By Yair Cohen, Solicitor specialising in internet and media law

Online Safety Act age verification for adult content creators

What Part 5 of the Online Safety Act 2023 requires if you publish your own adult content

If you publish your own pornographic content on a service that people in the UK can use, you have a legal duty to stop children encountering it, using highly effective age verification or age estimation. That duty comes from Part 5 of the Online Safety Act 2023, it has applied since 17 January 2025, and it covers audio as well as images and video. It is enforced by Ofcom, which can impose penalties of up to £18 million or 10% of qualifying worldwide revenue. This guide explains who the duty falls on, what "highly effective" means in practice, and the written record you are expected to keep.

The first thing to understand is what this regime is and is not. It is a compliance duty about who can reach adult content, not a ban on any kind of content. Nothing in Part 5 makes your work unlawful. It asks you to put a proper age check in front of it. A creator whose audience is fully age-verified is compliant, whatever the content is. We act for creators and performers who want to get this right without over-engineering it, and the practical answer is usually more straightforward than the headlines suggest.

Who the duty applies to

The duty applies to you if you publish your own pornographic content on an internet service that has links to the UK, which in practice means a UK audience or a service capable of being used here. Part 5 was written to catch providers who publish pornographic content directly, including individual creators who run their own site, store or channel, not only large platforms. If you sell or give away adult content through your own website, your own subscription page, or any channel you control, you should assume the duty is capable of applying to you.

Where you post on someone else's platform, the position shares out differently. Large user-to-user platforms carry their own duties under other parts of the Act, and a compliant platform will handle age assurance at its level. But you cannot simply assume that; if you run any channel of your own, the responsibility for age-checking that channel is yours.

Audio is covered, text is not

A point that catches audio creators by surprise: the age-verification duty covers sound, not just pictures. Part 5 defines pornographic content by reference to content that is "visible or audible", and it exempts text-only content. So written erotica sits outside the duty, but pornographic audio sits inside it, exactly like video. If your catalogue is audio, you cannot treat the age rules as a video-only problem.

What "highly effective" age assurance means

The standard is not a tick-box "are you 18?" button, it is age assurance that is highly effective at telling whether a user is a child. The Act requires the age check to be highly effective at correctly working out whether a particular user is a child, and Ofcom has set out the kinds of methods that can meet that standard. In broad terms, self-declaration and a simple card-payment gate on their own are not treated as highly effective, while methods such as verified photo-ID checks, facial age estimation, credit-card checks with proper verification, mobile-network age checks, and digital identity services are the sort of measures that can meet it. The right choice depends on your platform and your audience, and Ofcom's guidance is the reference point to design against.

Two practical points follow. First, the check has to sit in front of the content, so a user cannot normally reach the pornographic material without passing it, including at the preview or sample layer. Second, this is an area where using an established third-party age-assurance provider is often the sensible route, because they are built to Ofcom's standard and update as it changes.

The written record you must keep

Part 5 does not only require you to run age checks, it requires you to keep a written record of the age-assurance methods you use and how they meet the standard. This is easy to overlook and easy to fix. Keep a short, dated document that sets out which method or provider you use, why it meets the highly-effective standard, and when you last reviewed it. If Ofcom ever asks, that record is the difference between showing a considered compliance approach and scrambling after the fact.

What Ofcom can do

The enforcement behind this is serious, which is why it is worth getting right early. Ofcom can investigate, require information, and impose penalties of up to £18 million or 10% of qualifying worldwide revenue, whichever is higher. It can also pursue business-disruption measures in the most serious cases. The regulator has signalled that adult-content age assurance is a priority area, so the realistic expectation is active enforcement rather than a dormant duty.

How this fits with the rest of the law

Getting age verification right does more than satisfy Ofcom, it strengthens your position across the board. A properly age-verified audience also satisfies the CPS condition that the likely audience is not under 18, which is one of the conditions that keeps adult content out of the "likely to be obscene" category under the Obscene Publications Act 1959. In other words, the same age wall that keeps you compliant with the Online Safety Act also helps your position if the content of the material is ever questioned. We explain that wider picture in our guide on whether audio pornography is legal in the UK.

The one thing age verification does not do is change what the content depicts. It answers the "who can see it" question completely, but it does not, by itself, answer the separate question of whether the most extreme material is obscene. For that, format, audience size and content design still matter, which is why age verification is one layer of a sensible approach rather than the whole of it.

A practical checklist

For most creators running their own channel, compliance comes down to a short list. Put highly effective age assurance in front of all your adult content, including previews and samples. Choose a method that matches Ofcom's guidance, and lean on an established provider if that is simpler. Make sure nothing pornographic is reachable before the check. Keep a dated written record of the method and why it meets the standard, and review it periodically. And keep the extreme end of your catalogue behind that wall without exception. None of this is exotic, and most of it is a one-time setup with an occasional review.

Frequently asked questions

Does the age-verification duty apply to me as an individual creator? If you publish your own adult content on a channel you control that UK users can reach, you should assume it does. Part 5 was written to catch providers who publish pornographic content directly, not only large platforms.

Is a credit-card check or an "I am 18" button enough? On their own, generally not. The standard is age assurance that is highly effective at identifying children, and Ofcom's guidance points to stronger methods such as verified ID, facial age estimation and proper digital identity checks.

My content is audio only. Am I exempt? No. Text-only content is exempt, but audio is treated like video. If UK users can reach your pornographic audio, the duty applies.

What happens if I do nothing? Ofcom can investigate and impose penalties up to £18 million or 10% of qualifying worldwide revenue, and can seek business-disruption measures in serious cases. Adult-content age assurance is an enforcement priority.

Is this legal advice? No, it is general legal information for adult content creators. The right age-assurance setup depends on your platform and audience, so take advice on your specific situation before relying on it.