Online Safety Act

The Online Safety Bill received Royal Assenton 26th October 2023, heralding a new era of internet censorship.

The new UK internet Ofcom was quick off the mark to outline its timetable for implementing the new censorship regime.

Ofcom has set out our plans for putting online safety laws into practice, and what we expect from tech firms, now that the Online Safety Act has passed. Ofcom writes:

The Act makes companies that operate a wide range of online services legally responsible for keeping people, especially children, safe online. These companies have new duties to protect UK users by assessing risks of harm, and taking steps to address them. All in-scope services with a significant number of UK users, or targeting the UK market, are covered by the new rules, regardless of where they are based.

While the onus is on companies to decide what safety measures they need given the risks they face, we expect implementation of the Act to ensure people in the UK are safer online by delivering four outcomes:

• stronger safety governance in online firms;

• online services designed and operated with safety in mind;

• choice for users so they can have meaningful control over their online experiences; and

• transparency regarding the safety measures services use, and the action Ofcom is taking to improve them, in order to build trust .

We are moving quickly to implement the new rules

Ofcom will give guidance and set out codes of practice on how in-scope companies can comply with their duties, in three phases, as set out in the Act.

Phase one: illegal harms duties

We will publish draft codes and guidance on these duties on 9 November 2023, including:

• analysis of the causes and impacts of online harm, to support services in carrying out their risk assessments;

• draft guidance on a recommended process for assessing risk;

• draft codes of practice, setting out what services can do to mitigate the risk of harm; and

• draft guidelines on Ofcom's approach to enforcement.

We will consult on these documents, and plan to publish a statement on our final decisions in Autumn 2024. The codes of practices will then be submitted to the Secretary of State for Science, Innovation and Technology, and subject to their approval, laid before Parliament.

Phase two: child safety, pornography and the protection of women and girls

Child protection duties will be set out in two parts. First, online pornography services and other interested stakeholders will be able to read and respond to our draft guidance on age assurance from December 2023. This will be relevant to all services in scope of Part 5 of the Online Safety Act.

Secondly, regulated services and other interested stakeholders will be able to read and respond to draft codes of practice relating to protection of children, in Spring 2024.

Alongside this, we expect to consult on:

• analysis of the causes and impacts of online harm to children; and

• draft risk assessment guidance focusing on children's harms.

We expect to publish draft guidance on protecting women and girls by Spring 2025, when we will have finalised our codes of practice on protection of children.

Phase three: transparency, user empowerment, and other duties on categorised services

A small proportion of regulated services will be designated Category 1, 2A or 2B services if they meet certain thresholds set out in secondary legislation to be made by Government. Our final stage of implementation focuses on additional requirements that fall only on these categorised services. Those requirements include duties to:

• produce transparency reports;

• provide user empowerment tools;

• operate in line with terms of service;

• protect certain types of journalistic content; and

• prevent fraudulent advertising.

We now plan to issue a call for evidence regarding our approach to these duties in early 2024 and a consultation on draft transparency guidance in mid 2024.

Ofcom must produce a register of categorised services. We will advise Government on the thresholds for these categories in early 2024, and Government will then make secondary legislation on categorisation, which we currently expect to happen by summer 2024. Assuming this is achieved, we will:

• publish the register of categorised services by the end of 2024;

• publish draft proposals regarding the additional duties on these services in early 2025; and

• issue transparency notices in mid 2025.

Ofcom has commenced investigations into two pornographic services - Itai Tech Ltd and Score Internet Group LLC - under our age assurance enforcement programme.

Under the Online Safety Act, online services must ensure children cannot access pornographic content on their sites. In January, we wrote to online services that display or publish their own pornographic content to explain that the requirements for them to have highly effective age checks in place to protect children had come into force. We requested details of services' plans for complying, along with an implementation timeline and a named point of contact.

Encouragingly, many services confirmed that they are implementing, or have plans to implement, age assurance on around 1,300 sites. A small number of services chose to block UK users from accessing their sites, rather than putting age checks in place.

Certain services failed to respond to our request and have not taken any steps to implement highly effective age assurance to protect children from pornography.

We are today opening investigations into Itai Tech Ltd - a service which runs the nudification site Undress.cc - and Score Internet Group LLC, which runs the site Scoreland.com. Both sites appear to have no highly effective age assurance in place and are potentially in breach of the Online Safety Act and their duties to protect children from pornography. Next steps

We will provide an update on both investigations on our website in due course, along with details of any further investigations launched under this enforcement programme

 

Update: Low Scores

2nd July 2025. See article from ofcom.org.uk

Ofcom has closed its investigation of scoreland.com after the website introduced age/ID verification. The website now requires that UK users subscribe using a credit card (no debit cards) before content can be viewed. Visitors from other countries can see teaser images and can pay via several other options.

Ofcom writes:

In response to our investigation, Score Internet Group LLC have taken steps to implement highly effective age assurance to ensure compliance with their duties under Part 5 of the OSA.

As such, Ofcom is satisfied that the conduct that led to the opening of the investigation has ceased and we do not consider it appropriate to continue our investigation. We have therefore closed it without making any findings as to Score Internet's compliance with its duties, either currently or prior to its confirmation that it had taken steps to comply with the OSA.

A dating safety app that allows women to do background checks on men and anonymously share red flag behaviour has been hacked, exposing thousands of members' images, posts and comments.

Tea Dating Advice, a US-based women-only app with 1.6 million users, said there had been unauthorised access to 72,000 images submitted by women. Some included images of women holding photo identification for verification purposes, which Tea's own privacy policy promises are deleted immediately after authentication.

The company also admitted that an additional 59,000 images from the app showing posts, comments and direct messages from over two years ago were accessed.

So most of the major tube sites have decided to implement ID verification for UK viewers. But thankfully there are still plenty of options of websites that have not yet implemented ID verification requirements. Here is a useful list of porn sites to try to find those not inflicting ID verification: toppornsites.com .

For viewers stupidly subscribing to the risk of handing over ID to watch porn I noted that many websites were promising to not keep a copy of ID data provided for verification purposes and then immediately demanding an email address that will be kept for furture visits. Surely an email address is a key piece of identity data that should not be retained.

Surely a better idea is purchase a VPN and access porn as if in a different country from the UK. For the moment all the major porn sites stil allow access via VPN. Perhaps one day this will not be 5the case when ID verification is adopted worldwide. Also not that it is up to websites whether they allow access via VPN or not. Under threat of extreme punishment they could reasonably easily one day block access from VPNs. (as the likes of BBC and Netflix already do).

Another option is to install a tor browser (the onion ring I think). See torproject.org . This is a browser that looks bery much like Firefox but obtains page data via  complicated and encrypted routing that evades censorship and country specific blocking. It is not quite as 100% succesful as a VPN but can be used to watch porn on the main porn websites.

But of course the authorities will not be very pleased by these straightforward workarounds, and they have put in place a censorship rule to prevent adult websites from themselves promoting workarounds. According to Ofcom and the BBC, platforms must not host, share or permit content that encourages the use of VPNs to get around age checks and it will be illegal for them to do so.

An Aylo spokesperson, the parent company of Pornhub said parents are advised to block VPN usage just in case, and  told the BBC that the question of VPNs was an issue for governments, adding:

We certainly do not recommend that anyone uses technology to bypass the law.'

Aylo has publicly called for effective and enforceable age assurance solutions that protect minors online, while ensuring the safety and privacy of all users. The United Kingdom is the first country to present these same priorities demonstrably

Thankfully such censorship laws simply don't apply to websites out of Ofcom's remit so there will surely be plenty of sources of information available to workaround the dangers of ID verification for porn.

 

Update: VPNs galore

27th July 2025. From the Financial Times

The Financial Times has reported on the inevitably booming sales and downloads  of VPNs.

Proton VPN has leapfrogged ChatGPT to become the top free app in the UK, according to Apple. Proton VPN has experienced a 1800% increase in daily UK. sign-ups. NordVPN has seen 1000% increase in UK purchases.

A Proton spokesperson told Mashable:

This clearly shows that adults are concerned about the impact universal age verification laws will have on their privacy.

A new survey of 1,469 adults, which was conducted by the child protection focused Lucy Faithfull Foundation, has noted that 45% of adults who dont want to verify their identities to access porn have turned to using sites without age checks. In addition, 29% have used Virtual Private Networks to bypass age checks on sites that have them.

Kerry Smith, CEO of the Foundation, said:

Its highly concerning that age verification measures are not being implemented on certain platforms. Safeguards on pornography sites are essential to protect children from accessing pornography, which we know, if viewed at a young age, can normalise harmful sexual behaviours and leave children more vulnerable to grooming from predators.

There needs to be strong enforcement of the Online Safety Act to ensure robust and meaningful safety measures are put in place on pornography platforms, including the use of deterrence messaging and signposting for adults to appropriate support services.

We would also encourage the government to bring in even more robust legislation, so online pornography is treated just as it is in the offline world.

An Ofcom spokesperson said

Change is happening, and the tide on online safety is beginning to turn for the better. Last year saw important changes for people, with new measures across many sites and apps now better protecting UK users from harmful content, particularly children. But we need to see much more from tech companies this year, and well use our full powers if they fall short.

Ofcom does have the power to impose significant financial fines, although there remains a question mark as to how much impact this will have on non-UK based sites. The regulator could also ask broadband ISPs and mobile operators to block the sites at network-level, although this would have little impact on VPN users.

Overall, its hardly surprising or controversial that many adults do not want to have to share their private personal or financial details with unknown and unregulated third-party age verification providers, particularly when those services are associated with porn peddlers. The infamous Ashley Madison hack showed just how dangerous such information could be in the wrong hands (countless cases of blackmail and suicide etc.).

Pornhub explains in a press release:

In line with other stakeholder groups, academics and public policy institutions, Aylo's assessment is that the Online Safety Act (OSA) has not achieved its intended goal of protecting minors. Effective February 2, 2026 Aylo will no longer participate in the failed system that has been created in the United Kingdom as a result of the OSA's introduction. Based on Aylo's data and experience, this law and regulatory framework have made the internet more dangerous for minors and adults and jeopardizes the privacy and personal data of UK citizens.

New users in the UK will no longer be able to access Aylo's content sharing platforms, including Pornhub, YouPorn, and Redtube. UK users who have verified their age will retain access through their existing accounts.

Statement by Alex Kekesi, VP Brand and Community, on behalf of Aylo:

We've made the difficult decision to restrict access to our sites (user-uploaded content platforms, including Pornhub, YouPorn, Redtube) in the United Kingdom.

As of February 2, 2026, our library of thoroughly moderated and consensual adult entertainment, on one of the most trusted adult sites in the world, will be restricted. Our sites, which host legal and regulated porn, will no longer be available in the UK to new users, but thousands of irresponsible porn sites will still be easy to access.

Aylo initially participated in the Online Safety Act (OSA) because we wanted to believe that a determined and prepared regulator in Ofcom could take poor legislation and manage to enforce compliance in a meaningful way, while offering more privacy preserving age assurance methods than we'd seen in other jurisdictions. Despite the clear intent of the law to restrict minors' access to adult content and commitment to enforcement, after 6 months of implementation, our experience strongly suggests that the OSA has failed to achieve that objective. We cannot continue to operate within a system that, in our view, fails to deliver on its promise of child safety, and has had the opposite impact. We believe this framework in practice has diverted traffic to darker, unregulated corners of the internet, and has also jeopardized the privacy and personal data of UK citizens.

In October we met with both the government department which authored the OSA, and the UK regulator responsible for enforcing it, to re-iterate our concerns about the law's vulnerabilities. We presented data and continued advocating for a device-based solution and are disappointed that despite the evidence shared, such little progress has been made, especially when an alternative and viable solution exists.

Aylo consulted with the regulator and was committed to giving the OSA every chance to succeed, but we believe Ofcom was given an impossible mandate. In our view, it is clear this is too big a challenge for any regulator to execute within the parameters of the Act. Based on our data and experience, effective enforcement is not possible, circumvention is rampant, privacy is compromised, and new, unregulated sites quickly fill any gaps left by responsible operators. In other jurisdictions, Aylo has often been one of the only major platforms to comply, only to see traffic diverted to even larger, non-compliant sites. Although larger operators are compliant, we believe the OSA has created an ecosystem where the vast majority of sites with age-inappropriate content are left unchecked. Users are turning to sites that do not have uploader verification measures and do not moderate content, leading to an increased risk of exposure to dangerous or illegal content. What is alarming about the top 10 Google and Bing search results for free porn in the UK is not just that more than half of the sites lack any age verification, but that the specific sites keep changing. (January 20, 2026) Search results are constantly replenished with new, non-compliant sites, demonstrating how easily new players can enter the market. This revolving door means the internet remains wide open to unmoderated, unverified and potentially unsafe content, regardless of how many times authorities attempt to crack down. The longer this goes on, these non-compliant sites are accessed by more minors and adults. As outlined by Lucy Faithfull Foundation, we know that when faced with age verification, some adults are choosing riskier, irresponsible sites to avoid age checks. Alternatively, they seek out solutions to circumvent restrictions by using virtual private networks (VPNs) to connect to the same websites via a different country.

We remain committed to working with the UK, European Commission and other international partners to ensure the lessons learned in the UK inform future policymaking. We continue to believe that to make the internet safer for everyone, every phone, tablet or computer should start as a kid-safe device. We've seen progress in this space with Apple's recent iOS 26.1 update, which enables built-in content filters to limit adult websites by default on existing minors' accounts and requires parental consent to disable them. This method blocks access to known adult content websites, cannot be circumvented with VPNs and does not introduce any data privacy risks. This is a big step for online safety that can go even further. We encourage all device manufacturers to make this the default setting on all devices, not just known minor accounts, to better protect everyone. Laws should mandate that only adults be allowed to unlock access to age-inappropriate content. We are determined to be part of this solution and want to collaborate with government, civil society and tech partners to arrive at an effective device-based age verification solution.

 

The BBC makes an interesting comment with reference to an upcoming censorship law that will ban choking and strangulation content on porn websites. How on earth are foreign porn websites expected to implement such a ban on material that is so commonplace, just for the UK. Perhaps the answer is to simply self block in the UK with the knowledge that keen UK users with a VPN can still access it.

The BBC article notes:

Anti porn campaigner Prof Clare McGlynn believes Pornhub would prefer VPN usage to having to regulate or moderate its content more, particularly as the UK looks to restrict more material. The UK government recently announced plans to make online porn showing strangulation or suffocation illegal.

On VPNs being used to get around checks, social media expert Matt Navara says Pornhub's decision to restrict UK access may be more about creating a legal firewall about restrictions than a protest. He said:

I think blocking UK access lets Pornhub dodge some of the regulations, skip the costs and still collect the traffic from users they can no longer see.