The United Kingdom's Online Safety Act took full effect on 25 July 2025, requiring adult sites to verify that users are over 18.
Aylo, which operates Pornhub, did not build a verification flow for the UK market. It blocked unverified UK users instead. As of 2 February 2026, only accounts verified before the cut-off retain access. The company reported that UK traffic fell roughly 77%.
That decision is the most informative data point in the sector this year, and it has a direct investment reading.
What the numbers say
| Signal | Figure |
|---|---|
| Reported UK traffic decline | ~77% |
| Daily age checks triggered | 5M+ |
| US states where access is blocked | ~25 |
| VPN response | spiked, then plateaued (per Ofcom) |
The blocked states include Texas, Florida, Georgia, Utah, Tennessee, Virginia and West Virginia, where the law took effect on 12 June 2026. Louisiana is the exception that proves the rule: access continues there through verification rather than a block. Ohio also remains accessible, because of how its statute is drafted.
The revealed preference
A company facing a 77% traffic loss in a major market chose that loss over compliance. That choice tells you the compliance cost — not just in engineering, but in liability for holding identity documents and in conversion lost at the door — was judged higher than losing three-quarters of a national audience.
Two conclusions follow.
Verification is expensive in a way that is not obvious from outside. The technology is not the hard part. Storing or processing identity data creates a liability surface that a content business does not otherwise carry, and every additional step at the door costs conversion.
Geoblocking is now a normal strategic option. The industry treats jurisdictions as optional markets, which means legislative risk translates into revenue loss rather than compliance spending. For anyone underwriting a business in this space, the correct model is not "compliance costs rise" — it is "individual markets can go to zero on a legislative calendar."
Where the growth actually is
Five million age checks a day is a market that did not exist three years ago, and it is mandated rather than discretionary.
The buyers of that service are not only adult sites. Age-assurance obligations are spreading into social platforms, gaming, alcohol and gambling retail, and general-purpose app stores. The vendors serving those checks are the clearest beneficiaries of the entire regulatory wave: volume scales with legislation, and legislation is moving in one direction.
The second-order beneficiary is scale itself. When compliance carries a fixed cost, the platforms able to absorb it consolidate share from those that cannot. This is the standard pattern of heavy regulation in any industry — it entrenches incumbents while presenting as consumer protection.
The trade, stated plainly
Owning adult content businesses through this transition means underwriting revenue that a legislature can remove market by market. Owning the compliance layer means selling to whoever survives, on volumes that rise as the rules spread.
The second is the better risk-adjusted position, and it is available in listed form — identity and verification vendors, and payment processors specialising in high-risk merchants — while the content side largely is not.
What to watch next
Whether verification becomes device-level. If operating systems or app stores supply an age signal, the per-site check largely disappears and the current vendor volumes compress. That is the main threat to the compliance-layer thesis.
Whether blocked markets stay blocked. A reversal — an operator accepting verification in the UK or in Texas — would signal that the cost calculus has shifted and the traffic loss proved intolerable.
Whether the rules cross into mainstream platforms at scale. That is where the addressable market multiplies, and it is the difference between a niche compliance business and an infrastructure one.