Ofcom Investigates Pornhub Over Apple-Based Age Checks
Ofcom has opened an investigation into Pornhub over concerns that children can still access the site despite age-check requirements under the Online Safety Act.
The regulator announced the inquiry on 23 September 2026. It centres on Pornhub owner Aylo and its use of Apple's age-verification process to decide who can view pornography, a system Ofcom said may not be "highly effective". The Guardian
Pornhub had previously blocked new UK users in response to the Act. In May, it said it would use device-level checks — trusting the age recorded on a person's phone — to let UK users verified as 18 or older through Apple use a standard adult experience. Ofcom describes this as a new age assurance process deployed for some users in May 2026. Ofcom
Under the Act, Ofcom said it is the service provider's job to make sure any age check is highly effective, no matter where in the process the check happens. The regulator is concerned Aylo may not have done sufficient due diligence and testing before using the system. Its own checks found the site could have been reached by children. The inquiry is not focused on Apple's checks themselves, but on whether Aylo's reliance on them follows the law. George Lusty, Ofcom's director of enforcement, said liability stays with the provider.
The law requires services that host pornographic material to use highly effective age assurance to determine whether a user is over 18. That duty for user-to-user services took effect on 25 July 2025. Ofcom guidance lists credit card checks, open banking and facial age estimation as methods. Providers are now putting such controls in place across thousands of sites in response to Ofcom's enforcement. Ofcom
Ofcom describes robust age checks as a cornerstone of the Online Safety Act. Under the Act, it must produce and publish a report on how online services have used age checks. Its report of 15 July 2026 states that highly effective age assurance is helping to prevent children from accessing pornography online. A finding that Aylo broke the law could lead to a fine of up to £18m or 10% of global revenue, whichever is greater.
The broader context here is how responsibility is shared in layered systems. Device-level signals offer scale and familiarity for users and platforms. Regulators still hold the pornography provider accountable for effectiveness, validation and ongoing performance. Due diligence and testing before launch therefore become central compliance questions, not technical formalities.
Looking at what this means for enforcement, the Aylo case will test that standard in public. The penalty is substantial. For other adult services using third-party checks, the outcome will clarify how much independent verification Ofcom expects before a provider can rely on an operating system or app store signal. The parallel report finding, that effective checks are reducing child access, gives Ofcom room to present this inquiry as targeted correction rather than systemic failure.
