Full Report
Regulator wants to know whether parent Aylo did its homework before reopening the door to UK iPhone users
Analysis Summary
# Regulation/Compliance: Online Safety Act (OSA) - Age Assurance Duties
## Overview
The Online Safety Act (OSA) is a UK legislative framework designed to protect users, particularly children, from illegal and harmful content online. A central pillar of the act requires providers of regulated services (such as adult content sites) to implement "highly effective" age assurance measures to prevent children from accessing inappropriate material.
## Key Details
- **Issuing Authority:** Ofcom (Office of Communications)
- **Effective Date:** July 2025 (Age assurance duties commencement)
- **Jurisdiction:** United Kingdom (applies to services accessible by UK users)
- **Status:** In Effect (Investigation phase for Aylo/Pornhub)
## Requirements
### Mandatory Requirements
1. **Effective Age Assurance:** Implement measures that are highly effective at preventing children from accessing adult content.
2. **Risk Assessment:** Formally assess whether children are likely to access the service.
3. **Continuous Review:** Revisit and update assessments before making significant changes to the service or if existing checks are found to be less effective.
4. **Due Diligence:** Conduct thorough testing and homework/validation of third-party age signals before deployment.
5. **Information Compliance:** Respond to formal information requests from the regulator.
### Recommended Practices
1. **Multi-Platform Consistency:** Ensuring age gates apply across all operating systems (iOS, Android, Web) to avoid regulatory scrutiny.
2. **Pre-Deployment Audits:** Engaging in independent audits of age verification technology before a UK-wide rollout.
## Affected Organizations
- **Industries:** Adult content providers, social media platforms, and any "user-to-user" services.
- **Organization Size:** All sizes; however, Ofcom is currently prioritizing enforcement against large-scale providers (Category 1 services).
- **Geographic Scope:** Any global entity offering services to users located in the United Kingdom.
## Compliance Timeline
- **July 2025:** OSA age assurance duties officially came into force.
- **February 2, 2026:** Aylo restricted UK access following traffic declines and regulatory pressure.
- **May 2026:** Aylo introduced Apple-based age signals for UK iPhone users.
- **September 23, 2026:** Ofcom officially launched an investigation into Aylo’s compliance.
## Implementation Guidance
### Assessment Phase
- Determine if the service hosts content harmful to children (e.g., pornography).
- Evaluate the likelihood of UK children attempting to access the site.
### Implementation Phase
- Deploy age assurance technology (e.g., third-party signals, credit card checks, or ID verification).
- Ensure the technology is integrated securely and does not allow for simple bypasses.
### Validation Phase
- Conduct rigorous testing to ensure the "highly effective" standard is met.
- Document the "homework" (due diligence) performed on third-party providers (like Apple) to ensure their signals meet UK legal thresholds.
## Technical Requirements
- **Age Verification Signals:** Integration with device-level or OS-level age attributes (e.g., Apple's age-verified signals).
- **Access Control:** Hard gates that prevent content rendering until a positive age match is confirmed.
- **Data Privacy:** Ensuring age checks comply with data minimization principles.
## Penalties & Enforcement
- **Fines:** Up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.
- **Other Consequences:**
- **Business Disruption:** Court-ordered access restriction (ISP blocking).
- **Criminal Liability:** Senior managers can face criminal charges for failing to comply with information requests.
- **Reputational Damage:** Public notices of investigation and non-compliance.
- **Enforcement:** Ofcom gathers evidence, issues a provisional contravention notice, allows for a response, and then issues a final decision.
## Related Standards
- **ISO/IEC 27566:** Framework for age assurance systems (Alignment: Provides technical standards for age estimation).
- **BSI PAS 1296:** Code of practice for online age verification (Alignment: Offers a framework for providers to demonstrate due diligence).
## Resources
- **Official Documentation:** [ofcom.org.uk/online-safety]
- **Guidance Documents:** Ofcom guidance on "highly effective" age assurance methods.
## Practical Recommendations
1. **Document Everything:** Organizations must maintain a paper trail of the due diligence performed on third-party verification tools.
2. **Cross-Platform Parity:** Avoid "tiered" compliance where one OS (iOS) has different standards than another (Android), as this triggers regulatory red flags.
3. **Proactive Engagement:** If a service change is "significant," consult with legal counsel to ensure a new risk assessment is filed before the update goes live.