In January, the U.K.’s online safety regulator, Ofcom, published its guidance on how online services that host adult content need to verify users’ ages under the Online Safety Act.
Ofcom has already fined at least one video sharing platform for “failing to adequately protect children from accessing online pornography.” That site required only a declaration by users that they were over 18, which is insufficient as an age assurance measure under Ofcom’s rules.
Drafted exclusively for XBIZ by Ofcom, the following Q&A clarifies what verifying users’ ages really means in practice, as well as what services the OSA rules apply to, and provides answers to some other frequently asked questions.
How will adult sites know if these rules apply to them?
Ofcom: Ofcom regulates online services such as websites and apps under the U.K.’s Online Safety Act. We’re a U.K.-based regulator, but that doesn’t mean the rules don’t apply to sites based abroad. If people are visiting your site from the U.K., you’ll likely be in scope, wherever in the world you’re based. You can use our online tool to check if you’re in scope and find out more details about how the Online Safety Act could apply to your service.
What will in-scope sites have to do?
Ofcom: Make sure to read all the relevant guidance Ofcom has published. To help, you can find a directory of the relevant parts of our publications on this page. But in simple terms, if your site allows pornography, you need to make sure users from the U.K. are over 18, using something called “highly effective age assurance.” This means the age check should be technically accurate, robust, reliable and fair. You can read more about those criteria in our quick guide to highly effective age assurance. You’ll need to make sure users can’t see any pornography before the age check has been completed.
What methods can sites use to make sure U.K. users are over 18?
Ofcom: We have set out a non-exhaustive list of methods which could be highly effective if they’re implemented in the right way. These include: credit card checks, facial age estimation, open banking, photo-ID matching, network operator age checks, digital identity wallets and email-based age estimation. If you control the website, it’s your responsibility to make sure the methods you use meet the four criteria above — technically accurate, robust, reliable and fair — as well as making sure you comply with U.K. data protection laws.
Some sites based in the U.K. already have to verify that users are over 18, and we’re seeing them offer users more than one option.
If you have already taken payment from someone who has used a credit card, and you are able to show that the specific way you’ve done it meets the requirements of being highly effective, you may not need to verify that user’s age again.
Many sites already ask users to confirm they’re over 18. Is that no longer enough?
Ofcom: Self-declaration methods, like ticking a box, are not considered highly effective. Nor is asking users to enter into a contract confirming they’re over 18. If you use a payment method to verify age, it has to be a card that only adults can use — i.e., a credit card. Debit cards shouldn’t be accepted.
Is there anything else adult sites have to do?
Ofcom: Yes, for other requirements we have not covered in this Q&A, go to www.ofcom.org.uk/adultsonly.
When do adult sites have to do all this by?
Ofcom: If you’re a publisher of pornography, which we think most studios and paysites will be classed as, we expect you to start taking steps immediately. We’ve written to hundreds of studios and paysites, asking to see their plans. For those sites that don’t respond, we can open investigations and consider formal enforcement action. If you’re a user-to-user service, which we think most tube, cam or fan sites will be classed as, Ofcom expects you to have a solution in place in July 2025, with a more specific date confirmed later this year.
Will all sites have to do this?
Ofcom: Ofcom won’t just be expecting the biggest sites to comply with these rules. It’s true that more traffic can mean more potential harm to children, and we’ve been working with some of the industry leaders to prepare them for this change. But we know this only works if everyone moves together. So if your website is caught by these new U.K. rules, Ofcom will be expecting you to have these solutions. Noncompliant sites of all sizes, including smaller services, may face enforcement action where it is appropriate and proportionate.
What happens if a site doesn’t comply?
Ofcom: Ofcom wants to work with the industry to make sure these solutions are in place on time, so if anyone is unsure about these rules, they can get in touch by emailing pornsupervision@ofcom.org.uk Sites that don’t comply will be investigated using Ofcom’s legal powers, and those investigations can lead to penalties of up to 18 million pounds ($22 million) or 10% of global revenue. Really serious cases may result in court orders requiring third parties like payment providers or advertisers to stop providing services to noncompliant sites, or third parties like ISPs to block access to noncompliant sites for U.K. users altogether.
Where can adult companies and other industry stakeholders find out more?
Ofcom: You can find Ofcom’s guidance on highly effective age assurance, and on children’s access assessments, on this page. We’ve also created a dedicated directory for the adult industry, helping you to navigate the different documents relevant to your service. You can find that at ofcom.org.uk/adultsonly. We are always open to having conversations to provide more information, so feel free to get in touch at pornsupervision@ofcom.org.uk.
