Advice For Over 18s

Our top security tips:

  • DO Choose a provider with a good reputation for privacy
  • DO log out of sites after each visit
  • DON'T sign up to products you don’t understand
  • DON'T use credit cards, or provide biometric data for age verification
  • DON'T use VPNs that track your online activity
  • DON'T Reply to direct messages offering ways around age verification
  • DON'T use torrent sites to download porn

What is age assurance, how does it work and what are the risks - your questions are answered below.

As of 25 July 2025, UK law will require websites and apps that contain pornographic content to check that their users are over 18. This requirement became law under the Online Safety Act 2023 and is intended to prevent children and young people from viewing inappropriate sexual content, whether accidentally or intentionally.

Age verification is aimed at services that contain adult content. This does not just mean pornographic websites such as Porn Hub. It also includes social media platforms such as Reddit and X that allow pornographic content on their platforms

Age estimation and age verification are two different methods of age assurance. Age estimation techniques include: facial age estimation technology, which analyses a photograph of a user; and email-based age estimation that analyses what other services an email account is signed up with.

Age verification techniques include: matching someone’s details to an official form of ID such as a driving licence or passport and credit card checks or third-party verification checks such as open-banking.

Ofcom have published a list of techniques in their industry guidance as to what they consider to be ‘highly effective age assurance’.

Age assurance means proving that you are aged 18 or over. Proof requires more than simply ticking a box or typing in your date of birth, which anyone can do.

To access pornographic content on services that are complying with the Online Safety Act 2023 you will have to go through one of the age assurance process that Ofcom have approved in their industry guidance.

Each age assurance process works in a slightly different manner. This could be confusing for many users, so here is a simple explanation as to how each works.

Photo-based age estimation

This works by analysing an image of the user’s face. This is often uploaded via an app or website, then analysed by an algorithm.

Email-based age estimation

This works by examining the other services a verified email address is signed up to. It requires the verification company to have access to information about which services have your personal email on record.

Open banking

This works by your bank verifying your age to another service.

Mobile Network Operator (MNO) age checks

Every Mobile Network Operator in the UK has agreed to a voluntary code of practice where they filter out adult content accessed via a SIM and mobile data. Users can remove this filter by proving they are over 18. MNO checks involve a regulated service checking with the MNO as to whether a user has verified their age with them.

Credit card checks

In the UK only those aged over 18 can have a credit card. A credit card check involves checking credit card details to prove someone using the site.

Photo ID – Matching

This involves uploading a personal photograph to a service that then checks the photograph against a photo uploaded on an official document such as a driving licence or passport.

Digital Identity Services

This involves logging into a service with a digital identity service that has already verified someone’s age. For example giving permission for a digital identity wallet service to verify your age with another service.

Users should consider what choice different apps and websites offer them and pick an age assurance method that respects their personal privacy.

 

 

 

The Online Safety Act 2023 requires any sites that contain pornographic content to use age assurance for users in the UK. This applies whether sites and apps are hosted in the UK or overseas.

Ofcom has been appointed as the regulator for the Online Safety Act. They can apply fines to any company that does not comply with this requirement. They can also order Internet Service Providers (ISPs) to block websites that are not complying. This includes blocking websites that are outside the UK.

The vast quantities of porn on the internet will make it difficult for Ofcom to police compliance effectively across all sites and apps. 

It is expected that Ofcom will target its limited resources on the sites and apps that are most used or searched for by under 18s, or which have received a high amount of media attention for their associated online harms, for example 4Chan.

Small porn providers or overseas providers may therefore escape regulatory attention. They may not implement age verification at all or use cheap age verification systems that do not meet Ofcom’s standards. This could put users at risk of credit card scams or other privacy invasions.

Ofcom don’t regulate age verification providers, but they are supposed to ensure that providers are using what they consider to be highly effective age verification. They issue guidance but it’s not a statutory code of practice. They have not established an accreditation or standards scheme that age assurance providers must comply with. The Age Checks Certification Scheme has suggested that Ofcom do this.

The Information Commissioner’s Office, is responsible for ensuring that age assurance providers comply with UK data protection laws.  However, the ICO has a reputation for not taking action against companies when they fail the public. In addition, the Data (Use and Access) Act 2025 has shifted the ICO’s remit from protecting our privacy to include ‘promoting innovation and competition’.

 

There are legal ways you can avoid using age verification to access online porn, but these all have risks that you should consider.

It may be possible to use Virtual Private Networks (VPNs) to circumvent age assurance. Porn providers are likely only to ask users who appear to be in the UK to prove their age. A VPN will make you appear to be outside the UK, in which instance the requirement to verify your age may not be triggered.

If you choose to use a VPN, find a provider you trust. Free VPNs carry data privacy risks and should be avoided. Avoid any VPNs that store a log of your online activity. To avoid age assurance you are likely to need to use a VPN with servers based outside the UK, and possibly outside the EU. We suggest using VPNCompare to find a VPN that meets your needs.

It is worth noting that Ofcom can require websites to take measures to prevent people avoiding age-assurance measures. In future, this could involve them deploying algorithms that try and detect when someone is using a VPN. For example, blocking IP addresses that are known VPN servers. Many online streaming services deploy similar technologies.

It is possible to use BitTorrent or the Tor network to access the internet anonymously. However, be aware that your web traffic can still be monitored at the moment it exits Tor so this is not a foolproof workaround.

Non-UK-based porn providers can opt not to use age assurance. You should be able to access free porn sites and apps based overseas without verifying your age. It is likely that non-UK-based commercial sites that fail to use age verification for UK users will have UK payment methods blocked; however, using a VPN or non-UK payment method may still give you access.

Age assurance software is provided by a range of private companies. Some providers will be reputable. Others may put your personal data at risk of fraud or scams. You may want to look for providers that have certified security standards such as ISO 27001 and SOC2 Type II.

The age verification providers association works to improve standards within the industry. Their website is a useful source of information, and includes further information about the standards they are working to establish.

Some methods of verifying your age don’t rely on you providing new personal data. This has the benefit of reducing the amount of personal data that could be subject to a ‘man in the middle’ attack or left on a provider’s server that is then hacked. 

Other methods of age assurance such as Open Banking rely on a third party vouching for your age credentials. So the risk of your personal data being breached is smaller. Instead, the risk here is that information about the websites you are accessing become associated with another account. You should read the terms and conditions and consider if you trust the provider and systems in place. 

It is possible for a porn provider to legitimately re-use your personal data, for example with consent, claiming anonymisation, or through some other legitimate interests. Porn websites might also have ad tech data on them that attempts to use fingerprinting to match your online persona to devices, operating systems and other credentials. 

Read Terms of Service documents carefully and do not agree to anything you do not understand.

Be wary of any company promising free content or additional features, as it is likely that they are only doing this to get your consent to them further using and sharing your personal data.

Users should also watch out for phishing sites that appear to be a genuine age assurance service but are actually scams to try and steal your personal data.

Age verification services must at some stage directly identify you in order to accurately verify that you are over 18. Age estimation services must hold information such as your photograph, or where your email address is used by other services. If your real-world identity is connected to your pornography viewing preferences, your privacy could be at risk.

Users will be reliant on providers deleting data such as images, identity documents and credit card data from servers once checks have occurred. Some providers are keen to stress that they do this quickly and implement encryption technologies to protect users. 

No database is ever fully secure. Hacks and leaks can and will happen, even where age verification or pornographic providers take precautions against them. 

This means that there is a risk that your sexual preferences and porn viewing habits could be in the public domain, which could have a devastating effect on your personal life and professional reputation.

UK General Data Protection Regulation 2018 (GDPR) provides some positive improvements for data protection but it does not guarantee your online privacy.

The GDPR and UK data protection laws require personal data to be processed in a manner that is secure. This includes protection against unauthorised or unlawful processing and against accidental loss, destruction or damage. In theory, age verification systems must be designed with data protection in mind – i.e. they must ensure that your privacy is protected by default.

You should be told by porn providers why, when, where and how your personal data is being processed, and by which third-party companies or organisations. Age verification systems must process the minimum personal data necessary to verify your age; additional personal data should not be collected, irrespective of whether it is subsequently securely deleted. Personal data must not be kept for longer than is necessary to achieve the purpose of age verification, and must not be used for other purposes, such as advertising.

In the UK data protection laws are enforced by the ICO. There is sadly evidence that the ICO has a very poor enforcement record. They also have a long waiting time for people who raise complaints with them.

 

If an age verification or porn provider does not comply with GDPR requirements, it can be reported to the Information Commissioner’s Office (ICO). The ICO is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals. Providers can be reported to the ICO if they:

  • fail to assess, document and mitigate privacy risks;
  • re-use your age verification data for other purposes without your knowledge;
  • fail to ensure appropriate measures are in place to ensure your data is adequately safeguarded in age verification processes;
  • keep your personal data for longer than is necessary;
  • collect and keep personal data about people who fail an age verification check.

You could also make an individual complaint to the ICO if you believe that an age verification or porn provider is not keeping your personal details safe. However, this course of action will make your pornography viewing a matter of public record. Sadly, only about 5% of the thousands of complaints to the ICO result in them opening an investigation. Of these, only a handful each year result in enforcement action being taken. 

Even if the ICO does investigate reports and complaints, porn providers can be located outside the UK (and outside the EU) which makes enforcement of findings or sanctions difficult. 

 

You may not always be aware that your data has been leaked. Companies must inform the Information Commissioner’s Office (ICO), the UK authority responsible for overseeing data protection compliance, of data leaks, but they do not always have to tell the people whose data is affected. 

If information about you is published somewhere, you could try and make use of your GDPR right to erasure to get the content removed. 

You could choose to sue a porn provider for failing to adequately protect your sexual data, but this could expose your private life to further public scrutiny.

Companies can also be fined for leaking your data but this money will not be used to provide you with financial compensation.

Until enforcement is underway, we can only speculate as to how the availability of online porn will change. It could mean that people will simply switch to different methods of accessing and sharing pornographic content. Some of these methods could have their own online harms and risks.

In some states in the US and in France, some large  large providers of porn such as PornHub have responded by blocking all access to that region in response to requests for age checks. In Florida, VPN use soared by 1000% when age-checks were introduced.

As enforcement action or blocks are put in place on some websites, the nature of how pornography is accessed by people could change.

In recent years a small number of high-profile ‘tube’ websites have dominated the market share. These sites have also started to work harder to undertake age checks of actors, remove extreme content, and respond to take-down requests to tackle issues such as revenge porn.

If users find these sites blocked or harder to access, then they could search for smaller less regulated sites, or find themselves being targeted for scams that offer access to pornographic content without age checks.

 

 

Age verification may prevent younger children from accidentally finding porn online. The law means that service providers have legal duties to remove adult content  from the homepages of websites, and take it off feeds used by children on social media.

But as a group of young people told the BBC, determined teenagers are likely to find ways around age assurance methods.

Parents should be aware that teenagers may get round age assurance by:

  • Using VPNs
  • Stealing their parents’ ID
  • Look at pornography sites in other jurisdictions that are not applying age assurance
  • Using onion sites on the ToR network
  • Using torrent sites
  • Sharing content with each other via direct messages
  • Tricking algorithms that censor content with filters
  • Purchasing or exchanging memory sticks with pornographic content on
  • Gaining access to a phone or device that has account permissions and credentials unlocked, such as Mobile Network Operator age check or a computer logged into website. 
  • Developing new technological methods to share data and content.=

 

Age-gating the internet will change the way in which people access content online. Children and teenagers may try and circumvent these systems, or find themselves victims of new scams. Parents should be aware of some of the new risks children and teenagers might face:

Risks of hacking or leaking if they use a parent’s ID. This could also put other people’s privacy at risk in the process.

Bullying or coercion from groups or individuals that share content over messaging apps.

Free VPNs track internet use and therefore carry increased data privacy risks. Teenagers should be advised never to use free VPNs.

Being expose to malware shared through memoy sticks, phishing links or Torrents.

Viewing illegal or extreme content if they try to access pornography on sites in other jurisdictions or use the ToR network.

Being groomed by predators that offer them mobile phones that have passed Mobile Network Operator age checks.

Being scammed. Teenagers will also be at heightened risk of phishing sites that offer ways to bypass age assurance checks. . They may be targeted via direct messaging on social media platforms and messaging apps.

Romance and blackmail frauds where an AI bot entices them to share intimate images on the promise of receiving images in return.

Feelings of shame or guilt if they are caught or feel they’ve broken moral or family rules, which may discourage open conversation with trusted adults.

Trusting strangers online to provide access methods or software may lead to grooming, exploitation, or theft.

Possession of illegal content (e.g. certain extreme pornography or non-consensual imagery) may be a criminal offence even if unintentionally accessed.

Impersonation or identity fraud (e.g. misusing a parent’s ID) could lead to involvement with law enforcement, especially if part of a wider pattern of deception.

 

This issue is difficult to assess until we have seen the impact of age verification. We need to weigh the potential benefits of preventing young people from easily accessing pornography on mainstream sites against the risks and harms introduced by the methods they might use to bypass age checks.

While it’s likely that some teenages will be deterred from looking for pornography, we also need to recognise that age verification mechanisms can push them toward riskier behaviours, such as using VPNs, accessing lesser-known or illegal websites, or falling prey to scams and malware.

In fact, there are credible cybersecurity concerns associated with some verification tools. Fake age verification sites or phishing attempts mimicking legitimate services could harvest personal data. AI-driven scams, such as bots threatening to leak intimate content or personal information may also increase, especially as children seek workarounds.

Research by the NSPCC and UK Safer Internet Centre has already flagged that children are often under peer pressure to view pornography and that blocking access without support may lead them to unsafe corners of the internet.

⚠️ See also:

Over time, we may gain better data on whether these systems actually reduce harm. But if they fail, we risk getting locked into a pattern of applying increasingly technical solutions to what is, at its heart, a social and educational issue.

Ultimately, no technical fix can replace the importance of open, honest conversations between parents and young people about pornography, relationships, consent, and digital literacy.

Talk to your children about encountering pornography and other adult content online.

Action for Children have produced some helpful guidance for doing this. The Lucy Faithful foundation have also produced guidance that is well worth reading.

Your children should also receive education about sex, pornography and relationships in school.

You might want to talk to older children about the risks they could be exposed to if they try to get around age verification that are outlined above.

Talk to your children about basic cybersecurity. There is some guidance here from Our Safer Schools

There are also Open Source parental controls that you can set up on your own device.