Adult website age verification: legal advice on the Online Safety Act

By Yair Cohen, Solicitor specialising in internet law. Updated 1 October 2026.

This guide is part of our pornography and adult content law section.

If you run an adult website, sell your own content from your own site, or let users upload adult material, this article is for you. Where people in the UK can reach the site, the law requires you to check that every user is over 18 before they can see anything pornographic. The check has to be one that works, and Ofcom, the regulator, has been fining sites that have not done it, many of them based outside the UK. This article explains who is caught, which checks Ofcom accepts, the records you need to keep, and what to do if Ofcom writes to you. For most businesses, getting compliant is quicker and cheaper than they fear once someone who knows the rules has looked at the site.

Does the Online Safety Act apply to my adult website?

It applies if your site shows pornographic content and has links with the UK, wherever your company is based. A site has links with the UK if it has a significant number of UK users, or if the UK is one of the markets it aims at. That test is in section 80 of the Online Safety Act 2023, and it is why many of the companies Ofcom has fined so far are based outside the UK.

The Act reaches adult sites by two routes, depending on who puts the content up. If you publish the content yourself, as a studio, a producer or a creator with your own site, the duty is in Part 5 of the Act and has applied since 17 January 2025. If your users upload the content, as on a tube site, a fan platform or a forum, the duty sits in section 12, the duty to protect children, and has applied since 25 July 2025. Many sites do both, and then both duties apply.

The duty covers pictures, video and sound. Text on its own is outside it. Content made by an AI tool on your site in response to a user's prompt counts as content you publish. That is why Ofcom fined the provider of a "nudify" site £50,000 in November 2025 for having no age check at all.

What counts as a highly effective age check?

A highly effective age check is one that reliably tells adults from children, and the law requires it before any pornographic content can be seen. The words come from section 81 of the Act, which says the check must be "highly effective at correctly determining whether or not a particular user is a child".

Ofcom's guidance on age checks lists the methods that can meet that standard: photo ID matching, facial age estimation, open banking, a check with the user's mobile network, a credit card check, a digital identity service and email-based age estimation. A box that says "I am over 18" does not count. Nor does an ordinary card payment, because people under 18 can pay for things online. Whatever method you choose, Ofcom expects it to be accurate, robust, reliable and fair, and that is the test it will apply if it looks at your site.

Where the check sits matters as much as which check you use. Ofcom's position is that no pornographic content should be visible before or during the check. In practice that means free previews, thumbnails, sample clips and explicit banners on the landing page all sit behind it. A site with a good age check placed after a page of explicit thumbnails has not complied.

Most sites use a specialist age check provider rather than building their own, and that is usually the sensible route. The legal duty stays with you, though. If the provider's method turns out not to be highly effective, or it is set up so that users can get round it, Ofcom will look to you, not the provider. That is why the contract with the provider, and the testing you do before you switch it on, matter.

The records and the public statement you need

If you publish your own content, the Act requires you to keep a written record of the age check you use and how you use it, and to publish a plain summary of it for your users. Both duties are in section 81. The record also has to show how you took account of your users' privacy when you chose the method, because age checks collect sensitive personal data and the UK GDPR still applies to it.

If your users upload content, you also need a children's access assessment. Section 36 of the Act requires you to repeat it at least once a year, and again before you make a significant change to how the service works, including a change to your age check.

That second point is easy to miss, and Ofcom has shown it takes it seriously. On 23 September 2026 it announced an investigation into the provider of Pornhub. The question is not whether the site had an age check. It is whether the provider tested a new method, introduced in May 2026, enough to show it was highly effective, and carried out a proper children's access assessment before switching it on. If the largest site in the market can be investigated over a change of method, a smaller site that swaps providers without a record of why is exposed in the same way.

What Ofcom has done so far

Ofcom has been fining adult sites since late 2025, and the fines have climbed into seven figures. It opened its age assurance enforcement programme in January 2025, wrote to hundreds of sites, and opened formal investigations into the ones that did nothing.

The first fine was £1 million against AVS Group in December 2025. In February 2026 Ofcom fined 8579 LLC £1.35 million and Kick Online Entertainment £800,000. Since then it has fined Youngtek Solutions £500,000 in May, the provider of Fapello £600,000 in July, and the provider of Xgroovy £700,000 in September. In most of these cases Ofcom added a second penalty, of between £30,000 and £100,000, for not answering its questions properly, and in some it imposed a daily penalty of up to £1,000 until the site complied.

The maximum is far higher. Under Schedule 13 to the Act, Ofcom can fine up to £18 million or 10 per cent of your worldwide revenue, whichever is greater. Where a site ignores it altogether, Ofcom can ask a court for an order under section 144 requiring payment providers and advertisers to stop working with the site. It can also ask for an order under section 146 requiring UK internet providers to block it. For most adult businesses, losing the payment provider is the real threat, more than the fine.

For most adult businesses, losing the payment provider is the real threat, more than the fine.

If Ofcom writes to you

Answer it, fully and by the deadline. The first letter is usually a formal request for information, and failing to answer it properly is a breach in its own right under section 102 of the Act, separate from the age check itself. Several of the fines above include a penalty for exactly that.

A site that is not yet compliant is in a far better position if it replies with the facts and a dated plan to put things right than if it stays silent. When a client brings us an Ofcom letter, we look at the site as Ofcom will see it and work out what is missing. We then help choose and set up a check that will stand up, put the written record and the public statement in place, and draft the reply. The aim is to close the matter with Ofcom quickly and keep the business trading.

Some sites have responded to Ofcom by blocking UK visitors. That can be a commercial choice, but it does not wipe out what happened before the block. The nudify site mentioned above blocked UK users shortly after Ofcom opened its investigation, and Ofcom still fined it, taking the block into account only in setting the amount. If the UK is a market you want to keep, compliance usually costs less than leaving.

Creators who sell from their own site

If you are a creator and you sell your content through your own website or app, the duty is yours, not a platform's. The Act treats you as the provider of the service, in the same way as a studio.

Take a creator who sells on a fan platform and also runs a small site of their own, with a few free clips on the front page and a link to buy full videos. The fan platform has its own duty and its own age check for what is sold there. The creator's own site is a different service, and the free clips on its front page are pornographic content shown to anyone who arrives. Unless those clips sit behind a highly effective age check, the creator is in breach, however small the site. The fix is usually simple: move everything explicit behind a check from a reputable provider, write down what you use and why, and publish a short statement saying so.

A creator who only posts on platforms that run their own checks, and has no site of their own, is usually covered by the platform's compliance. Even then it is worth checking what any link-in-bio page or preview account shows before the visitor reaches the platform.

What an age check does not cover

An age check decides who can see your content, not whether the content is lawful. Those are separate questions, and passing the first does not answer the second. Material that is obscene under the Obscene Publications Act 1959, or extreme pornography under section 63 of the Criminal Justice and Immigration Act 2008, stays unlawful behind any age check. The Crime and Policing Act 2026 creates new offences of possessing and publishing pornographic images of strangulation or suffocation, which adult sites will need to plan for.

Nor does an age check deal with the people in the content. Every performer needs to have agreed to the filming and to its publication, and a release form signed under pressure can be challenged years later. Our guide is a release form by porn film actor valid explains how those challenges work, which is worth knowing whichever side of them you are on.

How we help adult businesses comply

Most of the adult businesses that come to us want the same thing: to keep trading in the UK without a fine, with as little disruption as possible. We start with a review of the site as Ofcom would see it. We then help you choose an age check that suits your business and your users, and check the contract with the provider. Finally we put the written record, the public statement and, where you need one, the children's access assessment in place. If Ofcom has already written, we deal with Ofcom for you.

We also prepare the other documents an adult business needs, from performer and model agreements to platform terms. See adult website lawyers for the full set, and terms and conditions for adult platforms for what your user terms should say.

Cases we have handled

We see what happens when producers and sites get consent and records wrong, because we have acted against them. We challenged the release agreements a young mother had signed with four production companies in the UK and abroad, and secured her control over most of the content. Read the removal of old online adult content case study.

In another case, a man who had been homeless was paid £180 to appear in a film and begged the maker not to publish it. We traced the anonymous operator of the site to a home in Essex. He took the videos down, paid compensation, and once journalists contacted him he took his whole site offline. Read the case of Mario Rogers, the porn headmaster. An operator who keeps proper records, and can show them, is in a far stronger position when a complaint arrives.

Frequently asked questions

Can I use a third-party provider for the age check?

Yes, and most sites do. The legal duty stays with you, though. If the provider's method is not highly effective, or users can get round it, Ofcom will hold your site responsible, so test it before you rely on it and keep a record of why you chose it.

What has to be in the written record and the public statement?

Under section 81 of the Online Safety Act 2023, the record should say which age check you use, how you use it, and how you took account of your users' privacy in choosing it. The public statement is a plain summary of the same thing for your users. Ofcom can ask to see the record at any time, so it needs to exist before the letter arrives.

I sell my own content from my own website. Does this apply to me?

Yes, if UK users can reach the site. A creator who publishes their own content on their own site is the provider of that service, in the same way as a studio, and needs a highly effective age check in front of anything explicit, including free previews.

Does AI-generated or audio content count?

Yes. The duty covers pornographic pictures, video and sound, including content an AI tool on your site produces in response to a user's prompt. Text on its own is outside it. Ofcom has already fined the provider of a "nudify" site for having no age check.

Can I avoid the rules by blocking UK users?

A full UK block can take a site out of the market, but it does not undo a breach that happened before the block. Ofcom has fined a site that blocked UK users shortly after its investigation opened. If you want to keep UK users, compliance usually costs less than leaving.

Can I change my age check method?

Yes, but test the new method before you switch, and record why it is highly effective. If users can upload content to your site, the Act also requires a fresh children's access assessment before a significant change. In September 2026 Ofcom announced an investigation into the provider of Pornhub over whether a new method was tested enough before it went live.