UK Regulator Launches Investigation into Aylo (Pornhub) Over Age‑Verification Shortcomings
What Happened – Ofcom announced a formal investigation into Aylo, the parent of Pornhub, over concerns that its new age‑assurance process—relying on Apple device signals—does not meet the “highly effective” standard required by the UK Online Safety Act. The regulator says Aylo may have insufficiently tested the method before deployment, potentially allowing minors to access adult content.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a documented, continuously‑monitored age‑verification control that can be proven effective to regulators.
- Highlights the importance of rigorous due‑diligence and evidence collection when adopting third‑party verification mechanisms.
- Aligns with the control objective of access control – verification of user eligibility, a single control that satisfies multiple frameworks (e.g., NIST CSF, ISO 27001).
Who Is Affected – Online media platforms serving adult content, broader digital service providers that implement age‑based access controls.
Recommended Actions
- Conduct an independent assessment of your age‑verification workflow against the “highly effective” requirement.
- Map the assessment to the access‑control objective and collect audit‑ready evidence (test results, third‑party certifications).
- Establish a continuous monitoring process for any third‑party age‑verification services you rely on.
Source: The Record
Technical Notes – The investigation focuses on Aylo’s reliance on Apple’s device‑level age signals (iOS 26.4) as the primary verification vector. No specific vulnerability or exploit is disclosed. Source: Ofcom press release