pleenk
enfrespt
Book a demo
← Blog
pt-brfresende

Ofcom's 2026 fines: age checks are no longer enough, you have to be able to prove them

Published 16 October 2026Updated 3 November 20267 min readBy Pleenk Approve

Ofcom's 2026 fines: age checks are no longer enough, you have to be able to prove them

You are the compliance lead of an adult platform. Your age check is in place, your provider is reputable and your internal tests pass. Then one morning Ofcom, the UK's communications and online safety regulator, sends you a formal information request. It wants to know how your system works, since when, and with what results. It also asks which tests you ran before going live. And it gives you a deadline.

That is the moment when many platforms lose their footing. The decisions Ofcom published in 2026 show it. In most cases, the fine does not only punish the lack of effective age checks. It also punishes the platform that could not answer the regulator properly. So the short answer is this. Your system must be effective. And you must be able to show it, quickly and in writing.

Let's look at what this year's fines teach us, and what we would do in your place.

What do Ofcom's 2026 decisions say?

The Online Safety Act (OSA) is the UK law on online safety. Since 25 July 2025, it has required "highly effective" age assurance from services that give access to pornography. The rule covers users in the United Kingdom. Ofcom has run a dedicated enforcement programme since then. Final decisions followed one another in 2026.

Decision dateProviderFine for ineffective age checksFine for poor answers to information requests
11 February 2026Kick Online Entertainment£800,000£30,000
20 February 20268579 LLC£1,350,000£50,000
26 May 2026Youngtek Solutions£500,000£100,000
8 July 2026Fapello£600,000£30,000
3 September 2026Xgroovy£700,000£30,000, plus £200 per day of delay

At the end of September, Ofcom targeted two more providers. It sent them a provisional notice, meaning a notice of breach before the final decision. These notices cover both age checks and information requests. The legal ceiling remains a strong deterrent: up to £18 million or 10% of qualifying worldwide revenue, whichever is higher.

Two lessons stand out. First, the fine for not answering comes back almost every time. Second, Ofcom can add a daily penalty for as long as the information is missing. In other words, the regulator treats silence or vague answers as a breach in its own right.

Why does your answer matter as much as the check itself?

Put yourself in Ofcom's shoes. The regulator cannot test every journey on every site itself. So it relies on what you send it. It expects a description of the system and of the methods used. It also expects pass and fail rates, the deployment date and the tests carried out. If these are missing or late, Ofcom cannot conclude that your check is effective. So it sanctions the fact that it cannot verify it.

Your acquirer or your PSP reasons the same way. The PSP is the provider that lets you accept card payments. The acquirer is the bank behind it. For them, a written policy proves nothing. What counts is the record: who was verified, when, with which method and with what result. And which decision followed. If you can answer your PSP in a few minutes, you can probably answer a regulator.

What we would do: prepare today an up-to-date "regulator file", reviewed every quarter. It contains a clear description of the system, the list of providers and the verification statistics. It also holds the history of changes. Finally, it names one person in charge of answering the authorities, with a deputy.

Can you rely on an age signal from a third party?

That question is at the heart of the investigation Ofcom opened on 22 September 2026. It targets Aylo, the company behind Pornhub. In May 2026, Pornhub launched a new journey for some of its UK users. This journey relies on signals from Apple. These signals indicate that a user may have passed Apple's age checks.

Ofcom is not judging Apple's checks. It is looking at two things. Did Aylo carry out enough checks and tests before launching this journey? And did Aylo properly carry out the mandatory children's access assessment? The regulator restates a key principle. It is the service provider that must guarantee highly effective assurance, not a third party. And that holds at every step of the journey.

For you, the lesson is very concrete. Before any significant change to your system, document your tests. That applies to a new provider, a new method or a simplified journey to improve conversion. Update your children's access assessment as well. And keep proof that you did it before going live, not after.

And in France, is Arcom taking the same road?

The framework is different, but the direction is the same. France's SREN law of 21 May 2024 aims to secure and regulate the digital space. Since January 2025, it has required publishers of pornographic content to prevent access by minors. They must follow the technical standard of Arcom, the French audiovisual and digital regulator.

In February 2026, Arcom announced a change of target. It is now focusing less on the most visited services and more on smaller sites. At the end of July 2026, it opened proceedings against 31 sites. Thirteen of them had no verification system and no known country of establishment. For these 13 sites, Arcom asked internet providers and search engines to act within 48 hours. They had to block these sites or remove them from search results. Five other sites received a letter of observations. They had 15 days to explain themselves.

The message is clear: being a "small" player no longer protects you. And the time to answer is short. Here again, the platform whose file is ready saves precious time.

What we would do as a compliance lead today

List your obligations country by country. United Kingdom, France, US states, European Union: accepted methods and authorities differ. If you know what each market expects, you do not discover the gap on the day of an information request. Some sanctioned providers ended up blocking access from the United Kingdom. That is a heavy business decision. Better to prepare it in advance than to take it under pressure.

Treat every request from a regulator as a priority incident. Note the deadline and name an owner. Have a lawyer validate the answer and keep proof that it was sent. The fines for not answering show that a vague answer is expensive.

Document any change to the journey before deploying it. Keep the tests, the results, the updated children's access assessment and the signed decision. That is exactly what Ofcom is examining in its latest investigation.

Measure how effective the check is, not just that it exists. Track the failure rate, bypass attempts and blocked accounts. A system that exists but lets too many people through is not "highly effective".

Do not store ID documents yourself. You must prove that verification took place, not keep the documents. The result and the record are enough. And you greatly reduce your risk under the GDPR, the European data protection regulation.

Bring your regulator file and your PSP file together. They are often the same evidence. Keep them up to date in one place. You will avoid answering twice with different versions.

How Pleenk Approve can help

Pleenk Approve runs your compliance policy. At its core is a single digital identity. Every creator, co-performer, agency or affiliate is verified with a liveness check. Their identity is encrypted by Pleenk and stored in a single wallet: you receive proof, never the ID document, in line with the GDPR. Everything is linked to that wallet: their accounts, their consents, the bank account that receives their earnings and any bans. Pleenk also verifies your visitors' age. Your moderation remains yours: Pleenk connects to your AI moderation tool and keeps proof of it. Every verification is dated, and you can export the evidence for your PSP, your bank or a regulator. Pleenk does not replace your lawyer or your own analysis of each country's obligations.

Are you preparing an answer to a regulator, or do you want to be ready before one arrives? Write to us at contact@pleenk.com.

This article is for information only and does not constitute legal advice. Regulations and regulators' practices change. Have your choices validated by your lawyer.

Sources

More articles
9 November 2026 · 8 min read
Human trafficking and cam studios: what a live streaming platform must check
6 November 2026 · 7 min read
Ofcom is investigating two adult services over non-consensual intimate images: what a PSP should ask its merchants
4 November 2026 · 7 min read
When an agency runs a creator's account: what your platform needs to control