"Online age checks are a vital protection to prevent children from encountering inappropriate or harmful material, including pornography," said George Lusty, director of enforcement at Ofcom.
Ofcom opens a probe into Aylo's Apple-reliant age assurance
Ofcom has opened an investigation into whether Pornhub owner Aylo complied with age assurance duties under the Online Safety Act (OSA), which came into force in July 2025. The regulator said it will examine how Aylo implemented and tested a new age assurance process that relies on signals supplied by Apple, and stressed that the investigation is concerned with Aylo's deployment and verification practices rather than the internal workings of Apple's system.
How the Apple-based checks were rolled out
Pornhub introduced the Apple-linked age assurance for some UK users in May 2026. The mechanism depends on signals indicating that an iOS user may have completed Apple's age checks. Aylo had previously restricted Pornhub to new UK users on February 2, arguing that the OSA had diverted visitors toward less regulated sites; existing users who had already verified their age retained access. In May 2026 Aylo partially reversed that restriction for eligible UK users who had confirmed their age through Apple, while new users on Android, PCs, and other platforms remain locked out.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadTraffic shifts and the business calculus that followed
The company’s access restrictions came amid sharp declines in UK traffic after the OSA's age assurance requirements took effect. Pornhub's UK visits fell 47 percent shortly after the rules kicked in and were reportedly down 77 percent by October. Those moves — closing access for new users on most platforms, then selectively reopening for Apple-verified users — form part of what Ofcom will assess when deciding whether Aylo met its OSA obligations and whether it conducted sufficient testing and due diligence before deploying the Apple-based process.
OSA enforcement powers and possible outcomes
Ofcom will gather evidence before deciding whether Aylo breached the OSA; if it provisionally finds a contravention, the regulator must give the company an opportunity to respond before reaching a final decision. The watchdog can close an investigation without further action or impose financial penalties of up to £18 million or 10 percent of qualifying worldwide revenue, whichever is greater. Ofcom can also order companies to remedy failures and, in serious cases of continuing noncompliance, ask a court to require third parties such as ISPs to restrict access to a service. The regulator noted that some failures involving information requests can expose senior managers to criminal liability.
Parliamentary pressure, the Children's Commissioner, and Ofcom's response
The inquiry comes against a backdrop of criticism aimed at Ofcom’s performance since the OSA's age assurance rules took effect. During a Lords Communications and Digital Committee inquiry into the OSA's impact, Dame Rachel de Souza, England's Children's Commissioner, told peers that children believe the legislation "has made absolutely no difference" in preventing access to online harms and accused Ofcom of failing to use its regulatory powers and UK politicians of not giving it sufficient authority.
Ofcom officials pushed back at a subsequent hearing. Enforcement director Suzanne Cater pointed to actions the regulator has taken against Telegram, TikTok, X, and other pornography companies, and told peers the regulator is preparing to target larger companies now that many of the more straightforward cases involving smaller companies are concluding. Cater and colleagues acknowledged limits to Ofcom's reach where companies operating from overseas have few UK assets against which fines can be enforced.
What this means for children, Aylo, and regulators
- Children and families: Ofcom framed the investigation as a safety measure intended to ensure age checks are "highly effective" before they are put live; the regulator is explicitly focused on whether the deployed process could leave children at risk.
- Aylo (Pornhub): The company faces scrutiny over its decision-making and testing after a February restriction, a May 2026 partial reopening for Apple-verified users, and large reported drops in UK traffic. The outcome could range from no further action to fines, remedial orders, or court-ordered access restrictions.
- Ofcom and policymakers: The probe tests Ofcom's ability to enforce the OSA against a high-profile, cross-border service while operating under political and parliamentary scrutiny; the regulator has warned of practical limits when overseas companies have limited UK assets.
Ofcom will now gather evidence and decide whether to provisionally find a contravention and invite Aylo to respond. The regulator’s decisions in this case — and any subsequent remedies or penalties — will be watched closely by officials, campaigners and platforms as the OSA's age assurance regime is tested in practice.
