Ofcom, the UK’s Office of Communications, has published a draft of age-restriction guidelines for online services that host explicit sexual content. The (not yet finalized) recommendations are a step toward cementing enforcement for the recently passed Online Safety Act, which requires platforms displaying or publishing pornography in the UK to ensure children are “not normally able to encounter” adult content on their sites or apps. It’s the UK’s latest attempt to enforce age verification after it bailed on a similar plan in 2019. As before, not everyone is convinced the measures will adequately protect user privacy.

The agency cites studies showing the average age children are introduced to online porn is 13, with 27 percent viewing it by age 11 and 10 percent by age nine. In addition, it says 79 percent of children have seen violent pornography (defined as content “depicting coercive, degrading or pain-inducing sex acts”) before their 18th birthday. Ofcom shared a survey indicating 87 percent of women and 77 percent of men in the UK are “broadly supportive” of measures preventing children from easily accessing porn.

Ofcom says sites or apps hosting adult content in the UK must introduce “age assurance” through direct verification, age estimation using facial scans or a combination of both. It stressed that “weaker” measures — self-declarations, online payment methods that don’t require a person to be 18 and general disclaimers or warnings — won’t cut it.

Should a company disregard the guidelines, the UK could fine it up to £18 million or 10 percent of its global revenue (whichever is higher). That gives platforms like Pornhub a significant financial incentive to comply.

Suggested safeguards

One of Ofcom’s suggested safeguards is asking users to consent to sharing banking information to confirm they’re over 18. (It stresses that the user’s full date of birth won’t be shared.) Photo ID matching is another possibility: Users would upload a legal identification document and take a live capture of their face to ensure they match. Facial age estimation, which scans the user’s face and algorithmically estimates their age, is another approved method. However, that approach would have to offer additional verification methods for adults whose faces look young enough to pass for underage teens.

Wireless carriers’ age checks (blanket blocks on age-restricted content) are another approved method in the draft. Ofcom notes, “Users can remove this restriction by proving to their mobile provider that they are an adult, and this confirmation is then shared with the online pornography service.”

Since UK credit card providers are required to ensure applicants are over 18 before approval, Ofcom gives the green light to users providing credit card details. (Banks would then verify the card is valid before the user’s porn viewing request is approved.) Finally, sharing digital identity wallets, which use various methods (including those already listed) to confirm a user’s age, are also on the agency’s approved list.

Ofcom expects to publish its final guidance in early 2025. Enforcement would follow soon after.

Privacy concerns

Assisting with the draft guidance was the privacy watchdog Information Commissioner’s Office (ICO), which Ofcom cites as a privacy reassurance. But some say that isn’t enough reassurance.

“It is very concerning that Ofcom is solely relying upon data protection laws and the ICO to ensure that privacy will be protected,” Abigail Burke, program manager at UK digital rights organization Open Rights Group, said in an interview with The Verge. “The Data Protection and Digital Information Bill, which is progressing through parliament, will seriously weaken our current data protection laws, which are in any case insufficient for a scheme this intrusive.”

“The potential consequences of data being leaked are catastrophic and could include blackmail, fraud, relationship damage, and the outing of people’s sexual preferences in very vulnerable circumstances,” Burke added in a separate interview with the BBC. 

Aylo, owner of Pornhub (which has a financial stake in the matter), told the BBC it supports age verification but only if safety and privacy are assured. “Any regulations that require hundreds of thousands of adult sites to collect significant amounts of highly sensitive personal information is putting user safety in jeopardy,” it said.

Perhaps the most obvious loophole in Ofcom’s guidelines is using a VPN to spoof a location outside the UK. The BBC noted that demand for VPNs in Louisiana and Utah surged after similar laws were enacted in the US states early this year.