enforcement, said: “Online age checks are a vital protection to prevent children from encountering inappropriate or harmful material, including pornography. We expect tech firms to ensure age checks are highly effective before introducing them. Anything less could leave children at risk.”
Ofcom’s investigation process
The Online Safety Act sets out the process Ofcom must follow when investigating a company and deciding whether it has failed to comply with its legal obligations.[3]
Our first step is to gather and analyse evidence to determine whether a breach has occurred. If, based on that evidence, we consider that a compliance failure has taken place, we will issue a provisional decision to the company, who will then have an opportunity to respond our findings in full, as required by the Act, before we make our final decision.
Enforcement powers
If our investigation finds that a company has broken the law, we can require platforms to take specific steps to come into compliance or to remedy harm caused by the breach. We can also impose fines of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.
We will provide an update on this investigation in due course.
Notes to editors:
- Ofcom’s Part 3 Guidance on highly effective age assurance can be found here.
- Ofcom’s Children’s Access Assessment Guidance can be found here.
- Our Online Safety Enforcement Guidance can be found here.
- For more information on what to do if your online service allows pornographic content, please visit our dedicated page.
Related content