Ofcom is investigating Aylo’s use of Apple’s age-assurance system on an adult platform in the UK. The case raises questions about the responsibilities services retain when age checks are carried out by third parties.
UK online safety regulator Ofcom is investigating the age-assurance system used by adult platform Pornhub, according to its operator Aylo. According to Aylo, it received a letter from Ofcom dated 21 September 2026 concerning its compliance with the Online Safety Act. Aylo had introduced Apple’s device-level age-verification process for eligible adult users in the UK four months earlier.
Under the Online Safety Act, services that provide pornographic content must use highly effective age assurance to prevent children from accessing it. Ofcom’s guidance is clear that this responsibility stays with the regulated service even where the age check is carried out by an external provider. Its 2026 review also says services should carry out regular due diligence on age-assurance vendors and be able to show that the process they use is highly effective.
Aylo has defended its approach. The company says Apple’s device-level verification offers a strong and difficult-to-circumvent way of keeping minors away from age-restricted content, and that it will cooperate with both Ofcom and Apple during the investigation.
Why does it matter?
The investigation highlights an important issue in age-assurance regulation: using a third party does not transfer the regulatory responsibility away from the regulated service. As platforms increasingly rely on operating systems, app stores and specialist providers to determine users’ ages, they are still expected to assess whether those systems meet the regulator’s standard and to monitor their performance. The case could therefore clarify how far regulated services must go in testing and overseeing third-party age-assurance systems.
