What happened
Ofcom has opened an investigation into whether Pornhub's owner, Aylo, complied with the age assurance duties that came into force under the Online Safety Act in July 2025. The regulator said in May that Pornhub had begun using a new age verification process for some users that relied on a third party, Apple.
The concern is not how Apple runs its own checks. Ofcom was explicit that it is looking at how Aylo implemented and tested the resulting process, and whether the company carried out sufficient due diligence before switching it on. Its worry is that the method may not be highly effective at keeping children away from the site.
As things stand, existing users who had already verified their age kept access. New users on Android, PCs and other platforms are still locked out.
"Online age checks are a vital protection to prevent children from encountering inappropriate or harmful material, including pornography," said George Lusty, Ofcom's director of enforcement. Anything less could leave children at risk.
Aylo says it will cooperate fully and argues that Apple's device level verification offers one of the strongest and hardest to circumvent protections available. The Age Verification Providers Association has pushed back, arguing a site cannot lean on a device based system unless it can show children are in fact prevented from reaching its content to the required standard. If Ofcom finds a breach, it can fine up to 10 percent of qualifying worldwide revenue or GBP 18 million, whichever is higher.
Why this is a GRC story
This is a control testing case. The obligation sits with the regulated service, not with the supplier it chooses. Relying on someone else's assurance does not transfer the duty to demonstrate that the control works for your own context. The regulator is asking for the due diligence file and the test evidence, and that file either exists or it does not.
Prior praise is not a defence. Aylo points out that Ofcom had previously described Apple's technology as a win for children and families. A regulator complimenting a technology in one context does not approve a specific implementation in another. Compliance decisions need their own documented rationale, not a citation of a favourable quote.
Portfolios need a testable story. Where a large platform applies different age assurance methods by platform and user type, each configuration is a separate control that needs to be assessed and justified. Uneven coverage across iOS, Android and desktop is the kind of gap that is easy to ship and hard to defend.
What to watch
Watch whether Ofcom accepts device level age signals as a standalone control or requires compensating measures on top. That determines what every age restricted service in the UK can rely on.
For teams anywhere with age assurance, content or eligibility controls: write down what you deployed, what you did to test it before launch, and what result you saw. If that record does not exist today, build it now rather than during an information request.
Attribution: Analysis based on The Register and related public reporting. This article is original commentary, not a repost of the source material.