As of 25 July 2025, UK law will require websites and apps that contain pornographic content to check that their users are over 18. This requirement became law under the Online Safety Act 2023 and is intended to prevent children and young people from viewing inappropriate sexual content, whether accidentally or intentionally.

The requirement for online porn to be restricted through age verification became law in the Online Safety Act. Ofcom has a digital tool that you can use to check to see what your duties are under this law. 

The Online Safety Act duties for providers of websites and user-to-user services covers a broad spectrum of both illegal and harmful content. The duties can be complicated and difficult for many providers to understand. 

Ofcom has extensive documentation and guidance for people to work through on this. 

In short, the requirements to put in place age assurance measures apply to social media and user-to-user services, as well as websites that are considered commercial pornography sites. 

The law on age verification applies whenever UK customers visit commercial porn sites and apps, whether these are hosted in the UK or overseas.

Ofcom has been appointed by the government to make sure that service providers comply with the law. Sites that do not comply with age verification requirements could be blocked at ISP level, and face financial penalties. There are also senior executive criminal liabilities for failing to comply with the Online Safety Act.

Ofcom is likely to concentrate its regulation attentions only on the most-used and searched for porn sites and apps.

If your business is flagged as non-compliant by Ofcom, this could lead to an investigation that could result in a prosecution, fine or your website being blocked at the ISP level for UK users.  

The law on age verification applies when UK customers visit commercial porn sites and apps, regardless of whether these are hosted in the UK or overseas.

Even if a service is hosted overseas, Ofcom can:

• Demand compliance if it’s accessible in the UK.

• Enforce through fines, blocking access at the ISP level, cutting off payment methods such as with Visa, or legal action.

• Work with other countries and regulators to increase pressure.

Age assurance requires you to ensure that your UK customers are aged 18 or over. It is not enough to ask customers to tick a box or enter their date of birth. In order to meet compliance standards and prevent fraud, you must implement what Ofcom considered to be a ‘highly effective’ age assurance method. 

There are various Age verification tools on the market. You should choose a product you trust and which offers the maximum privacy protection to your customers. The Age Verification Providers Association provides information on the options available to you. 

The choice of which third-party age verification provider to use is up to you. To best protect yourself and your customers, we recommend you use the most robust tools that offer the most privacy.

 Each tool has different user requirements, different levels of privacy protection, and different cost implications for your business.

We would encourage you to give your users a choice of which age verification method they would prefer to use, as privacy minded users will avoid sites with methods they don’t wish to use. 

Ofcom has published guidance for age verification providers which set out the criteria for a legally compliant system. There is also an international ISO standard for age verification providers. You can also look for a provider that has a good level of security certification for their services such as ISO 27001 and SOC2 Type II.

Age verification carries significant data protection and privacy risks.

To protect your customers, select a trustworthy age verification tool and ensure that individuals are automatically logged out of your site after each visit.

If you believe your site to have been blocked wrongfully or unfairly, you can appeal to the BBFC’s Independent Appeal Panel. More information is available here.

If you are unsure whether your site has been blocked, use our tool at blocked.org.uk

You must inform the Information Commissioner’s Office (ICO), the UK authority responsible for overseeing data protection compliance, of any data breaches.

You do not always have to inform the people whose data is affected, although it is a part of responsible business to keep people informed where their personal data is at risk of becoming public. There could be very significant consequences for individuals if their pornographic viewing and sexual habits were to be broadcast.

It is possible that age verification requirements will lead to fewer people accessing content that is hosted in the UK. The law is intended to stop children and teenagers from accessing explicit content. Adults might be intimidated from verifying their age on the basis that there is a risk of exposure. However, this does not mean that the overall market for online porn will shrink.

We have already seen examples of smaller providers decided the risks associated with the Online Safety Act are not worth them continuing to offer a service. 

Age verification also carries an inherent risk of censorship. Providers of websites and user-to-user services have to comply with a host of duties under the Online Safety Act. As a provider, that might pressure you into applying stricter content moderation policies to your website. 

It is probable that once politicians work out that age verification is failing to make porn inaccessible to children, some will demand that more and more sites are blocked. This could for example take the form of action against VPNs. 

This could lead to thousands of sites with legal content being blocked in the UK – which could have a positive or negative impact on your business depending on individual circumstances.

Age assurance will incur a commercial cost in terms of providing the service itself. This cost will have to be paid either by the site owner or the site user. Some porn viewers will not want to pay, others will not want to risk their privacy. This may reduce traffic and perhaps sales. Sites which pay to use third-party age verification services may find that age-verifying users is not cost-effective compared to the low proportion of site visitors that become paying customers. This puts low-income niche sites particularly at risk.