Age Verification for Adult Sites Without Losing Your Audience

A year into the UK's age assurance duties, the question for adult sites has moved on from whether to check ages to how much audience each design decision costs. Ofcom's July 2026 statutory report calls the rollout unprecedented and the job unfinished, and it names the specific things the regulator wants fixed next.

Who this is for: compliance and operations teams at adult sites serving UK users, and the product teams responsible for the age gate and sign-up flow.

TL;DR

• Ofcom has ruled that age inference, the practice of guessing age from behavior after signup, cannot satisfy the duty for services that must prevent child access. If you rely on it, you are out of compliance now.
• Fines have reached £1.35 million for a single non-compliant operator, and Ofcom has 23 investigations open, covering 88 adult services between them.
• Ofcom's own evidence shows some sites without age checks gained traffic after competitors introduced them. That gap is what enforcement is designed to close.
• The rules do not require you to collect ID documents. Facial age estimation, open banking, and digital ID services all appear in Ofcom's guidance, and they carry very different drop-off profiles.
• Ofcom now expects regular due diligence on your age assurance vendor. Outsourcing the check does not outsource the liability.

What does the Online Safety Act actually require?

Since 25 July 2025, services that publish pornographic content and user-to-user services that allow it have had to use highly effective age assurance to keep under-18s from encountering that content. The standard applies whether you build the check yourself or buy it.

"Highly effective" is Ofcom's term, and it has a definition. A method has to be technically accurate, robust, reliable, and fair. Fair does the most work of the four: a check that performs well on some demographics and poorly on others fails the test even if the average accuracy looks strong.

Three things Ofcom has ruled out for services in this category: self-declaration, general content warnings, and an online payment check that anyone under 18 could perform. In its July 2026 report the regulator added a fourth. Age inference, where a service estimates age from account behavior, cannot be highly effective here, because the inference only becomes possible after a child has signed up and used the service. Ofcom told services relying on it to switch methods without delay.

Which methods can you actually use?

Ofcom's guidance names several methods capable of meeting the standard. Each one moves cost, friction, and privacy exposure to a different place.

Nothing stops you offering several. Ofcom's concern is whether the method you rely on clears the bar.

What has enforcement looked like so far?

Concrete. Ofcom opened its enforcement program for age assurance on adult content in January 2025. It now has 23 investigations open, covering 88 adult services between them, and has fined 7 providers of 24 sites so far.

The penalties have escalated. In December 2025, Ofcom fined AVS Group, operator of 18 pornography sites, £1 million plus £50,000 for failing to respond to an information request, and gave it 72 hours to put highly effective age assurance in place or face £1,000 for every further day. In February 2026, Ofcom fined Kick Online Entertainment £800,000 plus £30,000 on the same information-request basis, and fined 8579 LLC £1.35 million plus £50,000, the largest penalty in this strand so far.

Two things to take from that pattern. Ignoring Ofcom's information requests is a separate breach with its own price tag, and the remediation deadlines are measured in days.

Ofcom has also said it will focus on porn sites growing their user numbers because they have no age checks in place, and that it will use every power available if enforcement action does not produce compliance.

How much traffic does an age check actually cost?

This is the question behind every design decision, so it is worth looking at what the data shows. The short version: an age check costs more traffic than most vendors admit, and less than the loudest headline numbers suggest.

Aylo reported traffic to Pornhub in the UK falling 77% after the duties took effect, and in February 2026 the company stopped accepting new UK users altogether. Ofcom reports that VPN demand spiked at rollout and then plateaued, which suggests some UK users routed around the check rather than completing it. VPNs are not age-gated, so some of that circumvention will have been the very children the check is meant to stop.

Not all of that 77% is lost adult audience. Some of it is children being turned away, which is the intended effect. In Ofcom's study, 8% of children tried to reach pornography services. Of those, half only reached sites that had an age check in place, and their visits were usually very short, which Ofcom reads as the check deterring them. It is a study estimate rather than a complete count, and the other half still reached sites with no checks at all.

The rest of the decline is harder to attribute. Ofcom's data does not split the wider traffic loss between minors being blocked and adults abandoning a check they found too much trouble. The adult share is the part you can influence, and it is a design problem rather than a legal one.

There is also a competitive wrinkle. By the end of January 2026, 77 of the top 100 dedicated pornography services had age assurance and 7 more had geoblocked UK users. Ofcom's evidence also shows that some services without checks picked up traffic after their competitors added them. That asymmetry should narrow: it is what the current enforcement wave and Ofcom's work with Google and Bing on search visibility are aimed at.

Where you have real control is the shape of the check. A single image with a sub-second answer converts differently from a document upload flow. Re-verification policy matters as much as the first check: if a returning user has to prove their age every session, you pay the friction every time. And a fallback path for users the estimator cannot place confidently keeps you from turning a borderline result into a lost adult user.

How do you keep the check without keeping the data?

This is where adult sites carry as much reputational risk as any sector, and where the two UK regulators have converged.

Ofcom and the ICO published a joint statement on 25 March 2026 setting out how the online safety duties and data protection law fit together. It introduced no new obligations. It made the expectation explicit: collect the minimum data needed to establish age, be transparent about what happens to it, and do not treat an age check as a reason to build an identity database.

For an adult site, the practical version is short. You need to know that a user is over 18. You do not need to know who they are. Methods that return an over-18 signal without a date of birth or an identity record leave you with less to breach, less to disclose, and less to explain to a user who is deciding whether to trust the flow.

Ofcom's July 2026 report is explicit about vendors: conduct regular due diligence on any age assurance provider you use, because responsibility for the process being highly effective stays with the regulated service. Ask your vendor what is stored, for how long, and where. Ask them to show you performance across demographic groups rather than a single headline accuracy figure. Keep the evidence, because the audit trail is what Ofcom will ask for first.

Where Youverse stands

We think you serve both assurance and audience by asking for as little as possible at the door, and by matching the effort to the risk.

Most checks never need a credential. YouAge handles that everyday route, estimating age from a single selfie in under one second, storing no biometric data, and returning the same minimal answer the check needs: over the age line or not. Where a check does escalate to a credential, YouLive guards it so only a real person can get one, with presentation attack and video injection protection independently tested to ISO/IEC 30107-3 and built to keep deepfakes out. YouAuth then keeps that credential bound to the person who created it, so reusing it means passing that person's face check rather than borrowing a device or a login, and no central biometric database is ever built.

What stays yours: the age threshold, the buffer around it, the fallback for uncertain results, and your re-verification policy. Those decisions shape your drop-off, and no vendor should be making them for you.

Explore YouAge →

Book a demo. Bring your traffic profile and we will walk through the threshold, fallback, and re-verification decisions against it.

FAQ

Does the Online Safety Act require adult sites to collect ID documents?

No. Photo ID matching is one route among several. Facial age estimation, open banking, digital identity services, mobile network operator checks, and credit card checks all appear in Ofcom's guidance as methods capable of being highly effective.

Is facial age estimation accepted by Ofcom?

Yes, as a method that can be highly effective. Acceptance is not automatic: your implementation has to be technically accurate, robust, reliable, and fair, and you need evidence to show it.

Can we still rely on self-declaration or age inference?

No. Self-declaration has never met the standard. In its July 2026 report Ofcom ruled that age inference cannot be highly effective for services required to prevent child access, and told services using it to switch methods without delay.

Do we have to age check returning users on every visit?

Not necessarily. Ofcom's concern is that children are prevented from encountering the content, so a durable, non-transferable session or account state can carry a verified result forward. Document the reasoning and the controls that stop a verified session being shared.

What happens if we do not comply?

Ofcom has 23 investigations open, covering 88 adult services between them, and has issued fines up to £1.35 million, with separate penalties for failing to respond to information requests. It has said it will use all the powers at its disposal against services that stay non-compliant after enforcement action.

Regulatory position accurate as of July 2026.