Ofcom opened a formal investigation on 23 September 2026 into whether Pornhub’s age-check system meets UK law — and on 7 October, Aylo, the company that runs Pornhub, used that exact same system to restore the site’s access in Australia. The regulator has not finished deciding whether the method works. Aylo is scaling it up anyway.
Why it matters to creators
This isn’t really a story about Pornhub. It’s a live test of what “highly effective age assurance” means under the UK’s Online Safety Act — the same standard OnlyFans and every other Category 1 pornographic platform has to meet. If Ofcom rules that device-level checks aren’t good enough, expect pressure on every platform using lighter-touch verification to add friction — ID uploads, facial scans, the stuff that’s already dented sign-up conversion across the industry. If Ofcom clears it, device-based checks could become the industry’s preferred route out of the age-verification mess that’s been costing creators traffic for two years.
What Ofcom is actually investigating
Since May 2026, Aylo has used a system that relies on signals from Apple suggesting a UK user has already completed Apple’s own device-level age check — rather than making every visitor verify directly with Pornhub. Ofcom opened its formal investigation into Aylo on 23 September 2026. Its enforcement director, George Lusty, said the regulator is concerned Aylo “may not have done the necessary due diligence and testing” before rolling the process out, and that this could mean it isn’t effective enough at keeping children away from pornography.
Two duties are in play, as trade publication MLex reported from the investigation filing. First, the general requirement to use “highly effective age assurance” — and under the Online Safety Act, that responsibility sits with the platform publishing the content, not with whichever company’s technology it leans on. Second, the duty to carry out a proper children’s access assessment before making a change like this. Ofcom is not investigating how Apple’s own system works — only whether Aylo tested and implemented it properly. If Ofcom finds a breach, Aylo faces fines of up to £18 million or 10% of qualifying worldwide revenue, whichever is larger.
Why Aylo is doubling down anyway
Pornhub blocked Australian users entirely in March 2026 rather than comply with the country’s updated Online Safety Act rules, which carry fines of up to A$50 million per breach — a saga we covered in September. On 7 October, Aylo confirmed it would let Australian users back in — but only on Apple devices that have completed Apple’s age check. Aylo’s VP of brand and community, Alex Kekesi, called the Apple method “one of the strongest and hardest to circumvent protections currently available,” and the company used the moment to publicly press Google and Microsoft to adopt the same model.
Aylo’s logic is straightforward: device-level checks ask the user to prove their age once, to their phone, rather than to every app and site they visit. That’s less friction, less data shared with individual platforms, and — Aylo argues — a smaller incentive for people to route around the check with a VPN. The Age Verification Providers’ Association has pushed back on that framing, arguing the model “does not clearly achieve compliance” because a verified device doesn’t confirm who is actually holding it at the time. Ofcom’s UK investigation is effectively a live test of whether that distinction matters enough to fail the “highly effective” bar.
What this means if you’re not on Pornhub
You don’t need to be anywhere near Aylo’s platforms for this to affect you. Ofcom’s decision, whenever it lands, will be the clearest signal yet of how far a platform can lean on someone else’s age-check infrastructure — Apple’s, Google’s, a third-party vendor’s — before that counts as not doing enough homework. OnlyFans sits in the same Category 1 bracket and has already been fined once by Ofcom over how it described its own age-assurance technology, so this isn’t an abstract compliance question for the platform your income runs through. It’s a preview of the bar OnlyFans will be held to next.
There’s an upside worth watching too. Every age-gate that adds friction has, in practice, cost platforms traffic — something Ofcom’s own data on age checks has already shown at scale. If device-based verification is eventually accepted as sufficient, it could be the first realistic route to lower-friction sign-ups without falling foul of the law. That’s a genuinely good outcome for anyone whose business depends on converting visitors into subscribers.
“We expect tech firms to ensure age checks are highly effective before introducing them.” — George Lusty, Ofcom Director of Enforcement
What to do now
- Don’t assume any single age-verification method — device-based or otherwise — is settled law. Treat this as unresolved until Ofcom issues a decision, which can take months.
- If you run your own site or linktree with an age gate, keep records of what method you use and when you last reviewed it. Ofcom’s complaint against Aylo was about inadequate testing and documentation, not just the technology itself.
- Watch for Ofcom’s provisional decision on this case — it will be the single clearest piece of guidance yet on what “highly effective” actually requires in practice.
- Don’t rely on one traffic source or one verification regime. The last eighteen months have shown repeatedly that age-verification rules can cut off access to an entire country or platform overnight.
This is general information, not legal advice — speak to a qualified professional about how UK or Australian age-verification law applies to your own site or business.
