The communications regulator Ofcom announced on 23 September 2026 that it is formally investigating whether the age-verification method adopted by Aylo the operator of Pornhub is capable of preventing minors from reaching adult content. The probe focuses on the system that relies on Apple’s device-level checks for iPhone and iPad users, rather than on the way Apple itself conducts those checks.
Regulatory timeline and traffic impact
When the Online Safety Act (OSA) entered force in, it introduced a duty for pornographic platforms to use “highly effective” age assurance mechanisms. In response, Aylo shut the door to most new UK visitors on 2 February 2026, arguing that the legislation was pushing traffic toward less-regulated sites. The restriction applied only to fresh visitors; existing accounts that had already proved their age retained access.
The immediate effect was stark. Within weeks, the number of UK visits to Pornhub fell by 47 percent. By, the decline deepened to roughly 77 percent according to internal traffic analyses. In, Aylo partially reversed the ban, allowing a subset of UK users to log in again if they had verified their age through Apple’s built-in process. Users on Android devices, PCs or other platforms remain blocked.
How the Apple-based verification is supposed to work
Apple’s iOS platforms provide a signal that indicates whether a user has completed the company’s own age-check routine on the device. Aylo’s implementation reads that signal and, if it shows a positive result, grants the user access to Pornhub without demanding an additional check. The approach was marketed as a privacy-preserving alternative that avoids storing personal data on the site itself.
Critics, however, point out that the effectiveness of any device-level solution depends on the consistency of the underlying signal and on whether it can be bypassed through tricks such as VPNs or shared devices. The regulator’s investigation deliberately excludes Apple’s internal processes; it will concentrate on whether Aylo performed adequate due diligence and testing before rolling out the new method.
Ofcom’s concerns and possible sanctions
In a statement, Ofcom said it is worried that Aylo may not have carried out sufficient testing to demonstrate that the Apple-based filter is “highly effective” at keeping minors away from pornography. The regulator highlighted two key questions: did Aylo use a robust age-assurance system, and did it conduct a proper assessment of children’s potential access before changing its approach?
George Lusty, Ofcom’s Director of Enforcement, stressed the importance of the issue, stating: “Online age checks are a vital protection to prevent children from encountering inappropriate or harmful material, including pornography. We expect tech firms to ensure age checks are highly effective before introducing them. Anything less could leave children at risk.”
If the investigation concludes that Aylo has breached the OSA, Ofcom can order remedial action and impose a penalty of up to £18 million or 10 percent of the company’s worldwide revenue—whichever is greater. In severe cases, the regulator may also seek court orders that compel internet service providers to block access to non-compliant services.
Aylo’s response and the broader debate
Aylo has defended its use of Apple’s technology, arguing that it represents “one of the strongest and hardest to circumvent protections currently available for helping prevent minors from accessing age-inappropriate content.” The company maintains that it will fully cooperate with Ofcom’s fact-finding team and sees the investigation as an opportunity to set a “meaningful precedent” for privacy-preserving online safety in the UK.
The controversy sits at the intersection of digital privacy, child protection and cross-border regulation. While the OSA leaves the choice of verification method to the service provider, it obliges them to demonstrate that the chosen solution meets the statutory standard of effectiveness. As the case unfolds, it will likely influence how other adult-content platforms design age-gate mechanisms and how regulators assess the adequacy of third-party solutions.
