On 16th January 2025, Ofcom released guidance on age assurance criteria for adult content providers under the UK’s Online Safety Act (OSA). Pornography websites, starting with sites that publish their own content, must now show how they are protecting children from adult material online. Other platforms, including content aggregators and user-generated platforms, have until July to comply.
The new requirements demonstrate that users accessing pornography in the UK won’t need to upload ID documents. Instead, innovative methods like email-based age estimation can be used to determine age with minimal disruption.
This blog outlines the key details of Ofcom’s guidance and highlights why email address age estimation is emerging as a leading solution.
The OSA: A recap
The UK’s OSA introduces rules to ensure children are protected from harmful online content, including pornography. Ofcom, the UK’s online safety regulator, divides online pornography services into two categories:
- Part 5 Services: Platforms that publish their own pornographic content, such as studios, pay sites, where operators control the material available.
- Part 3 Services: Platforms hosting user-generated content, such as tube sites, cam sites, fan platforms.
Implementation timelines and requirements
Here’s a breakdown of what services are required to do, and by when:
From January:
Part 5 Services:
- Platforms that publish their own pornographic content (Part 5 services) must take steps to start introducing highly effective age assurance measures immediately in line with Ofcom’s guidance.
Part 3 Services:
- Sites that allow user-generated pornographic content (Part 3 services) must carry out assessments to confirm whether under-18s can access content on their platforms, according to Ofcom’s children’s access assessments guidance, which has been published this January.
- Note: Unless sites are already using highly effective age assurance to prevent children from accessing pornography, we expect them to be caught by all the child safety duties – including age assurance requirements – which will be published in April 2025.
- Additionally:
- December 2024: Part 3 services will be expected to start taking steps to comply with their duties to protect people from illegal content from December 2024. Services will have three months to complete an “Illegal Content Risk Assessment”, writing down which measures they are taking or plan to take. Services should, therefore, be prepared to implement measures to tackle illegal harms starting in April 2025.
- April 2025: Ofcom will publish their Protection of Children Codes and children’s risk assessment guidance. This means that services that are likely to be accessed by children will need to conduct a children’s risk assessment by July 2025 – that is, within three months. Following this, they will need to implement measures to protect children on their services, in line with the Protection of Children Codes to address the risks of harm identified. These measures may include introducing age checks to determine which of their users are under-18 and protect them from harmful content.
This means that by July 2025, all services that allow pornography must have a highly effective age assurance solution in place to protect under-18s. This is the case for both services publishing their own pornographic content or allowing user-generated pornographic content.
Ofcom’s guidance sets out to ensure the adult industry is aware of the upcoming requirements and has the information it needs to comply. Alongside the guidance published, Ofcom has opened an Age Assurance Enforcement Programme to monitor compliance effectively. As part of this initiative, Ofcom is contacting all relevant services, requesting confirmation of their compliance measures by March 5th. They also remind services of the potential sanctions for non compliance. This proactive approach highlights Ofcom’s commitment to enforcement and marks a significant step forward in upholding regulatory standards.
What is “highly effective” age assurance?
Ofcom’s guidance emphasises four key criteria for highly effective age assurance methods. Solutions must be:
- Technically Accurate
- Robust
- Reliable
- Fair
Methods considered capable of meeting these criteria include:
- Email-based age estimation
- Open banking
- Photo ID matching
- Facial age estimation
- Mobile network operator age checks
- Credit card checks
- Digital identity services
Ofcom has made it clear that outdated methods such as self-declaration are no longer acceptable.
For adult content providers, robust age assurance is critical to ensuring legal compliance with ever-evolving regulations, safeguarding minors from inappropriate content and protecting the privacy of adults wishing to view adult content. The challenge for sites looking to protect their business lies in implementing age assurance methods that are both effective and provide a seamless user experience. Traditional age verification methods, such as ID scans, often involve significant friction and have resulted in reduced revenue for the site, as well as detering legitimate users, often leading them to seek less reputable alternatives where no methods in place.
Therefore, when it comes to age assurance, an emphasis is needed on minimal friction so adult sites can implement methods that vastly improve user experience and reduce drop-off rates.
Why email-based age estimation stands out for adult content providers
Among Ofcom’s approved methods, email-based age estimation, pioneered by Verifymy, offers a fast, privacy-preserving, and inclusive solution. Here’s why adult content providers and users alike are increasingly opting for email-based age checks:
In Ofcom terms, email-based age estimation fits the 4 criteria age assurance methods must meet to be deemed highly effective.
Technically Accurate
Email address age estimation uses just an email address to determine a user’s age with a very high degree of accuracy. The Age Check Certification Scheme certifies email address age estimation under PAS 1296:2018 to EAL 3, the highest possible level for age estimation.
The solution is highly accurate, as demonstrated by the ACCS EAL level 3 test audit, which returned 0 (zero) false positive results at +/-18, meaning no children were incorrectly estimated to be adults.
Robust
Email address age estimation is robust. To prevent users from attempting to circumvent it, the method includes an anti-spoofing mechanic to prevent someone from attempting to complete an age check with someone else’s email address. A time-sensitive One Time Password (OTP) is sent to that email account and the user must retrieve it to demonstrate they are the owner of that email address.
Reliable
Email address age estimation aligns with Ofcom’s definition of reliability as it leverages underlying data points rooted in strong digital identity verification, such as those from banks and mortgage lenders. Our system utilises trustworthy third-party databases to deliver consistent and accurate results. Rigorous testing is conducted on these data sources to ensure their reliability, which in turn supports the dependability of our mechanisms.
Fair
Email address age estimation is fair, fully accessible and widely available, given that 99.94% of regular online users have an active email address. It can be used by anyone with an active email address, irrespective of gender, race, ethnicity, sexuality or any other discriminatory trait, and it operates without risk of material bias.
A seamless solution for businesses
As well as the four criteria listed above, email-based age estimation is commercially viable. User data from our adult customers across the US, UK and France shows that 73% of users choose email address when presented alongside an ID scan and a facial age estimation check – a clear indication that it is the method they feel most comfortable using to prove their age
It is also fast and inclusive, given that 99.94% of regular online users have an active email address. Where services collect an email as part of operating their service, a check can be completed without any additional data being submitted and with no impact on user experience. Proving a user’s age to access a pornography site can be entirely free of friction.
In addition to email-based age estimation, Verifymy’s range of age assurance methods, such as photo ID matching, facial age estimation, mobile network operator age checks and credit card checks, meet Ofcom’s requirements. Find out more about our age verification and estimation solutions.
Email-based age estimation delivers a frictionless user experience, reducing the risk of conversion drops and minimising business disruption. Built with privacy-by-design principles, it’s a quick and reliable way to verify age without compromising user trust.
Conclusion
The OSA represents a major shift in online safety, and Ofcom’s guidance sets the stage for meaningful change. With email-based age estimation leading the way, pornography websites can achieve compliance while delivering a seamless, privacy-focused experience for users.
Lina Ghazal, Head of Regulatory and Public Affairs at Verifymy, comments:
“As the Online Safety Act rolls out, 2025 must be a year where regulatory talk turns to action and only effective implementation will drive real-world results.
“At Verifymy, we are giving platforms the tools they need to meet these regulatory requirements head-on. We will continue to work with adult content providers to educate and reassure users on the importance of privacy-preserving methods that safeguard minors from inappropriate content while protecting the privacy of adults wishing to view adult content.”
Get in touch to learn more about Verifymy’s full range of age assurance solutions and how we can help your platform stay ahead of the curve.
