Full Report
Regulator wants to know whether parent Aylo did its homework before reopening the door to UK iPhone users
Analysis Summary
# Regulation/Compliance: Online Safety Act (OSA) - Age Assurance Duties
## Overview
The Online Safety Act (OSA) mandates that providers of services containing adult content (specifically pornography) must implement "highly effective" age assurance measures to prevent children from accessing harmful material. This specific investigation focuses on the duty of platforms to perform due diligence and testing before implementing third-party age verification signals (e.g., Apple’s device-level signals).
## Key Details
- **Issuing Authority:** Ofcom (UK Office of Communications)
- **Effective Date:** July 2025 (Original duties); May 2026 (Investigation focus)
- **Jurisdiction:** United Kingdom
- **Status:** In Effect (Investigation Phase)
## Requirements
### Mandatory Requirements
1. **Effective Age Assurance:** Platforms must use technology that is "highly effective" at identifying and excluding minors.
2. **Pre-Implementation Assessment:** Providers must assess whether children are likely to access the service before launching or changing features.
3. **Due Diligence:** Platforms must conduct rigorous testing and homework on the efficacy of third-party tools (like Apple's age signals) before deployment.
4. **Re-Assessment:** Platforms must revisit safety assessments whenever a significant change is made to the service or if evidence suggests existing checks are failing.
5. **Information Compliance:** Companies must respond to regulatory evidence requests during investigations.
### Recommended Practices
1. **System-Wide Solutions:** Collaboration with OS-level providers (Apple/Google) to create uniform safety standards.
2. **Privacy-Preserving Methods:** Utilizing verification methods that protect user data while confirming age.
3. **Multi-Market Testing:** Documenting the efficacy of various age assurance methods across different geographic regions to justify the chosen approach.
## Affected Organizations
- **Industries:** Adult content providers, social media platforms, and any online service hosting "harmful" content for children.
- **Organization Size:** All sizes; however, Ofcom is currently prioritizing enforcement against large-scale entities (Category 1 services).
- **Geographic Scope:** Any entity providing services to users located in the United Kingdom, regardless of the provider's headquarters location.
## Compliance Timeline
- **July 2025:** Online Safety Act age assurance duties officially came into force.
- **February 2, 2026:** Aylo (Pornhub) restricted UK access for new users due to OSA pressures.
- **May 2026:** Pornhub reopened access to UK iPhone users via Apple-based signals.
- **September 23, 2026:** Ofcom officially launched the investigation into Aylo’s compliance.
- **TBD:** Deadline for Aylo to respond to provisional findings (if a breach is found).
## Implementation Guidance
### Assessment Phase
- **Target Audience Identification:** Determine the likelihood of children attempting to access the service.
- **Gap Analysis:** Evaluate if current age gates (e.g., self-declaration) meet the OSA’s "highly effective" threshold.
### Implementation Phase
- **Technology Integration:** Deploy age assurance (e.g., credit card checks, ID uploads, or device-level signals).
- **Control Testing:** Conduct internal "red-teaming" to see how easily the age checks can be bypassed (e.g., via VPN or fake accounts).
### Validation Phase
- **Documentation:** Maintain records of the due diligence performed on third-party vendors (like Apple).
- **Ongoing Monitoring:** Monitor traffic patterns and user demographics to ensure the age gate remains effective over time.
## Technical Requirements
- **Age Assurance Signals:** Implementation of device-level API signals (e.g., iOS age verification) to confirm user maturity.
- **Access Control:** Hard blocks for users on platforms where effective age assurance is not yet available (e.g., blocking Android/PC if only iOS checks are ready).
## Penalties & Enforcement
- **Fines:** Up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.
- **Other Consequences:**
- **Service Restriction:** Ofcom can seek court orders for ISPs to block access to the site.
- **Criminal Liability:** Senior managers can face criminal prosecution for failing to comply with information requests.
- **Enforcement:** Managed by Ofcom’s Director of Enforcement; includes evidence gathering, provisional findings, and a final ruling.
## Related Standards
- **UK GDPR:** Age assurance must balance safety with data minimization and privacy.
- **PAS 1296:2018:** The code of practice for online age estimation (often used as a benchmark for "effectiveness").
## Resources
- **Official Documentation:** [ofcom.org.uk/online-safety]
- **Guidance Documents:** Ofcom’s "Guidance for providers of published pornographic content."
## Practical Recommendations
- **Document Everything:** Organizations must be able to prove they "did their homework" before flicking the switch on new age-check technologies.
- **Platform Parity:** If a service is offered on multiple platforms (iOS, Android, Web), ensure a consistent level of age assurance across all to avoid regulatory scrutiny.
- **Engagement:** Cooperate fully with Ofcom information requests to avoid personal liability for senior management.