Britain’s media and communications regulator, Ofcom, has formally opened an investigation into Aylo, the company that owns Pornhub, over serious doubts about whether its age verification system genuinely prevents children from accessing adult content on the platform. The move marks one of the most significant enforcement actions taken under the UK’s Online Safety Act since the legislation came into force.
What Triggered the Investigation
The story begins back in May, when Ofcom noted that Pornhub had introduced a new age-checking process for certain users, one that leans on Apple’s own identity infrastructure rather than a purpose-built adult verification tool. On the surface, that sounds reasonable enough. Apple’s ecosystem is trusted by hundreds of millions of users worldwide, and its privacy credentials are, by most measures, solid.
But Ofcom is not satisfied with the surface. The regulator has stated publicly that it holds concerns Aylo “may not have conducted sufficient due diligence and testing” before rolling out this Apple-reliant process. In plain terms: the system may have been switched on before anyone properly confirmed it was working as intended. And when the content in question is explicit adult material, and the people potentially slipping through are children, “may not be working” is not a phrase any regulator is going to let sit unchallenged.
As reported by the BBC, Ofcom’s investigation will examine how Aylo actually implements its age verification processes, and whether the company did the necessary groundwork before putting the system live for users.
What the Online Safety Act Actually Requires
The Online Safety Act does not tell pornographic platforms exactly which technology to use for age checking. What it does require is that whatever method a site chooses must be “highly effective” at keeping under-18s out. That phrase carries legal weight. It is not a suggestion or a target to aim for. It is the threshold a site must clear, or face regulatory consequences.
The flexibility built into the law means platforms have options: facial age estimation, credit card verification, mobile network operator checks, photo ID matching, and, as Aylo is attempting, integration with existing tech giant ecosystems. The freedom is genuine. But the standard remains fixed and uncompromising.
George Lusty, Ofcom’s Director of Enforcement, put it plainly: “Online age checks are a vital protection to prevent children from encountering inappropriate or harmful material, including pornography. We expect tech firms to ensure age checks are highly effective before introducing them. Anything less could leave children at risk.”
That last sentence is not rhetorical flourish. It is a statement of regulatory intent, and it signals that Ofcom is prepared to act if Aylo’s system falls short.
Aylo Pushes Back, Hard
Aylo is not rolling over. In a detailed statement issued to the BBC, the company mounted a vigorous defence of its approach. Its core argument is one of comparative performance: after experimenting with multiple age-check methods across multiple markets, Aylo concluded that Apple’s system “provides significantly stronger protection than any other age assurance method currently available in the UK market.”
That is a bold claim, and it deserves scrutiny. If accurate, it reframes the conversation entirely. The question would no longer be whether Aylo chose a weak method, but whether the entire UK age verification market is simply not good enough, and whether Ofcom’s “highly effective” standard is being measured against a baseline that is lower than anyone would like to admit.
Aylo also confirmed it will cooperate fully with the investigation, which is the sensible and legally prudent path. Whether that cooperation translates into the regulator being satisfied with what it finds remains entirely open.
The Apple Question
One notable boundary Ofcom has drawn in its investigation is this: it will not examine how Apple operates its own age-checking mechanisms. The inquiry is focused squarely on Aylo’s decision-making and implementation, not on whether Apple’s technology is fit for purpose in isolation.
This matters because it places the burden firmly on the platform. Even if Apple’s system is technically sound, Aylo is responsible for understanding how it performs in the specific context of an adult content site, for testing it rigorously, and for being confident it meets the legal standard before switching it on. Choosing a reputable technology partner does not automatically satisfy the “highly effective” requirement. The platform must do its own homework.
The Bigger Picture for Online Safety
This investigation is not just about one website. It sets a precedent for how the Online Safety Act gets enforced across the adult content industry. There are dozens of platforms operating in the UK that host explicit material, and many of them will be watching this case closely.
If Ofcom finds that Aylo’s Apple-based system fails to meet the standard, it signals that no shortcut, however tech-credentialed the partner, will be accepted without rigorous, documented testing. If Aylo is vindicated, it could open the door for other platforms to adopt similar ecosystem-based approaches, potentially reshaping how age verification is done across the industry.
Child safety charities and advocacy groups have been pushing for stronger enforcement of the Online Safety Act since its passage, and for many of them, this investigation represents the kind of regulatory muscle they were promised when the law was debated in Parliament.
Age verification online has been a contested topic in the UK for years. An earlier attempt to mandate it, under the Digital Economy Act, collapsed before it ever launched, beset by technical and political complications. The Online Safety Act was supposed to be the fix. Whether it actually delivers depends heavily on how seriously regulators pursue cases exactly like this one.
What Comes Next
Ofcom has not set a public timeline for concluding the investigation, which is typical for regulatory inquiries of this nature. The process involves gathering evidence, reviewing Aylo’s internal documentation, potentially consulting technical experts, and ultimately deciding whether the company is in breach of its obligations under the Online Safety Act.
If a breach is found, Ofcom has the power to issue significant fines and require changes to how the platform operates in the UK. It can also, in extreme cases, seek to have a site blocked from UK users entirely, though that remains a last resort.
For now, Pornhub continues to operate in the UK. Its age gate stays up. And Ofcom’s investigators get to work.
The central question this investigation poses is one the entire digital industry needs to sit with: when a company says it has done everything possible to protect children online, is “possible” actually good enough, and who gets to decide?
