Age verification: Ofcom's £18M Pornhub age verification systems probe

Here's a fact that should stop you mid-scroll: the UK's media regulator, Ofcom, is now investigating whether Pornhub actually tested its own age verification before turning it on. Not whether the age check exists. Whether anyone bothered to see if it works. That's the story, and it's a bigger deal than it sounds.

Age verification in the UK just moved from a checkbox on a website to something a government regulator can fine you millions of pounds over, and that changes what information you might be asked to hand over the next time a site wants to confirm your age.

If you've spent any time online in the UK this year, you've probably noticed more sites asking you to prove how old you are before letting you in. That's not a coincidence and it's not going away. Ofcom opened an investigation into Aylo, the company that owns Pornhub, over whether its age verification setup actually meets the UK's rules under the Online Safety Act. According to Global Banking & Finance Review, the concern isn't that Pornhub has no age verification system. It's whether the age-verification technology it picked was properly checked out before it went live for millions of users.

Age verification in the UK: why the rules changed and what it means for you

For years, "age verification" meant a pop-up asking "Are you over 18?" You clicked yes, you got in, nobody checked anything. That era is ending in Britain. Since enforcement of the Online Safety Act began on July 25, 2025, Ofcom has gone after porn sites, file-sharing services, and smaller high-risk platforms over how they confirm age. It already handed out the UK's first fine over £1 million, to a company called AVS Group Ltd, for not having an age verification system that actually worked. So this isn't Ofcom warming up. This is Ofcom mid-swing.

Aylo said back in May that Pornhub would lean on Apple's age-verification technology built into iPhones to confirm users are over 18. Sounds solid, right? Apple's a name you trust with your phone, your photos, your face. But here's the twist Ofcom is pointing at: using a big trusted company's age verification method doesn't automatically mean you did your homework. Ofcom's worry, according to the reporting, is that Aylo "may not have conducted sufficient due diligence and testing before implementing its new age assurance process." Translation: they may have flipped the switch without checking if the lock actually locks. That single age-verification system now sits at the center of a regulatory probe with real financial teeth.

Aylo said in May that Pornhub would rely on Apple's age-verification process to confirm users are over 18, but Ofcom's concern is not the Apple system itself, it's whether the company tested it properly before deploying it. reporting on the investigation, Global Banking & Finance Review

What does uk age verification actually require from a website?

Under the Online Safety Act, sites with adult content have to put in place age verification methods that are "highly effective" at keeping kids out, not just checks that technically exist. That could mean id checks, a face scan that runs age estimation, checking with your mobile network, or a digital wallet that holds proof of age. The law doesn't demand one age verification method. It demands one that actually works, and that a company can prove works, using information the platform can defend to a regulator. This article is part of a series, start with Character Ai Age Verification A Teens Id In A Database.

Age verification laws now ask "does it work," not just "does it exist"

This is the part that should change how you think about every age check pop-up from here on. Age verification laws in the UK used to be about presence, ticking a box that says a check happened. Now they're about performance. A company can't just say "we added a face scan" and walk away. Regulators want proof the age verification technology actually catches a 14-year-old trying to sneak in, and proof the company tested that before rolling it out to the public. That's a real shift, and it puts pressure on every platform, from adult sites to social media apps, to show their work. Age verification aims to turn a vague promise into a provable fact, backed by information a regulator can actually audit.

Here's where it gets genuinely tricky. Every age verification method has a weakness. Id uploads mean a website now has a photo of your driver's license sitting somewhere. Face-based age estimation means a camera is guessing your age from your skin and features, which sounds simple until you remember that age estimation from a photo is never exact. Mobile carrier checks lean on information your phone company already has about you. None of it is free of trade-offs, and researchers have pointed out that no single verification method manages to be highly accurate, cover the whole population, and fully protect your privacy at the same time. Pick two.

Do social media platforms have to follow the same online age verification laws?

Yes, increasingly. The UK's age verification laws apply beyond adult content, and regulators elsewhere are moving the same direction, including proposals in the EU around social media restrictions for minors. If you're a parent wondering whether this only affects "that corner of the internet," it doesn't. Age verification is becoming standard across far more of the internet than most people realize.

Real age verification checks versus scams that copy them

Now for the part where I actually help you, because this is where my job gets interesting. As real age checks become normal, so does the opportunity for fraud. A scammer doesn't need to invent a new age-verification technology of their own. They just need to copy the real thing closely enough that you don't think twice. If you've ever wondered whether a site asking for your id or a quick selfie is legit or a setup, that's exactly the question this whole system is forcing all of us to get better at answering.

One useful thing you can actually check before you upload anything: look at whether the request is happening on the platform's own domain, not a link you clicked from a text or a random pop-up window, and look for a named verification system or vendor mentioned by the site (Apple's built-in age verification technology, a bank-style digital id check, a known age-verification systems provider), rather than a generic "click here to confirm your age" box with no explanation of who processes it. Legitimate checks tell you, even briefly, what information they collect and why. Scams almost never do.

How can I tell if a website's age verification request is real?

Check that it happens on the site's own address bar, not a redirected link. Look for a named age verification system or vendor rather than a bare "confirm your age" box. Be wary if it asks for more information than your age, like your full id number, address, or banking details. Real checks under UK law exist to confirm that a user meets minimum age requirements, not to build a profile of you. Previously in this series: Facial Recognition Camera 200 Sainsburys Stores Scan Your Fa.

The privacy trade-off nobody's fully solved yet

Privacy advocates aren't wrong to push back here, and I'm not going to pretend this is a clean win for anyone. Requiring id or biometric data (your face, fingerprints, that kind of body-based proof that's uniquely you) as age attestation for ordinary content online is a real shift in how much anonymity people get on the internet. Critics have warned this could make it much harder for adults to access legal content privately, and some worry aggressive enforcement just pushes people toward less regulated corners of the internet, or tools that dodge the age check entirely, rather than actually protecting kids. Both things can be true at once: the goal is good, and the age verification method still needs work.

Look, nobody's saying this is simple. A regulator fining a platform £1 million for weak age verification is a real consequence. But so is a parent uploading their driver's license as identity verification to a site they've never fully trusted, hoping the information stays where it's supposed to. Ofcom's own fine against AVS Group Ltd for lacking a proper age verification system shows the agency isn't bluffing. The question for the rest of us is whether the industry can build age verification software that's actually trustworthy with our information, not just technically compliant on paper.

The bigger picture: Ofcom's investigation isn't really about Pornhub. It's a test case for whether every platform in Britain, and probably beyond, has to prove its age verification system actually catches the kids it's supposed to catch, before it gets to claim compliance. Fraud around fake verification requests will only grow as real age verification becomes routine, so the smartest habit you can build right now isn't paranoia, it's just pausing for ten seconds before you hand over your face, your id, or other information to make sure the site asking is the one you think it is.

age verification: Frequently Asked Questions