LONDON — The United Kingdom’s House of Lords has launched a formal inquiry into the effectiveness of age verification enforcement under the Online Safety Act (OSA) of 2023, following reports of data breaches from age and identity verification vendors and concerns about the legislation’s practical impact. This inquiry, announced on Monday by the Lords Communications and Digital Committee, marks a significant shift as lawmakers question whether the compliance mechanisms themselves are flawed, rather than solely focusing on the enforcement pace by the digital regulator Ofcom.
The move comes despite Ofcom’s recent report indicating an “unprecedented scale” of age checks across various online sectors, including adult entertainment. Ofcom, which began deploying its age verification enforcement mechanisms last year, has investigated dozens of allegedly noncompliant adult entertainment platforms and collected hundreds of millions of dollars from tech platforms, many based in the United States. However, Baroness Barbara Keeley, a Labour Party MP and chair of the Lords Communications and Digital Committee, stated that it is "now clear that the Act is not working as well as it should." The committee has issued a "call for evidence" to stakeholders from domestic and international industries, including adult entertainment, with a deadline for written submissions set for 5 pm (UTC/GMT +1) on Monday, September 7.
Are Age Verification Mechanisms Failing?
The inquiry was prompted by a documented history of data breaches affecting age and identity verification vendors, including one suffered by a vendor for Discord. Such incidents raise critical questions for adult industry platforms regarding the security and privacy of sensitive user data. The Online Safety Act requires robust age checks for sites with content "restricted to adults," a scope extending beyond pornography to include non-explicit content. Platforms typically implement verification through methods such as payment card entry, government-issued ID uploads, selfies, or data-driven age estimation. Most rely on third-party services, such as Bluesky using Epic Games-owned Kids Web Services, Reddit working with Persona, and Discord partnering with k-ID.
These diverse approaches have led to a lack of standardization in age verification, creating what Cody Venzke, senior policy counsel at the American Civil Liberties Union, described as a "privacy nightmare." While some age verification platforms, like Persona, promise to erase data after a set period, such as seven days for Reddit verification, there is no universal guarantee across all services. The risk of security breaches remains substantial, as evidenced by a 2025 report by 404 Media detailing how AU10TIX, an identity verification solution used by TikTok, Uber, and X, left user information and driver’s license photos exposed for months. For adult industry platforms, which handle highly sensitive user information, these security vulnerabilities are particularly concerning, potentially exposing users to significant privacy risks and platforms to severe reputational damage and regulatory penalties.
What Are the Technical and Operational Challenges for Platforms?
Ofcom’s first annual report on age verification usage and adoption, released earlier this summer, highlighted both progress and persistent challenges. Between July 2025 and January 2026, the proportion of children encountering "highly effective age checks" increased from 25 to 43 percent. From July to December 2025, 69 million age checks were completed across a sample of 32 services, a 23-fold increase over the preceding six months. The report noted that all of the UK's top 10 porn sites and 64 out of the top 100 most popular porn sites in the country had installed age assurance as of June 2026, with 10 having geo-blocked UK users. Despite these efforts, Ofcom stated that "too many porn sites still don’t have age checks in place" and has opened 23 investigations into providers of 88 adult services.
A significant operational challenge identified by Ofcom is the discoverability of non-compliant sites through search engines. The report found that one-third (33 percent) of Google Search results on the first page for adult content were porn sites without age checks or geo-blocking, a figure that rose to 54 percent for Bing results. While Google and Bing are reportedly working with Ofcom to address this, the Online Safety Act does not mandate age assurance for search providers. This highlights a critical technical gap: even if individual platforms implement robust age verification, the broader digital ecosystem can undermine their efforts if search and discovery mechanisms do not integrate similar safeguards. For adult entertainment platforms, this means that even compliant services may struggle to prevent minors from accessing content if non-compliant alternatives remain easily discoverable, creating an uneven playing field and complicating enforcement.
Does Age Verification Create an Identity Mandate for All Users?
The implementation of age verification under the Online Safety Act has broader implications for all online users, not just minors. David Inserra, a fellow for free expression and technology at the Cato Institute, noted that to verify the age of children, platforms must verify the age of everyone, effectively turning a child-safety law into an identity mandate for the entire user base, including adults. This necessitates that platforms collect identifying information from all users before they can determine who is underage.
The Electronic Frontier Foundation (EFF) has voiced significant concerns regarding data privacy and free expression. Paige Collings, EFF's senior speech and privacy activist, stated in August 2025 that the Online Safety Act "is a threat to the privacy of users, restricts free expression by arbitrating speech online, exposes users to algorithmic discrimination through face checks, and leaves millions of people without a personal device or form of identification excluded from accessing the internet." This suggests that the current technical approaches to age verification may inadvertently create barriers to access for some adult users while simultaneously increasing the data collection burden and privacy risks for all. The inquiry will assess whether there are shortcomings in the OSA itself that limit its effectiveness and identify what further action may be required from the government, Ofcom, providers of regulated services, or Parliament to drive improvements.
What Are Industry Stakeholders Saying About the Act's Efficacy?
Industry stakeholders are actively engaging with the House of Lords inquiry, reflecting a range of perspectives on the Online Safety Act's implementation and impact. Iain Corby, executive director of the AVPA, welcomed the inquiry, agreeing with Baroness Keeley's view that "any law is only as good as its enforcement." Corby emphasized the need for Ofcom to create a "level playing field by enforcing at scale" and suggested that recommendations to accelerate the impact of the existing law would have a more immediate effect than focusing solely on legislative changes.
Conversely, the Free Speech Coalition (FSC), an adult industry trade group, intends to submit evidence highlighting the Act's limitations. Alison Boden, executive director of the FSC, stated that in the year since the Act went into effect, some adult platforms have faced "overly aggressive enforcement by Ofcom despite making good faith efforts to comply," while "some of the worst actors have exposed limitations of one country’s ability to police the entire internet." Corey Silverstein, an attorney specializing in the online adult entertainment industry, also welcomed the inquiry, stressing that while protecting children online is important, the effectiveness of the law and the harms it imposes on law-abiding adults must be scrutinized. Silverstein hopes the inquiry will lead to an "evidence-based reassessment of age-verification mandates" that protects both child safety and adult privacy, preventing other jurisdictions from repeating similar mistakes.
