The Age Check That Isn’t

01 · The short version

Four numbers, one problem

The Online Safety Act did not ban pornography. It built a gate. The gate is real: the top ten UK porn sites now ask for age. But a gate is only as strong as its hinges, and in 2026 four of them are failing at once.

Those numbers describe the same problem from different angles. The duty is on the books. The regulator is active. The top of the market has moved. But the tail has not, the discovery layer has not, and the money has not.

The short version is five sentences:

1. The duty is broad; the definitions are porous. The Act reaches “regulated provider pornographic content”, but that phrase excludes user-generated porn, text-only porn, paid advertisements and anything that is not “solely or principally” for sexual arousal.
2. The regulator is active; the money is not arriving. Ofcom has levied more than £7m in fines. Two providers have paid about £135,000. Nine of 11 providers have not paid.
3. The top of the market has moved; the tail has not. All of the top ten UK porn sites now have age checks. Roughly a quarter of the top 100 have neither an age check nor a UK block, and almost half the porn services visited by children in Ofcom’s study had no checks at all.
4. The check verifies a person, not the person. The largest measured circumvention route is not a VPN. It is a child using an adult’s face, ID, login or device — often with the adult’s knowledge.
5. The law creates a privacy bill it does not regulate. Section 81(4)(b) requires providers to “have regard” to privacy and record that regard. It imposes no minimisation, retention, security or interoperability standard.

This report is diagnostic. It does not propose a fix. It maps the places where the regime’s reach exceeds its grip, and it separates what is confirmed in the statute or by a regulator from what is alleged, contested or still speculative.

02 · What the Act requires

A single sentence, doing a lot of work

Part 5 of the Online Safety Act 2023 applies to an internet service if three conditions are met. It must publish or display “regulated provider pornographic content”; it must not be exempt; and it must have links with the UK. If all three hold, section 81 imposes the duty.

The duty is not a ban. It is an outcome: children not “normally” able to encounter the content. Neither “normally” nor “highly effective” is defined in the statute. Ofcom supplies four criteria — technically accurate, robust, reliable, fair — but they are guidance, not law, and they carry no numeric threshold.

The definitions are built in layers. “Pornographic content” means content “of such a nature that it is reasonable to assume that it was produced solely or principally for the purpose of sexual arousal” (s 236). “Provider pornographic content” means porn published or displayed by the provider or by someone acting on its behalf, including via software or algorithms, embedded content, content behind a blur or click-through, and AI-generated content produced in response to a user prompt (s 79(2), (6)). “Regulated” provider porn then strips out text-only content and paid-for advertisements (s 79(3)–(5)). User-generated porn is excluded altogether (s 79(7)).

“Age verification” means a measure designed to verify exact age; “age estimation” means a measure designed to estimate age or an age range. A measure that requires a user to self-declare their age, without more, is not age verification or age estimation at all (s 230). “Child” means under 18 (s 236).

The two regimes

The Act does not have one pornography regime. It has two, with different triggers, different standards and different commencement dates.

The gap between those two dates — January and July 2025 — is one of the most consequential facts in the regime. A service that could characterise its porn as user-generated got an extra six months. A service that could characterise it as provider porn did not.

The statutory test is also aggregate. “Not normally able to encounter” is not “never able to encounter”. A provider can argue that because most children are deterred, occasional access is not a breach. Ofcom’s guidance treats the duty as requiring no porn before an age check, but the statute does not say that in terms. The result is a duty that is simultaneously broad in reach and soft at the edges.

03 · The enforcement machine

Tools, powers and the paper trail

Ofcom is the regulator. Its powers are substantial on paper: statutory guidance under section 82, codes of practice, risk assessments, information notices, provisional notices of contravention, confirmation decisions, financial penalties, daily penalties and business disruption measures.

The penalty ceiling is the greater of £18 million or 10 per cent of qualifying worldwide revenue (Schedule 13, paragraph 4). Ofcom can also require remedial action and, in principle, ask a court to order payment providers, advertisers, app stores, search engines or internet service providers to withdraw services from a non-compliant platform (ss 144–146).

The machine is real, and Ofcom has used it. By July 2026 it had opened 23 investigations covering 88 adult services, issued more than 30 formal notices and fined seven providers of 24 sites. By October 2026 it had levied 31 fines against 11 providers, totalling more than £7m.

But the machine is also a paper machine. Section 81(4)–(5) requires a provider to keep a written record of the kinds of age verification or estimation it uses, how it uses them and how it has had regard to privacy, and to summarise that record in a public statement. There is no statutory audit, no mandatory certification, no published test of whether the check works against a determined child. Ofcom’s “skilled persons” audit power is not yet operational. Its “vet your vendor” resource is guidance, not a regulatory requirement.

That is the architecture. The rest of this report is about where it leaks.

04 · The search hole

The discovery layer is outside the duty

The clearest statutory gap is not in enforcement. It is in the definition. Section 79(6)(b) says porn that “appears in search results” is not “published or displayed” by the search service. Search engines are therefore not Part 5 porn publishers, however prominently they surface the content.

They are regulated search services under Part 3, with duties to minimise the risk of children encountering primary priority content. But that is a different, softer standard. Ofcom’s own report says the quiet part out loud:

The practical effect is a conveyor belt. In Ofcom’s study, 62 per cent of children who visited porn used a search engine immediately beforehand. Search engines accounted for around 30 per cent of entry points to pornography services among 8–14s. Almost half — 47 per cent — of the pornography services visited by children had no age checks at all.

The exclusion is not a blanket immunity. Google and Bing are regulated search services. Ofcom could act under Part 3 if their systems were not “proportionate systems and processes designed to minimise the risk” of children encountering porn. But that is a risk-mitigation standard, not an age-assurance standard. And no enforcement proceedings against Google or Bing over search discoverability were found in the sources reviewed.

The voluntary workstream is thin. After engagement with Ofcom, Google and Bing “agreed to work with Ofcom and other relevant stakeholders to explore practical solutions to address discoverability of porn services without protections via search engines.” No binding measure was announced.

What about image search?

Image search is where the exclusion does the most work, because the results are images, not just links. Thumbnails in a results grid almost certainly count as “appearing in search results” and are therefore excluded. A larger preview panel is more arguable: if Google serves a full-size image from its own cache rather than merely linking to the source, there is an untested argument that this is a separate “display” by Google, outside the search-results carve-out. Google’s own hosted or generated content is not covered by the exclusion. SafeSearch is a product policy, not a statutory age gate.

The academic critique is blunt. McGlynn, Woods and Antoniou describe search services’ duties as “a reduced obligation compared to user-to-user services”, given search’s “foundational role in content access, including pornography.” The Act’s own impact assessment says the pornography provision does not capture search results because search is regulated separately. That is a rationale, not a solution.

Status: the exclusion and the absence of a search-specific HEAA duty are confirmed in the statute and by Ofcom. The policy criticism is confirmed by Ofcom’s own data. Whether Part 3 duties are adequate is contested; no enforcement action against a search engine over this issue was found.

05 · The user-generated line

One word — “provider” — splits the regime

“Pornographic content that is user-generated content … is not to be regarded as provider pornographic content” (s 79(7)). That single exclusion pushes the largest tube, cam and creator platforms into Part 3, with a later commencement date and a different duty.

The allegation that this mattered is well reported. In November 2024 the Christian Institute and the Telegraph reported that Pornhub was claiming it was covered by the later user-generated-content rules, not the January Part 5 rules. The Age Verification Providers Association said such sites were “not obviously user-to-user services” to the general public. No direct Aylo statement confirming the motive was found; Ofcom’s public position was that services hosting their own pornography had to introduce checks immediately.

The practical gap is real even without the motive. Part 5 began on 17 January 2025. The Part 3 children’s duties began on 25 July 2025. A service that could characterise its content as user-generated got an extra six months.

The boundary is not easy to draw. Ofcom/BBFC research found that 47 per cent of the top 100 UK porn services were tube services, 14 per cent cam services and 18 per cent aggregators. The researchers “could not always differentiate between UGC and provider content.” Thirty-one per cent of services hosted UGC but the researchers could not determine whether provider content was also present. Twenty-four per cent offered a “content partner program.” Branded channels were present on 31 per cent of services, 94 per cent of them tube services. If channels are treated as indicative of provider content, the share of services publishing provider content rises from 30 per cent to 61 per cent.

The boundary turns on “control.” Ofcom’s guidance says the provider is “the entity or individual that has control over which content is published or displayed,” and that editorial control over the nature, selection or presentation of content is likely to count. But there is no decision applying that test to a revenue-share arrangement, a content-partner programme or a shared-parent-company structure. Embedded third-party players sit in an unresolved interaction between s 79(6)(a)(ii) (“embedded” content counts) and s 79(7) (user-generated content does not).

There is a related labelling problem. Some adult aggregators describe themselves as “search engines.” If accepted, that would shift them toward Part 3 search duties and away from Part 5. Section 229 defines a search engine broadly — a service that enables a person to search some websites or databases — but excludes a service that searches just one website or database. Many aggregators search multiple sites. No Ofcom decision or court ruling on whether a particular adult aggregator is a search service was found.

Status: the carve-out is confirmed. The Pornhub allegation is reported but not directly proven. The provider/UGC boundary is confirmed as factually indeterminate by Ofcom’s own research. The legal effect of content-partner programmes and aggregator labels is contested and unresolved.

06 · The undefined gate

“Significant” is whatever the provider says it is

Part 5 reaches a service if it “has links with the United Kingdom.” That means either “a significant number of United Kingdom users” or “United Kingdom users form one of the target markets for the service (or the only target market)” (s 80(4)). Neither expression is defined. No numeric threshold is set. The provider makes the initial judgement.

Ofcom’s guidance does not supply a number. It says the Act does not define “significant,” that providers “should be able to explain their judgement,” that the number should be “material in the nature and context of the service” rather than “large or substantial,” and that providers should “err on the side of caution.” That is a stance, not a safe harbour.

Part 5 also lacks the extra limb that Part 3 has. A Part 3 service can be in scope if it is “capable of being used in the United Kingdom by individuals” and there are reasonable grounds to believe there is a “material risk of significant harm” to UK individuals (s 4(6)). Part 5 has only the “significant number” and “target market” limbs. A low-reach, high-harm, offshore provider-porn service that does not market to the UK can therefore fall between the two.

The scale of the long tail makes the point sharper. The Government’s own impact assessment found that 36 per cent of the top 200 pornography sites — and 16 per cent of traffic — were outside the scope of the Act’s core duties. Ofcom later told the Lords that the market includes “a longtail of at least 20,000 identified adult sites.” A self-assessed scope test at the edge of a 20,000-site market is not a minor technicality.

There is a counter-argument. Open Rights Group says “even small niche providers of pornographic content are required to implement HEAA measures,” because there is “no minimum number of users required for the provisions of Part 5 to bite.” Ofcom’s “err on the side of caution” stance cuts the same way. But no published Ofcom decision quantifies “significant,” no litigation construes it, and no provider has publicly admitted relying on a small-audience escape. The gap is structurally real; its use is largely undocumented.

Status: the indeterminacy is confirmed. The claim that providers exploit it is analytical. The missing s 4(6) limb is confirmed textually; its practical effect is contested.

07 · What counts as porn

The definition is the first gate

“Pornographic content” means content “of such a nature that it is reasonable to assume that it was produced solely or principally for the purpose of sexual arousal” (s 236). The test is objective and purpose-based. It is also the first place a service can argue that the Act does not apply.

Ofcom’s guidance says the definition may include AI-generated or animated images, audio and audio-visual content, and content that would fall under the BBFC’s R18 category — but also “other content of a strong sexual nature that seeks to sexually arouse or stimulate” that would not. Art, education and documentary material may fall outside. There is no case law on where the line falls.

The exclusions are more concrete. Content consisting only of text — or text plus a non-pornographic GIF, emoji or symbol — is excluded from “regulated provider pornographic content” (s 79(4)). The same text-only exclusion appears in the Part 3 definition of “primary priority content” (s 61(6)), so text-based pornography sits outside age-assurance duties across the regime. Audio, by contrast, is expressly within scope according to Ofcom. That text/audio distinction is hard to justify on harm grounds.

Paid-for advertisements are also excluded (s 79(5)). The definition requires consideration (monetary or non-monetary) and placement determined by systems or processes agreed between the parties. Affiliate links, creator promo codes, “shop window” channel pages and organic posts may not meet both limbs. No source was found applying the paid-ad definition to affiliate arrangements.

AI, nudify and the “on the service” formula

Section 79(6)(a)(iii) treats porn generated on the service by an automated tool in response to a user prompt as “published or displayed,” even if only visible to that user for a moment. Ofcom says a provider that makes available a GenAI tool “designed to be used for the purpose of generating pornography” is in scope; a general tool “capable of generating pornography” requires safeguards. Nudify sites are confirmed in scope: Itai Tech Ltd, operator of Undress.cc, was fined £55,000 in November 2025.

But model and API providers that supply weights or inference without publishing output sit awkwardly within the definition. So do AI companions that generate text or audio. Text-only sexual role-play is likely outside Part 5 because of the text exclusion; audio companions may be inside. Ofcom opened an investigation into the AI companion service Novi in January 2026. The Government has said it will require age assurance for sexualised chatbot features by 2027. The statutory position for general-purpose chatbots remains unresolved.

The complexity has a cost. McGlynn, Woods and Antoniou argue that the Act generates “eight new classifications of pornography, each associated with a distinct legal framework,” producing “a confusing and unnecessarily complex regulatory regime.” They exclude Part 5 from their analysis, but the point transfers: the more classifications, the more room to argue that a particular slice of content belongs on the least burdensome route.

Status: the definition and the text/ad exclusions are confirmed. The art/education boundary is analytical. The AI model/API and companion gaps are unresolved; nudify sites are confirmed in scope and have been fined.

08 · The exemption map

Every exemption is a boundary

Part 5 does not apply to services that are “exempt” under Schedule 1 or Schedule 9, or to parts of services that meet the internal business service conditions. It also does not apply to a part of a service that is an on-demand programme service (ODPS), or a non-UK ODPS that is a Tier 1 service (s 80(6)).

The ODPS carve-out is the most interesting. ODPS are regulated under Part 4A of the Communications Act 2003, where the child-protection standard is “proportionate measures,” not “highly effective” age assurance. Ofcom’s guidance gives the example of a pornographic subscription service where editorial decisions are made in the UK and the provider has its head office in the UK. The Media Act 2024 extended the carve-out to certain non-UK Tier 1 services. No published case of a porn service successfully claiming ODPS status to escape Part 5 was found; the arbitrage is structurally plausible but undocumented.

The other exemptions are narrower. Schedule 9 covers internal business services available only to a closed group of officers, workers, contractors, consultants, auditors and, in educational institutions, pupils and students; services provided by public bodies in the exercise of public functions; and services provided by education or childcare providers for those purposes. Schedule 1 paragraph 6 removes most of the ordinary exemptions where regulated provider porn is present, so a Part 5 service cannot rely on the email or limited-functionality exemptions. No evidence was found of a commercial porn service claiming to be an internal business service or an education service.

Two further boundaries matter. First, “regulated user-generated content” excludes one-to-one live aural communications (s 55(2)(d)), so a live audio sexual service between two users is not regulated UGC; provider audio, by contrast, is within Part 5. Second, the s 81 duties extend only to “the design, operation and use of an internet service in the United Kingdom” (s 80(8)). Ofcom’s position is that the Act applies to providers with UK links regardless of where they are based. The tension between those two propositions is the extraterritoriality problem in miniature.

Status: the exemptions are confirmed. Their abuse is largely speculative. The ODPS boundary is the most plausible arbitrage route; the internal-business and education exemptions are not.

09 · The money that never arrives

The fines are real. The collection is not.

Ofcom has levied 31 fines against 11 providers, totalling more than £7m. Only two providers have paid — about £135,000, or roughly 1.9 per cent of the nominal total. The rest is in dispute, in appeal, or simply unpaid.

The fine schedule is dominated by small, overseas porn operators. The largest single penalty is £1.4m against a US LLC. No Category 1 social media platform has yet been fined under the Act.

The table lists the principal decisions. 4chan appears twice — information notices and substantive duties — and the 11-provider count includes the suicide forum and im.ge. It is not a complete reconciliation of every daily penalty.

Three details matter more than the totals. First, the fines are small relative to the statutory maximum: £450,000 for 4chan’s age-assurance breach is roughly 2.5 per cent of the £18m cap. Second, non-cooperation is an aggravating factor, but it also produces a separate penalty that is easier to impose than to collect. Third, the corporate identity can move: some of 8579 LLC’s sites were later listed under Reply Buzzer Ltd, which complicates enforcement against the original entity.

Ofcom’s own explainer sets out the mechanics. A provider has at least 28 days to pay. If it has UK assets, Ofcom can obtain a judgment debt and use bailiffs. If it does not, Ofcom must “engage with law enforcement agencies and private specialists in other countries to identify individuals and assets.” That is a description of a collection problem, not a deterrent.

Status: established and admitted by the regulator. Nine of 11 providers have not paid. Only two small providers have paid, totalling £135,000. The 4chan case is the purest example; it is treated separately below.

10 · Compliance by exit

A block is not an age check

Geo-blocking has become the functional equivalent of compliance. Ofcom counts a UK block as a mitigation; in its July 2026 scorecard, 10 of the top 100 services had blocked the UK, 64 had age assurance, and 26 had neither. By August 2026 the figures were 63 age-assured, 11 geo-blocked and 26 neither. Ofcom describes 74 per cent as “inaccessible to children in the UK without use of circumvention measures.”

Geo-blocking closes investigations without findings. Duplanto Ltd (pornhaven.ai) was investigated, then closed on 30 March 2026 after it “restricted access to its service for people with UK IP addresses.” Ofcom closed “without making any findings as to Duplanto Ltd’s compliance with its duties.” The suicide forum case is the paradigm: Ofcom concluded that the forum’s geoblock was “the fullest extent of what can currently be achieved by Ofcom under the Act,” that the legal grounds for a business disruption order were not met, and that “all possible legal routes under the Act have now been exhausted.”

Dame Melanie Dawes did not dispute the description of geo-blocking as “a win.” She explained the limits of the Act instead: Ofcom does not have “any capacity to require a website, for example, to block themselves in the United States just to deal with the risk of circumvention using a virtual private network by a UK citizen.”

The market has responded in predictable ways. Ofcom found that “many porn sites that have introduced age checks have experienced sharp declines in user traffic, while some sites without age assurance have gained in popularity.” Almost half of the porn services visited by children in its study had no age checks. Nearly nine in ten visits were for under 30 seconds, and 65 per cent for under 10 seconds — a pattern consistent with site-hopping in search of one that will let you in.

Pornhub/Aylo is the highest-profile example. It blocked new UK users in February 2026, then partially reopened in May 2026 for iPhone and iPad users who had completed Apple’s device-level age check. UK traffic reportedly fell 77 per cent by October. Ofcom opened an investigation in September 2026 into whether Aylo’s reliance on Apple’s signal is “highly effective” and whether it carried out a suitable children’s access assessment. Android and PC users remain locked out.

Status: geo-blocking as compliance is confirmed by Ofcom’s own statements and case closures. The 26-per-cent “neither” figure is confirmed in two snapshots. The displacement effect is confirmed; its scale is contested.

11 · The capacity problem

Busy, but not outcome-oriented

Ofcom has opened 23 investigations into the providers of 88 adult services. It has identified a long tail of at least 20,000 adult sites. Roughly half of the 23 investigations had concluded by September 2026. It has around 450 people working specifically on online safety and says it was “fully loaded” before the under-16 social media ban was announced.

Its own leadership is underwhelmed. Oliver Griffiths, Group Director, Online Safety, told the Lords Communications and Digital Committee in September 2026: “Generally, when you look at our tracking indices on this, we are underwhelmed by the overall effect so far.” The Children’s Commissioner, Dame Rachel de Souza, told the same inquiry that children say the Act “has made absolutely no difference”; she called Ofcom “not effective enough” and urged it to “use its teeth.”

The activity metrics look stronger than the outcome metrics. Over 69 million age checks were completed across a sample of 32 services between July and December 2025 — a 23-fold increase. The proportion of children asked to prove their age rose from 25 per cent to 43 per cent. But around seven in ten children still recalled encountering harmful content in a four-week period. A completed check is an input, not an outcome.

Assurance is paperwork

Section 81(4)–(5) requires a written record and a public statement. It does not require independent audit, certification, testing or publication of test results. Ofcom’s “skilled persons” reports — the closest thing to an audit power — were still in “preliminary market engagement” in October 2026. Its “vet your vendor” resource is a support tool, not a regulatory requirement.

Ofcom says it assessed over 1,000 pornography websites “for the presence of age assurance.” That is site-by-site observation of whether a gate appears, not a test of whether the gate works against a determined child. The 69 million checks are counted as completed checks, not unique children blocked or attempts defeated. A site that prompts every visitor, including adults, inflates the number.

Redress is absent

The Act is a public-law regime. Ofcom says: “We are unable to respond to or investigate individual complaints. However, we do use complaints to help us assess whether regulated services are appropriately protecting their users and if we should take any action.” There is no individual decision, reasons, appeal or compensation. Super-complaints are available only to eligible bodies, and only where the complaint is of “particular importance” or affects “a particularly large number of users” (s 169). Penalties are recoverable as court debts, not paid to victims.

Business disruption is unused

The Act gives Ofcom power to ask a court to order payment processors, advertisers, app stores, search engines and ISPs to cut off a non-compliant service. The power requires continuing non-compliance, cannot be used for non-payment alone once a service has complied, and has never been used. In the suicide forum case, Ofcom concluded that the legal grounds were not met. It has asked Parliament to lower the test, allow orders for non-payment alone and permit interim orders.

Status: the capacity and assurance gaps are established. The “underwhelmed” and “absolutely no difference” findings are direct quotes from the regulator and the Children’s Commissioner. The absence of individual redress and the non-use of business disruption are confirmed in the statute and in Ofcom’s statements.

12 · The 4chan case

Two events, one ruling

“The 4chan ruling” is usually compressed into a single story. It is two events on two continents, and only one is a ruling.

Ofcom’s decision is an administrative finding. The US judgment is a jurisdictional dismissal. The court did not uphold the fines, and it did not strike them down. It held that Ofcom is a foreign state under the Foreign Sovereign Immunities Act, so the suit could not proceed in Washington. The merits were never reached.

What Ofcom found

Ofcom found continuing breaches of s 9(2) (no suitable and sufficient illegal-content risk assessment), s 10(5) (terms of service did not explain how users are protected from illegal content) and s 12 (no highly effective age assurance to prevent children encountering pornography). It imposed £450,000, £50,000 and £20,000 respectively, with compliance due by 2 April 2026 and daily penalties of £500, £200 and £100 from 3 April to 1 June 2026. A separate October 2025 decision imposed £20,000 for breaching two information notices plus £100/day, capped at £6,000. The headline “£520,000” understates exposure: fixed penalties across both decisions are £540,000, and maximum aggregate exposure is about £594,000. Nothing has been paid.

Ofcom’s extraterritorial reasoning rests on s 80(4). 4chan’s own site claimed that 7 per cent of its user base was in the UK; SimilarWeb data showed 170,000–330,000 monthly UK users between February 2025 and February 2026. Ofcom held that “a UK user base in the hundreds of thousands is, of itself, a significant number.” In the alternative, it found that 4chan marketed to UK advertisers, which made the UK a target market. Both findings were administrative; neither was tested on the merits in any court.

Ofcom’s free-expression reasoning is thin and generic. It says the requirements are “necessary and justified” and merely replicate “interferences already decided on by Parliament,” going “no further than” the Codes. Anonymity is recorded as 4chan’s objection but never analysed as a distinct issue. “Highly effective” is operationalised through the four guidance criteria — technically accurate, robust, reliable, fair — none defined or quantified. 4chan deployed nothing beyond a one-click adult-content disclaimer.

The D.D.C. held that Ofcom is a “foreign state” because its core functions are “quintessential government functions.” The commercial-activity exception failed because investigating and penalising is “classic regulator, and thus sovereign, behavior,” and the only relationship was “that of a regulator to a regulated party.” The court did not decide the First Amendment, s 230, or whether the penalties are enforceable in the US. Its enforcement discussion is obiter: US courts “generally decline to enforce foreign judgments that violate the United States Constitution,” and “are not necessarily required to enforce foreign penal judgments.”

No appeal appears on the docket; the 30-day window likely expired around 15 October 2026. On 20 October Dame Melanie Dawes told the DCMS Committee that only two of 11 OSA fines had been paid and that Ofcom “won’t be able to recover every single fine.” Rebecca Paul MP raised 4chan in a Westminster Hall debate on 29 October. US bills (GRANITE and HOMEFRONT) would strip foreign regulators of immunity; neither is law.

Status: the Ofcom findings and the D.D.C. judgment are confirmed primary documents. The fines are unpaid. The obligation layer survived; the collection layer did not.

13 · The identity problem

Someone over 18 was involved at some point

The regime verifies a person, not the person. The dominant real-world circumvention route is not technical at all: a child uses an adult’s face, ID, login, device or payment card, often with the adult’s knowledge. The check succeeds. It checks the wrong person.

Ofcom names the mechanism explicitly. Children may use accounts belonging to adults, or rely on an adult to complete a check on their behalf. A parent or older sibling may complete a check so that a child can access content, or allow their ID or card details to be used. A child may have an account shared with an adult who has completed a check, and therefore unrestricted access.

The Government’s own research quantifies it. In the July 2026 study of 2,299 children aged 11–17, 63 per cent of those who bypassed a check did so by “posing as someone else” — equivalent to 24 per cent of all children. Of those who pretended to be old enough, 45 per cent gave a false date of birth, 11 per cent used a parent’s or relative’s ID, 5 per cent used someone else’s ID, and 6 per cent used altered images or disguises. Fifty per cent learned how to bypass from friends their own age; 10 per cent learned from a parent or guardian.

Internet Matters puts numbers on parental facilitation: 26 per cent of parents have allowed their child to bypass age checks, 17 per cent actively helped, and 9 per cent “allowed it or turned a blind eye.” Thirty-two per cent of children say they have bypassed a check in the past two months.

Ofcom’s own compliance findings reinforce the point. Many services rely on a one-time age check and do not require users to repeat it. Its guidance recommends verifying ownership of ID, phone number, email or card; using liveness detection; and repeating checks to prevent access via device or account sharing. Those are expectations, not statutory requirements.

The Aylo/Pornhub case is the first enforcement case to test identity binding at ecosystem level. Pornhub’s May 2026 process relies on “signals from a third party, in this case Apple” that suggest UK iOS/iPadOS users may have completed Apple’s age checks. Ofcom is investigating whether Aylo conducted sufficient due diligence and testing. The Age Verification Providers Association doubts Aylo can show “that each time someone accesses its site, the person is the same one who originally proved their age.” Ofcom says it will not investigate how Apple operates its checks; the probe concerns Aylo’s implementation.

Status: parental and adult facilitation is officially quantified and acknowledged by the regulator. It is not the subject of any enforcement action or specific guidance beyond generic “verify ownership” and “repeat checks” expectations. No provider has been sanctioned for accepting an adult’s ID or face where it otherwise followed guidance.

14 · The VPN question

The evidence is contested; the route is real

VPNs let a user appear to browse from another country. Because much UK age assurance is geo-applied — checks switched on for UK IP addresses — a VPN terminating outside the UK can present a user to a service as a non-UK visitor, outside the age-check flow. This is the most politically salient circumvention route, and the evidence on its scale is genuinely contested.

Ofcom’s July 2026 statutory report found that the estimated number of daily UK VPN users was 2.2 million, compared with 1.2 million before 25 July 2025. It also said: “Our evidence suggests that VPN use has increased among UK users, but does not currently show that this increase is due to children motivated by a desire to bypass age checks.” Its child-specific estimate is 5 per cent, with an explicit reporting-bias caveat. The public record also contains earlier, different figures: a peak of about 1.5 million falling to around 1 million by late September 2025, based on a different data supplier.

The Government-commissioned study is more detailed. It found that 26 per cent of 11–17s have ever used a VPN and 22 per cent in the past three months; 10 per cent of all children say they have bypassed a check using “settings or tools that change their apparent location”; 56 per cent of lifetime VPN users have successfully bypassed a check, against 33 per cent of never-users; and 71 per cent among children who set up the VPN themselves. Twenty-two per cent of lifetime users were helped to set it up by a parent; 43 per cent say a parent pays.

Independent research is flatter. Internet Matters found 8 per cent of 9–17s had used a VPN in the past 12 months, with “no statistically significant changes” over two years; only 16 per cent of VPN users cited restricted adult content. Childnet found no post-July-2025 spike attributable to children. Ofcom’s own report notes that one striking figure — 77 per cent of 16–17s saying they had ever used a VPN, rising to 87 per cent among active porn users — is an outlier against its 31 per cent lifetime figure and appears to come from a pornography-user panel. It should not be used as a population estimate.

The policy is settled for now. The Government has said: “We will not ban or age-gate VPNs.” A Lords amendment to the Children’s Wellbeing and Schools Bill requiring a prohibition on providing VPN services to under-18s was carried on 26 January 2026 by 207 votes to 159, but was not adopted. The Government has asked Ofcom to research how services can detect VPN traffic and prevent children from using VPNs to bypass safeguards. No enforcement action has been taken against any VPN provider, app, influencer or affiliate marketer. The only legal hook is the guidance duty not to promote circumvention, which binds regulated services, not VPN vendors.

Status: a real, sustained increase in UK VPN use is confirmed; attribution to children is contested. The child-specific estimates range from 5 to 10 per cent depending on the study and question. The route is lawful, politically sensitive and not addressed by any ban.

15 · The error band

The margin of error sits at the threshold

Facial age estimation is the workhorse of the porn sector: 68 per cent of all age-check completions on Ofcom’s analysed porn services between July and November 2025. Ofcom accepts it as capable of being highly effective, subject to four criteria — technical accuracy, robustness, reliability and fairness — and a “challenge age” above the statutory threshold, so that a user estimated below the challenge age must complete a second check.

The error numbers are not small. Ofcom’s October 2026 rapid assessment, using NIST data, found that for the 13–17 age group the lowest mean absolute error among 50 tested algorithms was 1.77 years; 19 of 50 were below 3 years. For 18–25 the lowest was 2.39 years; 9 of 50 were below 3 years. Parliament’s POST note says Home Office and NIST testing puts the best systems at “around 2.5 years” at the critical 16–18 boundary, with “consistently higher error rates for female faces.” The Australian trial found false-positive rates at a 16+ threshold of 25.2 per cent for under-13s, 38.3 per cent at 13, 59.4 per cent at 14 and 73.3 per cent at 15.

Compliance with the mitigations is patchy. Ofcom found that all but two pornography services using facial age estimation applied a challenge age; one described its solution as a “no threshold model,” another said it had “no predefined challenge age thresholds.” Multiple analysed dating services deployed facial estimation without a challenge age; two of four had no liveness detection. Retry limits and cooldowns are used but not universal.

Fairness is a guidance criterion, not a published test standard. Ofcom defines it as the extent to which a method “avoids or minimises bias and discriminatory outcomes” in its “internal operation,” expressly excluding “external factors, such as a lack of access to a particular form of identification.” Providers must “consider and monitor” outcome/error parity across characteristics and be “satisfied” that results do not produce significant bias. There is no numeric threshold, no mandated independent test and no publication requirement. The Government’s own study accepts that tools “exhibit bias across gender, skin tone, ethnicity,” and that the market is unlikely to resolve the data gap alone.

Status: facial estimation remains an Ofcom-approved method and the sector’s workhorse. The error band is confirmed by Ofcom, POST, NIST and the Australian trial. Fairness is self-assessed; there is no UK deployment data on false-positive rates by skin tone, sex, age or device quality.

16 · The plumbing

The law regulates the decision, not the enforcement

The Act is technology-neutral. It requires “age verification or age estimation” that is “highly effective.” It does not require server-side enforcement, signed assertions, session binding, short expiry, re-verification, independent testing or certification. Those are implementation choices. The result is that a service can comply on paper while the gate is enforced in the browser, by a cookie, or by a one-time check that anyone can inherit.

The public research record is consistent with that design. A June 2026 study of 154 adult sites in the UK, France, Germany and Italy found that 69 of the 154 had age verification; 60 used age estimation, 14 ID, 17 email, 5 SMS and 28 credit card. The authors report “systemic weaknesses across mechanisms and integrations under realistic threat assumptions, including failures against low-cost, widely accessible attacks.” They describe much of the deployment as “compliance theatre.”

The failure modes are not exotic. A gate can be enforced client-side, so the content is already in the response. A success flag can be a boolean cookie or a message from a pop-up, so the browser can write it without a check. A one-time check can be inherited by anyone using the same device or account. A face check can be defeated by a still image, a video, a 3D avatar or a game character. The EU’s own age-verification app was bypassed in under two minutes after launch; researchers found rate-limiting in an editable file, biometric authentication controlled by a single boolean, and credentials outside secure hardware. A Firefox add-on with more than 17,000 users was distributed to remove age-gate overlays; it did not beat the document or face check — it removed the panel covering content the server had already sent.

This is not a report about how to bypass checks. It is a report about what the law does not require. Ofcom’s guidance says that implementing one of its example methods “is not a guarantee” of compliance, and that providers must be able to demonstrate use in practice. But there is no statutory security baseline, no mandatory penetration testing, no certification and no public incident register. The weakest implementation sets the market baseline, because the child goes to the site that lets them in.

Status: the technology-neutral design is confirmed. The implementation weaknesses are documented in academic and security research. The Act does not require the specific controls that would prevent the most common failures. No enforcement decision has yet treated a client-side or one-time check as a breach of the “highly effective” standard, though the Aylo/Apple investigation may test the point.

17 · The privacy bill

A procedural duty on a substantive gap

Section 81(4)(b) requires a provider, when deciding on the kinds of age verification or estimation and how to use them, to make and keep a written record of the way it “has had regard to the importance of protecting United Kingdom users from a breach of any statutory provision or rule of law concerning privacy.” It is a duty to consider and record, not a duty to minimise, secure, retain for less time, avoid secondary use or use privacy-preserving credentials. The substantive standard is whatever UK GDPR, the Data Protection Act 2018 and the ICO say at the time.

Ofcom’s guidance confirms the light touch. Providers “should familiarise themselves with the data protection legislation” and consult ICO guidance; they “may find it helpful” to include privacy reasoning in their written record; and where Ofcom has concerns, it “may refer the matter to the ICO.” Open Rights Group’s assessment is blunt: “Ofcom cannot mandate privacy standards within their existing OSA powers.”

The public statement duty may not even cover the privacy reasoning. Section 81(5) requires a summary of the record “so far as the record concerns compliance with the duty set out in subsection (2)” — the age-verification duty — plus details about which kinds of age verification or estimation are used and how. On its face, the s 81(4)(b) privacy analysis can remain internal. No regulator or court interpretation of the point was found.

The data pool is concentrated. Ofcom found that “almost all analysed pornography services relied exclusively on third-party vendors, with only one analysed pornography service using an in-house solution.” Yoti reports over one billion age checks globally. k-ID became Discord’s sole vendor after the Persona exposure; Persona also serves Reddit, ChatGPT, Roblox and LinkedIn. There is no public register of approved providers, no mandatory certification, no concentration limit and no continuity rule. The supply chain extends beyond the age-check vendor: the Discord breach entered through a customer-service provider and its ticketing system.

The ICO’s enforcement tilts toward more age assurance, not less data. It fined Reddit £14.47m in February 2026 for failing to apply “any robust age assurance mechanism” and for failing to carry out a DPIA; it fined MediaLab (Imgur) £247,590 for similar failures. It says it is assessing how age-assurance providers comply with data protection law, but has published no findings. Spain’s AEPD fined Yoti €950,000 in March 2026 for excessive retention, invalid consent and unlawful biometric processing in its Spanish Digital ID app; Yoti has appealed. No UK vendor has been publicly fined or audited for over-collection or retention.

Exclusion is the other side of the privacy bill. An estimated 94 per cent of people aged 16 and over in the UK have a passport or driving licence; around 150,000 16- and 17-year-olds have neither. Around 90 per cent of 16–17s hold a bank account. But Ofcom accepts that “a photo ID will likely be needed at some point” in every highly effective route at 16, either for the method itself, to open a bank account, or to obtain a digital ID. In England, 21.2 per cent of those in the most deprived areas do not have a passport, compared with 7.1 per cent in the least deprived. Ofcom’s “fairness” criterion expressly does not cover this; it is relegated to an “accessibility” principle. The proposed mitigation is a PASS-certified photo ID card, with free cards for 16–17s; take-up, cost, waiting times and platform acceptance are not assessed.

Age tokens are market-led. OpenAge, launched by k-ID, issues an “AgeKey” — a privacy-preserving credential that lets users prove an age threshold without revealing their identity — and says it completed over 10 million verifications in beta. But the OSA does not mandate reusable or privacy-preserving credentials. Ofcom’s interoperability principle is not a duty. EFF and EDRi warn that centralised token issuers can track every use, creating a metadata trail; the EU app’s flaws have strengthened the case for caution. The UK’s digital ID work, which would create a reusable age attribute, is still developing; the national digital ID was cancelled in July 2026.

Status: the procedural nature of s 81(4)(b) is confirmed. The incidents are confirmed. Vendor concentration is real but poorly measured. The ICO has not published an age-assurance vendor audit or over-collection fine. ID exclusion is acknowledged by Ofcom but not covered by the fairness criterion.

18 · Beyond the browser

The Act regulates a slice

The OSA regulates services, not the app-store, operating-system or device layer. Ofcom’s October 2026 report says plainly: “App stores are not currently regulated services under the Act.” They “did not consistently use age assurance to correctly establish whether a user was a child, providing little incentive for children to self-declare an accurate age.” The report says app stores “could do more,” but responsibility “remains with regulated services.” The Government has not decided whether to bring app stores into scope.

Device-level age signals are emerging voluntarily. Apple’s iOS 26 includes an age-confirmation feature; Aylo’s partial Pornhub reopening relies on it. Ofcom’s investigation into Aylo is the first test of whether an inherited device signal is “highly effective” at binding age to the actual user. Ofcom says it will not investigate how Apple operates its checks; the probe concerns Aylo’s implementation and due diligence. The outcome will matter for every service that wants to rely on a platform-level signal.

AI companions are the fastest-moving gap. Ofcom opened an investigation into the AI character companion service Novi in January 2026. It says a chatbot is covered if it meets the OSA definitions, including “services that publish pornographic images, video or audio online, including via chatbots — they must use highly effective age assurance.” The Government has said that AI chatbot services whose primary purpose is to provide sexual relationships will not be available to under-18s, and that access to sexually explicit interaction features will require proof of age. The IWF says chatbots are “not adequately covered” by the Act, which only includes user-to-user, search and pornographic services. General-purpose chatbots are not age-gated; text-only sexual role-play is likely outside Part 5 because of the text exclusion.

Nudify tools are a criminal-law and app-store problem as much as an age-assurance problem. The Crime and Policing Act 2026 bans making or supplying “intimate image generators,” including nudification apps, websites, bots and AI models. But the ISD found that of 181 nudify sites identified, 163 appeared accessible from the UK on 1 April 2026; only two included measures to verify that users were over 18; 61 required a click “yes”; and 100 had no disclaimer or age verification at all. The EU has moved to ban nudifying AI systems; Australia’s eSafety has taken action against a major service. The UK’s OSA route still depends on the tool being made available “on” a service and the content being “published or displayed.”

Payment processors and adult ad/affiliate networks are outside the statutory regime, but they exercise significant gatekeeping power. Baroness Bertin’s review called payment providers “the unofficial regulators of online pornography,” using their power to withdraw services; their prohibited-content lists are not public and “not consistent nor universal.” Visa and Mastercard require enhanced due diligence for adult merchants. Patreon requires creators sharing sexually explicit material to verify they are over 18 — a creator-side check, not a viewer-side age gate. TrafficJunky, the ad network of Pornhub’s parent, says it “does not operate, host, control, or monitor” advertisers’ landing pages and assumes no responsibility for their compliance. ExoClick says its “verified” traffic setting “does not by itself guarantee legal compliance.” Steam and itch.io deindexed adult games after payment-processor pressure.

Encrypted and private channels remain a structural gap. Ofcom opened a CSAM investigation into Telegram in April 2026; Telegram had introduced age controls. But age assurance at the door does not reach content shared inside private channels, Discord servers or direct messages. Ofcom’s passive measurement found Telegram was visited by 10 per cent of 8–14s, despite a minimum age requirement of 18. Dating apps are a partial success story: Tinder, Grindr, Bumble and Hinge now use age checks, but Ofcom found that in December 2025 more than one in ten 15–17-year-olds were still spending time on three of the most-used dating apps.

Status: app stores and devices are confirmed outside the Act; policy is under review. AI companion enforcement is live but the statutory coverage is unresolved. Nudify sites are accessible at scale despite a criminal-law ban. Payment and ad networks are confirmed outside the regime. Private channels are a structural gap.

19 · The reform backdrop

A crowded agenda, not a Part 5 fix

The Independent Review of Pornography, led by Baroness Bertin, published Creating a Safer World on 27 February 2025. It made 32 recommendations across violence against women and girls, platform accountability, exploitation, enforcement, tech-enabled harms and governance. The Government published a short joint letter response the same day, promising a fuller response; as of late 2025 it had not provided a timetable. The review’s recommendation 12 called for “increased, effective, and quick business disruption measures across the ecosystem of pornography — including ancillary services.” That recommendation has not been implemented.

The Crime and Policing Act 2026 is now the main porn-reform vehicle. It creates new offences, bans intimate image generators, and contains age/consent verification powers in sections 108–110. No regulations or review under those powers had been published as of 2 November 2026.

The under-16 social media ban is the flagship reform. Regulations are expected by the end of 2026, with commencement in spring 2027. Ofcom’s October 2026 rapid assessment sets out four methods capable of being highly effective at 16 — photo ID, digital ID, banking checks and facial age estimation — and says app stores “could play an important role” but responsibility remains with regulated services. App-store inclusion is under consideration. The national digital ID was cancelled in July 2026.

The OSA’s own statutory review under section 178 may not begin until 2029 and could be as late as 2032. The Lords Communications and Digital Committee is inquiring into implementation and impact; its report was still outstanding as of 2 November 2026. There has been no 2026 NAO or PAC follow-up, and no dedicated POSTnote on porn age verification.

The point is not that reform is absent. It is that the Part 5 gaps are not the main vehicle. The live agenda is about under-16 social media, app stores, AI chatbots, intimate image abuse and the criminal law. The search exclusion, the provider/UGC line and the absence of a metric for “highly effective” are not the subject of a pending bill. They may persist through the next phase.

Status: the Bertin recommendations are largely unimplemented; the Crime and Policing Act 2026 is the main vehicle; the under-16 ban is the flagship; the s 178 review is years away. This is descriptive, not a recommendation.

20 · The register

Where the statute leaks

Severity is an editorial judgement, not a statutory classification. The evidence column is the part that matters. The register is grouped by domain; the same vulnerability can appear in more than one place.

Scope and definition

Enforcement

People and identity

Privacy, data and the ecosystem

21 · The pattern

Reach without grip

The vulnerabilities are not a random list. They form a pattern. Five patterns recur across the statute, the regulator’s practice and the market’s response.

1. Reach versus grip

The Act’s normative reach is broad. It applies to services with UK links wherever they are based, and it speaks in outcomes: children not normally able to encounter. Its coercive grip is narrower. It depends on providers self-assessing scope, on UK assets for collection, on voluntary search co-operation, and on a geo-block being treated as a win. The gap between the two is the regime’s defining feature.

2. Obligation versus collection

The obligation layer is intact. Ofcom can find a breach, issue a confirmation decision and set a penalty. The collection layer is not. Nine of 11 providers have not paid. The 4chan case shows the purest version: a $520,000 administrative finding, a sovereign-immunity dismissal in Washington, no UK assets and no payment. A penalty that cannot be collected is a statement, not a deterrent.

3. Service versus system

The Act regulates individual services. Children move between services. Ofcom’s own data shows short visits, site-hopping and migration to unchecked sites. The search engine is the discovery layer; the app store is the distribution layer; the device is the identity layer; the payment processor is the money layer. Each sits outside or at the edge of the duty. A service-level regime cannot close a system-level route.

4. Method versus outcome

The statute asks for an outcome: children not normally able to encounter. The guidance measures methods: four criteria, a list of approved techniques, a challenge age. The market optimises for the weakest link. Ofcom says a listed method is not a guarantee, but it has not set a quantitative threshold, and every enforcement case so far concerns an absent check or non-cooperation, not a check that failed. The Aylo/Apple case may change that; it has not yet.

5. Boundary versus protection

Each carve-out was drawn for an administrative reason: search results are a different service; user-generated content is a different regime; text is not images; paid ads are advertising; ODPS is TV-like; internal business services are not public. Together, the boundaries determine whether a child is protected. The most consequential are the search exclusion, the provider/UGC line and the absence of any metric for “highly effective.” Those three are confirmed in the statute or by Ofcom; the extent to which providers have deliberately exploited them is, in most cases, still alleged rather than proven.

The honest conclusion is not that the Act has failed. It is that the Act has changed the top of the market, has not changed the tail or the discovery layer, and has created a collection and privacy bill it does not control.

22 · What the evidence shows

Strong, contested, speculative, absent

The evidence base is uneven. It is worth separating four kinds of claim, because they carry different weight.

Strong

The statutory text is clear. Ofcom’s own reports and decisions are primary sources. The 4chan confirmation decision and the D.D.C. opinion were read in full. The fine schedule, the collection figures and the geo-block counts are documented. The privacy incidents are reported by named outlets and, in some cases, confirmed by the companies. The search figures, the top-100 counts and the 69 million checks are Ofcom’s own data.

Contested

VPN prevalence is contested: Ofcom’s child-specific estimate is 5 per cent; the Government-commissioned study finds 10 per cent using location-changing tools; Internet Matters finds no child-specific spike. The “39 per cent bypassed” figure covers all age checks, including tick boxes and date-of-birth prompts; the “5 per cent circumvented HEAA” figure covers highly effective checks. Both are defensible; they measure different things. Whether geo-blocking is “compliance” is a policy choice, not a fact. Whether Pornhub deliberately delayed checks is reported but not directly proven. Whether Ofcom’s enforcement is adequate is a judgement.

Speculative or analytical

The small-audience escape under s 80(4) is structurally real but no provider has publicly relied on it. The ODPS arbitrage is plausible but undocumented. The affiliate-network gap is analytically plausible but no source applies the paid-ad definition to affiliate arrangements. The internal-business and education exemptions are real but no commercial porn service has been found claiming them. The “compliance theatre” critique is supported by academic testing, but it has not been accepted by a court or applied in an enforcement decision.

Absent

There is no published outcome measure linking age checks to reduced child access. Ofcom’s passive measurement is a proxy; the 69 million checks are an activity metric. There is no official estimate of the proportion of UK porn traffic that arrives via VPN. There is no UK deployment data on facial-estimation error by skin tone, sex, age or device quality. There is no public register of age-assurance vendors, no published audit of their security and no UK enforcement outcome against a vendor for over-collection. There is no data on verified-account resale. There is no measurement of repeated circumvention. These absences are part of the finding.

A. Timeline

B. Glossary

Part 5 service

An internet service that publishes or displays regulated provider pornographic content, is not exempt and has links with the UK.

Regulated provider pornographic content

Provider-published pornographic content, excluding text-only content and paid-for advertisements. User-generated porn is not provider content.

HEAA

Highly effective age assurance: Ofcom’s shorthand for age verification or estimation that meets the s 81(3) standard and the four guidance criteria.

Age verification / age estimation

Verification establishes exact age; estimation estimates age or an age range. Self-declaration alone is neither (s 230).

UGC

User-generated content: content generated, uploaded or shared by users. It is regulated under Part 3, not Part 5.

ODPS

On-demand programme service: TV-like video on demand, regulated under Part 4A of the Communications Act 2003 rather than Part 5.

FSIA

Foreign Sovereign Immunities Act, the US statute under which Ofcom was held to be a “foreign state” in the 4chan litigation.

QWR

Qualifying worldwide revenue, the base for the maximum penalty (the greater of £18m or 10%).

Challenge age

A threshold above the statutory minimum at which a user estimated to be below it must complete a second age check.

Geo-block

Blocking access from UK IP addresses. Ofcom treats it as a mitigation, not as age assurance.

C. Method and confidence

This report is based on primary legislation, Ofcom guidance and enforcement decisions, the D.D.C. opinion, parliamentary and government material, regulator-commissioned research, academic and legal commentary, NGO reports and news reporting. The research was current to 2 November 2026. The 4chan confirmation decision and the D.D.C. memorandum opinion were read in full.

Claims are labelled in the text where the distinction matters. “Confirmed” means clear in the statute, a regulator statement or a court document. “Reported” means asserted by a named actor but not established by a regulator or court. “Contested” means there are credible arguments or evidence on both sides. “Speculative” or “analytical” means structurally plausible but without direct documentary evidence of use.

D. Sources

Selected primary and secondary sources. Links are provided for verification; the report is not affiliated with any of the organisations listed.

Legislation and courts

• Online Safety Act 2023, Part 5 (ss 79–82)
• Online Safety Act 2023, s 4 (links with the UK)
• Online Safety Act 2023, s 12 (children’s safety duties)
• Online Safety Act 2023, s 61 (primary priority content)
• Online Safety Act 2023, s 79 (provider pornographic content)
• Online Safety Act 2023, s 80 (scope)
• Online Safety Act 2023, s 81 (duties)
• Online Safety Act 2023, s 230 (age verification and estimation)
• Online Safety Act 2023, s 236 (interpretation)
• Online Safety Act 2023, Schedule 13 (penalties)
• 4chan Community Support LLC and Lolcow LLC v UK Office of Communications, No. 1:25-cv-02880 (D.D.C.)

Ofcom

• Guidance on highly effective age assurance and other Part 5 duties (January 2025)
• Use of Age Assurance Report 2026 (July 2026)
• Age checks progress update (July 2026)
• 4chan confirmation decision (March 2026)
• Aylo/Pornhub investigation (September 2026)
• Rapid assessment of HEAA at 16 (October 2026)
• Report on the use of app stores by children (October 2026)
• BBFC/Ofcom, Functionality of Online Pornography Services (2023)

Parliament, government and regulators

• Ofcom letter to Baroness Keeley (6 October 2026)
• DCMS Committee oral evidence (20 October 2026)
• Ofcom written evidence to the Lords (September 2026)
• DSIT/BMG, Children’s circumvention behaviours online (July 2026)
• House of Commons Library, The Online Safety Act: An overview (October 2026)
• Baroness Bertin, Creating a Safer World (February 2025)
• POST, Facial age estimation (July 2026)
• ICO, Age assurance for the Children’s code

Research, NGOs and news

• Internet Matters, The Online Safety Act: Are children safer online? (May 2026)
• ISD, Mapping the ‘Nudify’ Tools Ecosystem (July 2026)
• McGlynn, Woods and Antoniou, Pornography, the Online Safety Act 2023 and the need for further reform (2024)
• Lavermicocca, Carminati and Longari, X-rated Compliance Theater (2026)
• LBC, Ofcom boss admits tech giants have dodged nine out of 11 online safety fines (October 2026)
• The Christian Institute, Pornhub ‘exploits’ loophole to delay protecting kids (November 2024)
• The Guardian, Discord age-verification breach (October 2025)
• Open Rights Group, Regulating Age Verification (July 2025)