LOS ANGELES — The Free Speech Coalition (FSC) has published an article offering guidance on the U.K.'s Online Safety Act and the various guidelines put forward by the country's telecommunications regulator Ofcom.
The article follows:
The United Kingdom’s Online Safety Act (OSA) went into effect earlier this year, which (among many other things) requires websites (or “services”) that provide adult content to implement age verification for traffic coming from the UK. Ofcom, the regulator charged with enforcing the OSA, has put out a dizzying array of guidance in recent months. This article aims to simplify what adult sites need to know, but it does not represent legal advice – always speak with your legal advisors when deciding how to comply with laws and regulations!
Part 3 or Part 5?
Very long story short, your site’s functionality determines whether it is covered under Part 3 or 5 of the OSA. At the moment, the biggest practical difference between being covered by one part or the other is the enforcement deadline for incorporating age verification on your site.Part 3 of the OSA covers “user-to-user” (U2U) services that allow users to interact with each other, including by uploading content or messaging one another, as well as search engines. Examples of U2U services likely* include tube sites, cams, and fan platforms. These services are expected to implement age verification by July 25, 2025, as Ofcom explained in a letter in April.
Part 5 covers any other site that displays or publishes adult content. This includes paysites; sites that sell content downloads, rentals, and streams; and other types of adult content services. For simplicity, we'll refer to these as porn sites in this article.
Porn sites were expected to implement age verification in January of 2025. Many have already received letters from Ofcom requesting information about how they plan to comply. Below, we’ll cover the basic requirements for adult websites regulated by the OSA.
Age Verification Requirement
The law requires that all sites with pornographic content implement "highly effective age assurance." In contrast with U.S. laws, Ofcom is not concerned with the type of age verification used, provided that it meets technical criteria that adult websites are not generally in a position to evaluate.Thankfully, they have also published a list of methods they consider highly effective:
- Photo-identification (photo-ID) matching
- Facial age estimation
- Mobile-network operator (MNO) age checks
- Credit card checks (only adults may have a credit card in the UK)
- Open banking
- Digital identity services
- Email-based age estimation
The methods that they explicitly prohibit are:
- Self-declaration that a user is an adult
- Entering a user's birth date without additional verification
- Debit cards and other payment methods that are available to minors
- Simply including text on the website or in the terms of service that says the site is only for adults.
For more in-depth information about "highly effective age assurance," please consult Ofcom's resources:
- Guidance on highly effective age assurance and other Part 5 duties
- Guidance on highly effective age assurance for Part 3 services
- Quick guide to implementing highly effective age assurance
Record-Keeping Requirements
Of course, there are different record-keeping requirements for U2U services and porn sites.Free Speech Coalition is creating a template to help porn sites comply with this requirement. It will be shared once Ofcom has responded to our questions about the exact information and level of detail needed. Until then, please refer to Ofcom's guidance on keeping records to demonstrate compliance with the OSA.
U2U services are expected to conduct a Children's Access Assessment at least once a year. They helpfully provide a template that you can use for this purpose.
Further reading:
- Duties to keep written records for age assurance (porn sites)
- Children's access assessments Guidance (U2U)
Letters from Ofcom
Ofcom has been sending out letters to porn sites for several months. They request contact information for the company's OSA compliance point person and an explanation of the company's plans for implementing age verification. Companies that do not respond or mistakenly provide incorrect information are subject to extremely severe penalties, so it's important to confer with trusted advisors when sharing information with Ofcom (or any regulator)!If you have questions for Ofcom that you would rather not ask directly, drop us a line. FSC is happy to ask them anonymously on your behalf and communicate any answers they provide.
* Ofcom has not explicitly spelled this out. They have only said that they "anticipate the types of service covered by [Part 5] will include studios and paysites."