Security3 publishers3 min readPublished
Ofcom asks Aylo what testing it did before it trusted Apple's under-18 signal
Pornhub's parent company started reading Apple's device-level under-18 signal in May. Ofcom's investigation is about the testing Aylo did before it switched that over. The liability stays with Aylo.
The Watch · Security desk
What happened
- Ofcom announced on Wednesday that it is investigating Aylo, the parent company and service provider behind Pornhub, over whether the firm complies with the Online Safety Act's age assurance rules.
- The regulator said Aylo may not have conducted sufficient due diligence and testing before implementing the process, and so it may not be highly effective at preventing children from seeing pornography.
- Ofcom said it will not investigate how Apple operates its age checks, and will instead examine how Aylo implemented the process and what due diligence it did beforehand.
- Ofcom will gather evidence and let Aylo respond before formally deciding whether to issue a fine or an order to remedy deficiencies.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- precedent Ofcom's written position is that the duty to be highly effective sits with the service provider at every stage of a check. Any site building an age gate on a platform signal inherits the testing burden for a signal it does not generate.
- exposure Apple produces the signal and faces no Ofcom action in this case; Aylo holds the enforcement risk for how that signal behaves on its own site.
- cost The penalty is capped at 18 million pounds or 10 percent of qualifying worldwide revenue, whichever is greater. For a company above 180 million pounds of revenue, the ceiling rises with the size of the global business.
- contradiction Aylo points to Ofcom's earlier praise for Apple's device-level checks. Ofcom's case turns on Aylo's own testing. Both accounts can hold, and Aylo can still be fined.
Ofcom's press release describes the process Pornhub switched on in May as relying on signals from Apple that suggest under-18s in the UK "may have completed Apple's age checks" [3]. The statutory duty is firmer than that. The age assurance has to be highly effective at establishing that a user is at least 18 [2]. Ofcom says the job of closing that distance belongs to the site. "The Online Safety Act is clear that it is the service provider's responsibility to ensure that any age assurance process is highly effective - no matter at what stage an age check occurs," the regulator said [5].
The Act also sets a step before a change goes live. Providers have to assess whether children are likely to use their service. That assessment is due before major changes to the "design or operation of their service, or in response to evidence about reduced effectiveness of age checks" [6]. Ofcom's concern is that children may still be viewing Pornhub content as a result of the switch [20]. "We expect tech firms to ensure age checks are highly effective before introducing them," said George Lusty, Ofcom's director of enforcement. "Anything less could leave children at risk" [8].
Aylo is defending Apple's checks. Alex Kekesi, the company's vice president for brand and community, said in a statement: "We trust that the investigation will show Apple's UK device-level age-verification update, which renders devices operating since iOS26.4 kid safe by default, offers one of the strongest and hardest to circumvent protections currently available for helping prevent minors from accessing age-inappropriate content" [13]. Kekesi also said: "We are committed to working constructively with Ofcom and Apple in our shared commitment to child protection" [14]. An Aylo spokesperson told The Record that Ofcom has previously praised the Apple methods the company uses. The Record reported that Ofcom earlier this year called Apple's deployment of age checks on UK devices "a real win for children and families" [15].
Age checks have been required of every site and app allowing pornography in the UK since July 2025 [16]. Pornhub blocked all unregistered UK users in February, said visitors had gone to non-compliant sites, and argued that only device-based checks run by the likes of Apple and Google would level the playing field, Politico reported [17]. Aylo has said the verification requirements had "not achieved its goal of protecting minors" and had "diverted traffic to darker, unregulated corners of the internet" [18]. In May it said it would make the site available again for some UK Apple users who had confirmed their age with the most up-to-date version of iOS [19]. The BBC described the investigation as the latest clash between the regulator and the site [23].
What to watch
- Whether Ofcom's evidence gathering turns into a provisional finding, and whether it spells out what sufficient testing of a third-party age signal would have looked like.
- Whether other UK sites relying on Apple or Google device-level signals receive the same enforcement notice.
- Whether Aylo's response persuades Ofcom to accept the Apple signal with additional checks layered on top.