On September 23, 2026, UK media regulator Ofcom opened a formal investigation into whether Aylo — parent company of Pornhub, YouPorn and Redtube — is complying with the Online Safety Act by relying on Apple's device-level age verification to keep children off its free tube sites. The investigation, reported by XBIZ's Rick Louis the same day, is titled "Investigation into Aylo's compliance with the duty to prevent children from encountering pornographic content through the use of age assurance," and it targets the exact mechanism Ofcom publicly praised five months ago.

Why It Matters

This is the most consequential age-assurance question in the industry right now, and it has nothing to do with fines. Device- and OS-level age signals are the model that platforms, privacy advocates and an increasing number of regulators have converged on as the least-bad answer — one identity check at the operating system, propagated as a signal to every site, instead of every adult site collecting IDs and becoming a honeypot. Ofcom's own July age-assurance report recommended layered app-store, OS and device checks. Apple, Google and a string of US state bills have moved in the same direction. If Ofcom concludes that Aylo cannot discharge its duty by relying on Apple's signal, the practical effect is that device-level age assurance becomes a supplement rather than a substitute — and every adult platform in the UK is back to running its own highly effective checks on top of it. That is a materially worse outcome for user privacy and a materially more expensive one for operators, particularly smaller sites that cannot absorb per-check verification costs. It would also blunt the emerging global template just as Canada's Bill S-209, the EU Kids Act draft and Australia's regime are all circling the same architecture. The narrower lesson for compliance teams is about process, not technology. Ofcom's stated concern is due diligence and testing — whether Aylo assessed the new configuration before deploying it, not whether the configuration is theoretically sound. Under the OSA, changing your age-assurance method is a significant change to the operation of the service, which triggers a fresh children's access assessment. Any platform that swapped verification vendors or leaned on a new third-party signal this year without re-running that paperwork is exposed to the same argument, regardless of how good the underlying tech is.

The backstory is a study in regulatory whiplash. In February 2026, Aylo began blocking UK users without existing accounts, calling the OSA a "flawed system." When Apple shipped iOS 26.4 in March with account-level age verification for UK users, Aylo restored access for iPhone and iPad users who had confirmed their age through Apple — a partial unblock that made it the first major adult platform to reopen a market it had walked out of. Aylo called Apple's implementation "one of the strongest and hardest to circumvent protections currently available." Ofcom, at the time, called Apple's approach "a real win for children and families."

Now the regulator is asking whether Aylo did its homework before leaning on it. In its investigation notice, Ofcom said it is "concerned that Aylo may not have conducted sufficient due diligence and testing before implementing its new age assurance process" and that, as a result, the process "may not be highly effective at preventing children from seeing pornography." The regulator restated the load-bearing principle: under the OSA, it is the service provider's responsibility to ensure any age assurance process is highly effective, "no matter at what stage an age check occurs." Providers must also carry out a suitable and sufficient children's access assessment before making any significant change to the design or operation of a service.

Ofcom drew one careful boundary. "Our investigation will not make a determination on how Apple operates its age checks," the statement said — the probe is about Aylo's implementation and due diligence, not Apple's underlying system. That distinction matters enormously: it means the regulator is not blessing or condemning device-level age assurance as a category, only asking whether a porn platform can outsource its statutory duty to an operating system and call the job done.

Aylo is not backing down. Alex Kekesi, the company's VP of Brand and Community, said Aylo will cooperate fully but defended the approach: "We are committed to working constructively with Ofcom and Apple in our shared commitment to child protection. We trust that the investigation will show Apple's U.K. device-level age-verification update, which renders devices operating since iOS 26.4 kid-safe by default, offers one of the strongest and hardest-to-circumvent protections currently available." Kekesi repeated the company's long-running structural argument: "The internet is global and it's impossible to patrol millions of different sites based in hundreds of different countries. Site-based regulation is always going to encourage evasion."

Sources

Update — 2026-09-24

{Initial entry — story first created.}

Update — 2026-09-30

Aylo takes its case public. On September 29, 2026, Biometric Update published evidence Aylo shared in response to Ofcom's investigation. Aylo argues that the UK's platform-level age-check regime has "categorically failed" and pushed users to non-compliant sites, and that Apple's OS-level age assurance, which it now uses for UK access, is the fairer fix. Aylo VP Brand and Community Alex Kekesi says Aylo has complied with the Online Safety Act since July 25, 2025, while most operators have not, and that enforcement "at scale has failed and has proven impossible." Aylo's main evidence is a series of "free porn" searches. In October 2025, five of Google's top ten results and four of Bing's were non-compliant sites. By March 25, 2026 each engine showed six, and on September 22 each showed five. Aylo also cites Ofcom having issued only 11 Confirmation Decisions as of September 18.

Biometric Update was not persuaded. It noted that Ofcom's six-month report says the top 10 sites by traffic all had age checks in place, as did a majority of the top 100, and that Ofcom had opened 23 investigations covering 88 providers by July. The Age Verification Providers Association objected that moving age assurance to the operating system "concentrates market power and creates a single point of failure," and gives a child with a parent's unlocked device easy access. The AVPA backs a layered approach.

Read: The dispute is now about who carries age-check liability: the site that profits, or the OS that ships the phone. If Ofcom accepts device-level assurance as compliant, the cost and data-risk burden moves off adult platforms and onto Apple and Google. That is an outcome age-verification vendors are lobbying hard against.

New Sources