Ofcom Is Investigating Whether Pornhub's Age Checks Actually Work

Key Takeaways

• According to the BBC, Ofcom has launched an investigation into Pornhub owner Aylo over whether its age verification process is effectively preventing children from accessing adult content.
• Ofcom said in May that Pornhub began using Apple's age verification system for some UK users, and has concerns that Aylo "may not have conducted sufficient due diligence and testing" before implementation, meaning the system "may not be highly effective."
• Pornhub's UK traffic dropped more than 75% after the Online Safety Act's tougher age checks came into force in October 2025; the site then restricted access entirely in January before partially reopening to Apple users who had verified their age.
• The investigation doesn't cover how Apple operates its age checks — only how Aylo implemented and tested them.
• Ofcom can fine non-compliant companies up to £18 million or 10% of global annual turnover, whichever is greater.

What Ofcom Found and What It's Investigating

According to the BBC's technology reporter Laura Cress, Ofcom has launched a formal investigation into Aylo — the company that owns Pornhub — over whether its age verification process meets the standard required under the UK's Online Safety Act. The OSA requires sites hosting pornographic material to use "highly effective age assurance" to confirm users are over 18, but leaves the choice of method to the platform.

According to the BBC, Ofcom said in May that Pornhub had begun using Apple's age verification system for some UK users — a process that relies on Apple confirming a user's age through its iOS platform. Ofcom's concern is that Aylo may not have conducted sufficient due diligence and testing before implementing this process, and that as a result it may not be meeting the highly effective standard the Act requires. The investigation will examine how Aylo implemented age verification and whether it carried out the necessary checks before deploying a system that affects whether children can access the site's content.

What Ofcom isn't investigating is how Apple operates its age checks. The regulator's scrutiny is aimed at Aylo's implementation decisions, not Apple's underlying technology — a distinction that matters because Ofcom had previously described Apple's system as "a real win for children and families" when it launched in the UK.

Pornhub's Argument, and Why It's Not Entirely Wrong

According to the BBC, Aylo strongly defended its system in a statement, arguing that Apple's technology "provides significantly stronger protection than any other age assurance method currently available in the UK market." 

Aylo's broader argument is one it's been making consistently since the OSA came into force: a system that requires individual pornographic sites to implement their own age checks simply drives users to non-compliant sites that aren't following Ofcom's rules — and those sites, according to research cited by Aylo from the Lucy Faithfull Foundation, may also be more likely to host harmful or illegal content, including sexual images of children.

That argument has some empirical support. According to the BBC, Pornhub's UK traffic dropped more than 75% after the OSA's tougher checks came into force in October 2025. That traffic didn't disappear — it went somewhere. Some of it went to VPNs routing around the blocks. 

Some of it almost certainly went to sites operating outside Ofcom's jurisdiction and making no attempt to verify ages. A system that pushes users from a large, regulated platform to smaller, unregulated ones may produce worse outcomes for child safety than it prevents, depending on what those alternatives look like.

That doesn't make Aylo's implementation above scrutiny. Ofcom's concern isn't with the principle of using Apple's system but with whether Aylo tested it rigorously enough before deploying it. Those are separate questions.

The Structural Problem Age Verification Can't Solve

Here's what this investigation doesn't address, and what the entire age verification framework consistently sidesteps: age verification, as currently implemented, is very good at generating data and very uncertain as a mechanism for actually keeping determined minors off adult platforms.

Every age verification method in use — ID scans, credit cards, biometric selfies, device-level age signals from Apple or Google — creates a record. Someone's age is confirmed, a signal is generated, a third party is involved, and data is retained for some period. 

The September 2025 breach at a Discord vendor exposed government ID photos and selfies belonging to around 70,000 users — data collected for exactly this kind of age verification purpose. Our own research tracking 88 identity verification breaches since 2011 found that at least 2.15 billion records have been affected on a confirmed basis, with 41 of those incidents exposing actual ID scans and biometric templates.

The data collection, in other words, works reliably. Whether the child protection goal is achieved is what Ofcom is now investigating — and the honest answer, given that Pornhub's traffic dropped 75% and went somewhere else rather than disappearing, is that it mostly hasn't been. Age verification creates a gate at the compliant site, generates data in the process, and leaves the non-compliant internet untouched. That's not an implementation failure. It's what age verification does.

The UK has built significant regulatory infrastructure around the premise that if regulated platforms implement robust enough age checks, children will be kept safe online. Ofcom's investigation into whether one of the world's largest pornographic sites met the standard reveals the gap between that premise and the reality. The checks may not be working. The data collection is.