Age Verification in 2026: What UK, EU, Australian and Dubai Laws Mean for Escort Agencies, Directories and Adult Brands

Age verification now shapes how every adult site, agency and directory operates. The UK, the EU, Australia and the UAE each take a different route. Ofcom keeps fining operators that fall short.

If you run an agency, a directory, an adult store, or your own site as an independent, these rules apply to you. A wrong step can cost you a fine or your search traffic.

This guide explains what each region requires and who it covers. It shows what counts as compliant and how you can check. It also sets out what each type of operator should do next.

The age gate, page content, hosting, and search impact all affect each other. The strongest position comes from setting them up together, before a regulator asks. That takes people who know the sector.

We have worked in the adult sector for over ten years. Our in-house team builds, hosts, ranks and secures sites for escort agencies and tantric practitioners. We do the same for luxury adult ecommerce brands and companionship services. Treat this guide as strategic guidance, not legal advice.

Start with the largest operator in the sector. Its UK exit shows how hard this is to get right.

The Pornhub walkout: why the biggest player still has not settled

On 27 January 2026, Aylo said it would restrict UK access to Pornhub, YouPorn and RedTube from 2 February. Aylo owns all three sites. UK users who had already verified their age kept access through their existing accounts. New UK visitors lost it.

Aylo gave a blunt reason. In its statement, it said the Online Safety Act “has not achieved its intended goal of protecting minors”. It chose to stop recruiting UK users rather than run checks it no longer backed.

The commercial pressure showed months earlier. On 31 October 2025, the BBC reported a claim from Pornhub. It said its UK traffic fell 77% after checks began on 25 July 2025. The BBC could not verify that figure. Ofcom told the BBC that porn site visits fell by almost a third in the three months after 25 July.

February was only the first step. Three more followed:

• On 5 May 2026, Aylo restored Pornhub for UK iOS users whom Apple confirms as adults (Aylo). Biometric Update reported it on 8 May.
• On 22 September 2026, Ofcom opened an investigation into how Aylo applied its new process. Ofcom said it was not judging Apple’s own system.
• In Australia, Aylo began blocking users in March 2026. Its newsroom listed Apple-confirmed adults returning on 6 October 2026.

The UK and Australia are not the only markets Aylo has left. It suspended its sites in France in June 2025. On 27 January 2026, Biometric Update counted 22 US states on its blocked list.

Aylo says the system has not protected minors, and Ofcom keeps enforcing it.

The largest operator in the sector is now testing device-level age signals. The regulator, in turn, is testing how it tests them. If Aylo has no settled answer yet, smaller operators have no template to copy.

The UK position: the Online Safety Act in practice

Ofcom regulates the Online Safety Act 2023. For age verification on adult sites, UK law sets two separate routes. The route that applies to you decides almost everything else.

Part 5: pornography you publish yourself

The Act calls this provider pornographic content. Section 81 requires age verification or age estimation. The method must be “highly effective at correctly determining” whether a user is a child. This duty took effect on 17 January 2025.

Part 3: services that host user content

These are user-to-user services, where users upload content that others can see. Section 12 sets children’s safety duties for these services, including age assurance. Ofcom gives 25 July 2025 as the date these age checks became necessary (Ofcom).

Under s.79(7), content that users upload is not provider pornographic content. So a listing that a third party writes and uploads sits under Part 3, not Part 5.

Who the Act reaches

Your business address does not decide the question. The Act applies wherever a service has “links with the United Kingdom” (s.80). That means a significant number of UK users, or the UK as a target market. A site hosted abroad and run from abroad can still fall inside.

The penalties are heavy. Ofcom can fine up to £18 million or 10% of qualifying worldwide revenue, whichever is greater (Schedule 13).

The Crime and Policing Act 2026 received Royal Assent on 29 April 2026. Its section 109 inserts section 217A into the Online Safety Act. That section gives a power to make regulations on age and consent verification for people shown in pornographic content. The legislation.gov.uk page for section 81 lists one entry under “Changes and effects yet to be applied”. Section 247(4) of the same Act makes it. That entry amends section 102 (information notices). It does not change the section 81 duty.

What “highly effective” means

Ofcom’s guidance tests each method against four criteria: technically accurate, “robust”, reliable and fair.

The regulator also lists methods that can meet the standard. The list is not exhaustive. It includes open banking, photo-ID matching, facial age estimation and mobile network operator checks. It also includes credit card checks, digital identity services and email-based age estimation.

Two approaches fail. Self-declaration, such as an “I am over 18” button, does not count. Nor do payment methods that do not require the user to be 18, such as debit cards.

Ofcom’s list names methods, not vendors. No vendor is “Ofcom-listed”.

Enforcement since December 2025

Ofcom has moved from guidance to fines. By 15 July 2026, it had fined seven providers of 24 sites (Ofcom). The table lists five of them.

Date	Provider	Penalty
4 December 2025	AVS Group	£1 million, plus £50,000 for not answering an information notice (Ofcom).
12 February 2026	Kick Online Entertainment SA	£800,000, plus £30,000 (Ofcom).
23 February 2026	8579 LLC	£1.35 million, plus £50,000 (Ofcom).
27 May 2026	Youngtek Solutions	£500,000, plus £100,000 (Ofcom).
18 June 2026	First Time Videos LLC	£80,000. Ofcom has closed the case. The firm had blocked UK IP addresses and paid (Ofcom).

Ofcom’s July 2026 announcement counted the top 100 porn services as of June 2026. Of these, 64 ran age checks. A further ten were geo-blocked to UK users.

Apple’s device-level signal

Apple lets UK users confirm they are adults in their Apple Account. They can add a credit card, or scan a passport, driving licence or government ID (Apple). Ofcom’s July 2026 report cites action from Apple as progress at system level. It expects more from app stores, operating systems and devices.

Aylo now relies on Apple’s adult check for Pornhub, and Ofcom is investigating how Aylo applied its process. For other operators, its status as a route to compliance remains unsettled.

Australia: the eSafety codes and the VPN spike

Australia is moving in the same direction with a wider net. The eSafety Commissioner oversees a set of industry codes under its own Online Safety Act 2021.

eSafety registered its codes in June and September 2025. The newer codes took effect on 9 March 2026. Three earlier codes took effect on 27 December 2025. They cover search engines, hosting and internet carriage (eSafety FAQ, updated 21 September 2026).

The scope goes beyond the UK. The codes reach porn sites and social media services that carry adult material. They also reach app stores, R18+ games, AI chatbots and search engines. App stores must stop under-18s downloading R18+ apps.

On porn sites, clicking “I am 18” is no longer enough. eSafety expects methods that are “accurate, robust, fair and reliable” (eSafety release, 6 March 2026).

eSafety says ongoing non-compliance can bring civil penalties of up to A$54.6 million per breach (eSafety FAQ). It acts on systemic non-compliance.

VPNs: where Australia goes further

Here Australia parts company with the UK. eSafety expects providers to detect VPN use. It also expects reasonable steps against other workarounds. The UK takes a lighter line, covered in the VPN section below.

Users responded fast. Reuters reported 28,722 VPN downloads in Australia on 8 March 2026, citing Apptopia data. That was about three times the previous week’s daily average.

Aylo’s Australian block, covered above, came in the same month.

For operators, Australia shows two things. Regulators outside the UK now expect the same family of checks. At least one of them also expects you to look at how users reach you.

The EU: DSA enforcement, the EUDI Wallet and what is coming

The EU combines a live legal duty with tools still under construction.

Who Article 28 covers

Article 28 of the Digital Services Act applies to online platforms accessible to minors. They must put in place measures to ensure a high level of privacy, safety, and security for minors. An online platform stores user content and shares it with the public. The duty applies to these platforms generally, not only to very large ones.

Two limits narrow the scope. A site that publishes only its own content is not an online platform (Article 3(i)). Article 19 also excludes micro and small enterprises, unless they are very large platforms. So scope depends on how your service works and how big it is.

DSA fines reach 6% of worldwide annual turnover (Article 52(3)). Data failures can add GDPR fines of up to 4% or €20 million, whichever is higher (Article 83(5)).

The case against four platforms

The Commission opened formal proceedings against Pornhub, Stripchat, XNXX and XVideos on 27 May 2025. On 26 March 2026, it issued preliminary findings that all four breach the DSA by letting minors in. It found self-declaration ineffective. The findings are not final (Commission press release).

The EU’s own age check

The Commission released an open-source age verification blueprint on 14 July 2025. The Commission says the solution became “feature ready” on 15 April 2026 (EU age verification).

The design aims to tell the platform only that the user is over 18.

The longer-term vehicle is the EU Digital Identity Wallet. Regulation (EU) 2024/1183 requires each Member State to offer at least one wallet. The deadline falls 24 months after the implementing acts. The Commission expects wallets by the end of 2026.

The technology is still young. On 16 April 2026, security consultant Paul Moore showed a bypass of a demo version of the EU app. He got past its PIN and biometric checks in under two minutes. The Commission said it had taken immediate steps to fix the flaw.

France and what comes next

France already enforces stringent age verification measures. Its 2024 SREN law gives Arcom, the regulator, power to sanction and block pornographic sites. Aylo suspended Pornhub, YouPorn and RedTube there from 4 June 2025, in protest at its age verification law. Arcom noted the decision on 3 June 2025.

In September 2026, the Commission also proposed an EU KIDS Act.

For operators, the EU calls for preparation. Watch for final decisions on the four platforms and for the wallet rollout. Before either arrives, check whether your service counts as an online platform.

Dubai and the UAE: a different question

UAE law restricts adult content directly, through its cybercrime law. A newer child digital safety law adds age verification duties for platforms. This section covers both.

Federal Decree-Law 26 of 2025 on child digital safety came into force on 1 January 2026. Law firm summaries say it applies to digital platforms that operate in the UAE or target its users (Baker McKenzie, Clyde & Co). They say platforms must use age verification methods that match their risk classification. They describe a one-year transition to January 2027. Implementing regulations will set the detail. Neither summary mentions adult content.

Federal Decree-Law 34 of 2021 covers cybercrimes. ADGM hosts an English translation.

• Article 34 covers creating, running or displaying obscene or morality-breaching material online. It carries imprisonment, a fine of AED 250,000 to 500,000, or both.
• Article 33 covers inciting or helping others into prostitution or immoral acts through an information network. It carries temporary imprisonment and a fine of AED 250,000 to 1 million.
• Article 10 covers using another IP address or other means to commit a crime or avoid detection. It carries temporary imprisonment, a fine of AED 500,000 to 2 million, or both. The decree-law does not mention VPNs.

This is a summary of the law and of law firm commentary, not operating advice. Consult UAE-qualified counsel for any operation with meaningful UAE exposure.

Should you be worried? Guidance by operator type

The answer depends on what you publish and who uploads it. This section gives strategic guidance for three types of operators. It is not legal advice, and a qualified solicitor should confirm your position.

Escort agencies

An agency that publishes its own pornographic content falls under Part 5. The age-check duty attaches to the pornographic content you publish yourself.

The statute draws a line by format. Content that consists only of text sits outside Part 5 (s.79(4)). Images, video and audio sit inside it.

So the decision turns on one question: what do your public pages show? Before any check, can a visitor see pornographic images, video or audio? If yes, those pages raise the Part 5 question directly. If your public pages carry text only, the statute treats them differently.

A self-declaration splash page does not meet the standard for pornographic content.

One caution applies. Ofcom judges titles and captions in context, as the next section explains.

Directory operators

An escort directory works differently. If providers upload their own listings, those listings are user-generated content. User-generated content is not provider pornographic content (s.79(7)). That places those listings under Part 3, not Part 5.

Paid-for adverts, as defined in s.236, sit outside Part 5 (s.79(5)). The text does not settle how Part 3 treats a paid listing.

Part 3 also brings other duties. User-to-user services carry illegal content duties. The priority offences include causing or inciting prostitution for gain. They also include controlling prostitution for gain (Schedule 7, paras 27 and 28). A directory has to weigh those duties alongside age checks.

The practical questions are who uploads the images, where they appear and what a visitor sees before any check.

The directory position is not settled by the text alone.

Independent providers

Independent providers with their own sites face the same Part 5 question as agencies. They usually have fewer resources to absorb the cost and the risk.

Three options exist. None is risk-free, and this guide does not rank them.

1. Third-party age checks. You add a vendor check before explicit material and accept the friction. Vendor costs are now manageable. The friction may still deter careful clients who avoid leaving a digital footprint.
2. Restructure the site. Public pages show no pornographic images, video or audio. Explicit visual material sits behind a gate.
3. Geo-restriction. Some services have chosen this route. Ofcom reports that 10 of the top 100 porn services geo-block UK users.

Geo-restriction is not a safe harbour. The UK test turns on links with the UK (s.80). Australia expects providers to detect VPN use. Visitors from a blocked market can still arrive through a VPN.

Each option changes cost, friction and search visibility in different ways. The sections on compliance and VPNs below cover those trade-offs.

What counts as compliant? Gating, images, text and messaging

The UK statute draws its line by format. That line decides what you need to gate.

How the Act defines pornographic content

The Act defines pornographic content by purpose. It covers content of a certain nature. It must be reasonable to assume someone produced it solely or principally for sexual arousal (s.236).

The Act then carves out text. Content that consists only of text falls outside Part 5’s regulated provider pornographic content (s.79(3) and (4)). It also falls outside Part 3’s primary priority content (s.61(6)). Images, video and audio stay inside.

What this means for your pages

Explicit text on a public page does not, on its own, trigger the UK age-check duty. The exemption names only text, or text with a non-pornographic GIF, emoji or symbol (s.79(4)). It does not mention explicit text beside photos. Ask counsel about that case. The risk sits in any pornographic image, video or audio a visitor can see before the check.

Ofcom’s placement blog of 14 January 2026 adds detail. Nothing pornographic may be visible before the check. Ofcom judges titles and captions in context. It names four types of gates: front, blur, image and in-video. It calls the front gate the safest approach. It says in-video gates may create more risk.

So text that sits beside gated media still needs care. A caption can change how a regulator reads the page around it.

Self-declaration fails everywhere

All three age-check regulators reject self-declaration. Ofcom does not accept it in the UK. The European Commission’s preliminary findings called it ineffective. In Australia, eSafety says clicking “I am 18” is no longer enough.

The SEO trade-off

Search engines may not be able to crawl media behind a gate, so gated media may not rank. Text-only pages, by contrast, sit outside the UK age-check duty. Strong public copy can therefore keep its search value.

Two points apply. First, Google’s explicit content guidelines say to let Googlebot crawl your content without the age gate. They say to verify Googlebot requests first (Google). Google warns that blocking it may cause your site to rank poorly. That advice covers search ranking only. It does not say whether the approach meets the UK age-check duty. Second, this reading covers UK law only. The DSA and the eSafety codes may treat text differently, and this guide does not assume they match.

This is a statutory interpretation. Counsel should confirm how it applies to your site.

Third-party age verification: what is on the table

This section outlines the main options. It names no best option and gives no prices.

Yoti is based in London. Its site lists facial age estimation, ID document checks and a digital ID wallet. It also lists credit card, mobile and email-based age estimation, among others. Yoti states that Ofcom recognises its methods as highly effective. That is Yoti’s own claim.

AgeChecked is a London company. Its site lists adult content, e-commerce, gambling, pharmaceutical and charity uses.

Apple’s account-based adult check is covered in the UK section. Its status for third-party operators remains unsettled.

EU blueprint apps and EUDI Wallets continue to emerge through 2026.

How to compare options

Four criteria help you compare vendors:

• Cost per check. What each verification costs at your volume.
• Friction. How many steps a user takes before access.
• Privacy design. Whether the verifier stores data or uses selective disclosure.
• Regulator acceptance. Whether the method meets the standard in each market you serve.

Caveats

A demo version of the EU app fell to a two-minute bypass in April 2026.

On 3 October 2025, Discord said an attacker had compromised a third-party support vendor. Its update on 9 October said about 70,000 users may have had ID photos exposed.

Treat vendor choice as ongoing due diligence. Ask each vendor what it stores, for how long and who can reach it.

VPN traffic, Cloudflare and the technical reality

Adult-sector sites have long blocked VPN and Tor traffic at the firewall. Attack volumes, scraping and fraud drove the habit. That habit now meets age-check rules that differ by market.

The UK position

Ofcom’s guidance says services must take appropriate steps against circumvention that children can easily use. It says services should not publish content that directs or encourages UK users to get round the checks. Its example is information about, or links to, a VPN. The guidance does not require a service to block all VPN traffic. Ofcom’s 29 October 2026 assessment of age checks for under-16s says no method fully resists circumvention. It says services will need to take practical steps to address attempts to bypass checks.

The Australian position

eSafety expects providers to detect VPN use and take reasonable steps against workarounds. One rule cannot fit both markets.

Challenge or block

The choice between challenging and blocking VPN traffic is a trade-off. No single rule settles it. Web application firewalls such as Cloudflare’s let you challenge traffic instead of blocking it.

Blanket blocking removes some compliance risk. It also shuts out legitimate users and costs revenue. A challenge step lets legitimate users through and stops bots.

Many VPN users are privacy-conscious adults. A blanket block treats them as suspects.

Verified search engine bots must pass any VPN rule. If they cannot, indexing breaks.

Tor is a separate case. Operators commonly block Tor traffic, and that is a defensible choice.

Two systems, side by side

VPN handling and age verification are separate systems. A user who passes a VPN challenge still needs an age check before seeing pornographic content.

This section explains principles. It gives no configuration steps. Ask a qualified technical reviewer to check any firewall change.

What to do now: a decision framework

Work through these steps in order. Each one builds on the last.

1. Audit your jurisdiction exposure. List where your users are, where your business is legally based, where you host and where you market. Each answer changes which regimes apply.
2. Audit your content. Check which images, video and audio a visitor can see before any check. In the UK, text-only content sits under different rules. Decide whether Part 5 or Part 3 applies to you.
3. Decide your posture. Choose from the three options set out for independent providers above.
4. Choose a vendor if you need one. Use the four criteria in the vendor section. Treat the choice as ongoing.
5. Review your technical set-up. Check gate placement, VPN handling and how crawlers reach gated areas. Set robots rules deliberately. Decide what stays indexable.
6. Document your position. Part 5 providers must keep a written record of their assessment. They must also publish a summary of it (s.81(4) and (5)). In any other case, keep a short internal memo.
7. Get legal advice. Brief a qualified solicitor in your home jurisdiction and in each major market. This guide is strategic guidance, not legal advice.
8. Revisit in six months. Watch for the Commission’s final decisions on the four platforms. Track the EUDI Wallet rollout, due by the end of 2026. Follow Ofcom’s Aylo investigation and any further Ofcom fines. Watch Australia’s next phases, the EU KIDS Act proposal and any regulations under the new section 217A power.

Age checks affect your site build, hosting, page content, and search visibility. Our in-house team covers all four.

We have spent over ten years building, hosting, ranking and securing sites for escort agencies, tantric providers, directories and luxury adult ecommerce brands. We know how these rules meet the technical and commercial side of running an adult site.

If you want to talk through your own position, ask us. We will tell you what applies to you, what it would cost and whether you need us at all.