Pornhub Returns to Australia, but Only for Verified Apple Users

Key Takeaways

Eight months after leaving Australia entirely, Pornhub is back — for some Australians. Aylo announced on Wednesday that eligible adult users who have confirmed their age through Apple's Australian age verification process will now be served a standard adult experience on the site. Everyone else remains blocked.

Australia introduced stricter age verification laws in March 2026 requiring proof of age to access adult content, including pornography, R-rated video games, and sexually explicit AI chatbots. Pornhub's response at the time was to exit the market rather than implement its own per-site verification, arguing that such an approach would not protect children and would instead create data privacy risks while pushing users toward non-compliant platforms. 

That argument was substantively correct — Ofcom's ongoing investigation into Pornhub's UK age verification implementation, which we covered, is examining exactly whether site-level checks are doing the job they're supposed to do.

Aylo's position has now shifted, not because Australia's laws changed, but because Apple's device-level verification arrived. Apple recently introduced age checks in Australia following a rollout in the UK, allowing users to verify their age once at the device level — using a credit card, passport, driver's license, or government ID — and have that status communicated to apps and websites without those services seeing the underlying document. Pornhub is treating that as sufficient.

The Device-Level Argument and Its Limits

Aylo's framing of the Apple system is worth taking seriously on its own terms, because it's making a real argument rather than just defending its commercial interests. The company has long advocated for device-based age verification as more effective and privacy-protecting than per-site verification. When every phone or tablet starts in a restricted state and unlocks adult content only after the device owner confirms their age, the verification happens once, with an established identity infrastructure, rather than being repeated — with associated data collection — at every platform a user visits.

That argument has genuine merit. Our ID verification breach research documented 88 incidents affecting at least 2.15 billion records since 2011. Per-site age verification creates 88 more opportunities for that kind of breach with every new platform that implements it. A single device-level check is a smaller attack surface than dozens of individual platform checks.

But the Apple-only restoration also makes the limits of this approach visible. Device-level age verification is only as universal as the device infrastructure. Apple has deployed it in Australia and the UK. Android has not. That means a 45-year-old Australian adult with an Android phone can’t access Pornhub in their own country, while their neighbor with an iPhone can — not because of anything either of them did, but because one phone manufacturer moved faster than the other. 

The practical effect of a "device-level" solution that only works on one platform is that it fragments access by hardware, which isn’t a principled outcome.

The VPN Comment

Aylo's announcement included a note that device-level verification "limits the usefulness of VPNs to circumvent age-verification technologies." That framing positions VPN use as a problem to be solved rather than a tool people use for legitimate privacy reasons.

The correct reading is narrower: if age verification happens at the device level rather than at the IP address level, routing traffic through a VPN doesn't change the device's verified age status. That's a technical property, not a moral one. People who use VPNs for privacy, security, or to access region-restricted content unrelated to age verification are not the population being described. The framing conflates circumvention with ordinary VPN use in a way that's worth pushing back on.

What This Means for the Broader Age Verification Debate

The Pornhub Australia situation is a live case study in what age verification looks like when it moves from law to implementation. The law required age verification. The platform left rather than implement it per site. A device manufacturer deployed a solution the platform found acceptable. Access returned, partially, for users of that manufacturer's products.

The outcome is an internet where access to legal adult content is determined by which smartphone you own, which country's laws apply to you, and whether your device manufacturer has struck the arrangement with platforms that makes verification interoperable. 

That's not a principled framework for who gets access to legal content. It's the accidental result of regulatory requirements being resolved through commercial negotiation between large companies, with users of whichever products lost those negotiations — or who have no smartphone at all — simply excluded.