Britain’s online age-verification regime is reducing access to compliant pornography services, but evidence from Ofcom and major operators points to an awkward side effect: some users are moving towards sites that have not introduced the required checks.

Aylo, the owner of Pornhub, says its UK traffic has fallen sharply following mandatory age assurance, while arguing that non-compliant services are benefiting from demand displaced elsewhere. The criticism is consistent with evidence Ofcom published in July, when the regulator acknowledged that sites introducing age checks had experienced substantial traffic declines while some services without equivalent controls had become more popular.

The disagreement is therefore less about whether checks alter behaviour than about where that behaviour goes next. Britain’s Online Safety Act requires pornography services to use what Ofcom defines as highly effective age assurance, but the policy operates differently when one site complies and a competing service remains accessible without comparable friction.

Ofcom says all ten of the UK’s most popular pornography services and 64 of the top 100 had introduced age assurance by June, while another ten had blocked British users. A sizeable tail of smaller providers remains, including services capable of gaining traffic quickly after larger competitors introduce controls.

Compliance changes the shape of the market

Online regulation often assumes that changing the behaviour of the largest platforms will materially alter overall exposure. That works most effectively where a market is concentrated and alternatives are difficult to find; websites are easier to switch between, and search services can direct users towards providers outside the group regulators initially targeted.

Ofcom’s research shows signs of that movement. Only a minority of children in its monitoring study attempted to access pornography, while a substantial proportion encountered services with age checks in place. Many visits were brief, which the regulator said may reflect users moving rapidly between sites while looking for access.

The same economic effect applies to adults. Adding an identity, facial-estimation, credit-card, mobile-network, or other verification step introduces friction that does not exist on a non-compliant competitor.

Where the underlying content is readily substitutable, some users will respond by taking the route requiring fewer steps rather than completing verification. That produces an unusual competitive consequence: companies spending money to comply can lose traffic to operators that have not incurred the same implementation costs.

Enforcement speed therefore becomes part of whether the compliant market remains commercially sustainable. Ofcom says it is analysing thousands of adult services to identify shifts in popularity and emerging non-compliant providers, while its enforcement programme has opened 23 investigations into providers responsible for 88 services.

The regulator says 73% of those services subsequently either implemented age assurance or blocked access from Britain. Financial penalties against several providers also show that the regime has moved beyond guidance into active enforcement.

Age assurance remains a systems problem

The regime does not prescribe one verification technology. Ofcom permits methods including facial age estimation, photo-identification matching, open banking, mobile-network checks, credit-card verification, and digital identity services where they meet requirements around accuracy, robustness, reliability, and fairness.

That technology-neutral approach gives operators flexibility, but implementation varies considerably. Some methods introduce more friction than others, while privacy consequences depend on what personal information is collected, where it is processed, and whether the content service itself sees identity data.

The Information Commissioner’s Office has separately stressed that child protection and privacy have to be met together rather than traded against one another. Providers cannot resolve one regulatory requirement by introducing disproportionate data collection for another.

Device-level age signals are being discussed as an alternative because they could allow a person to establish an age status once and pass an assurance signal to different services without repeatedly submitting personal information.

Moving the check lower in the technology stack could reduce repeated verification, although it would place more responsibility on operating-system providers, app stores, identity companies, and device manufacturers. Regulators would then have to determine how reliable those signals must be and what services should do when they are unavailable.

Enforcement determines whether friction works

The regime remains young, and Ofcom’s early reporting stops short of a definitive judgement on effectiveness. Its evidence nevertheless suggests that strong age checks can deter access and create meaningful barriers at compliant services.

The harder measure is whether exposure falls across the wider market rather than migrating elsewhere. If regulated providers lose users while services ignoring the rules acquire them, the legal obligation may work at individual sites while producing weaker results across the system.

Search engines, VPNs, overseas hosting, changing domains, and a long tail of smaller providers make that enforcement problem more difficult than supervising a few large domestic companies. Ofcom has powers to pursue non-compliant services, but the durability of each intervention will depend on how quickly it can identify new destinations receiving displaced traffic.

The regime therefore creates a continuing market-monitoring task rather than a one-off compliance deadline. Regulators need visibility into where users move, while compliant businesses need confidence that ignoring the rules will not become a durable competitive advantage.

Age assurance can place a meaningful barrier between children and restricted material, and Ofcom’s early evidence indicates that it already does so in many cases. The first year of enforcement is also showing that adding friction to one part of the internet does not remove demand; enforcement has to follow that demand if regulation is to change the market rather than merely rearrange it.