What actually changed
For most of the internet's history, the age check on an adult site was a button. You clicked "I am 18 or older", the site took your word for it, and that was the entire system. Two separate legal machines have now retired that button in two of the largest markets for online adult content.
In the United Kingdom, the Online Safety Act 2023 obliges services that allow pornographic content to use highly effective age assurance. The duty applied from 25 July 2025, and it is enforced by Ofcom, the UK communications regulator, which has since issued fines.
In the United States, the route was judicial rather than regulatory. On 27 June 2025, the Supreme Court decided Free Speech Coalition, Inc. v. Paxton by 6-3, upholding a Texas age-verification statute. That ruling removed the main constitutional obstacle that had held similar state laws back.
The important thing to understand is that these are rules about access, not about content. Neither system tells a studio what it may film or a site what it may host. They govern who is allowed to get in.
What "highly effective age assurance" means
The UK standard is not satisfied by asking. Ofcom assesses an age-assurance method against four criteria: it must be technically accurate (it correctly determines age under test conditions), robust (it still works in real deployment), reliable (its output is reproducible and comes from trustworthy evidence), and fair (it avoids or minimises bias and discriminatory outcomes).
Ofcom has named methods that are capable of meeting that bar, including:
- Photo-ID matching - you upload an identity document and a selfie, and the two are compared.
- Facial age estimation - software estimates your age from a live image, without identifying you by name.
- Open banking - with your consent, your bank confirms you are over 18 without disclosing your balance or transactions.
- Mobile-network operator checks - your carrier confirms the adult filter on your line is lifted.
- Credit card checks - the card itself is age-restricted at issue.
- Digital identity services, including digital identity wallets.
- Email-based age estimation - inference from how an address has been used elsewhere.
What does not qualify is just as important. Self-declaration does not count. A date-of-birth field with nothing behind it, or a button asserting you are an adult, fails the criteria - it is trivially defeated by anyone willing to type a different year. This is the single change most visible to readers: the honour system is no longer a lawful control in the UK.
Note that a method being capable of being highly effective is not the same as any given implementation being acceptable. Ofcom fined one operator whose photo-upload check lacked liveness detection, meaning a child could hold up a photograph of an adult and pass.
How the UK enforces it
The enforcement is real, and the ceiling is high. Ofcom can impose penalties of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater. "Qualifying worldwide revenue" is a defined statutory term, not simply a company's global turnover - press summaries often blur this.
Two decisions show how it works in practice:
- AVS Group Ltd was fined £1 million in a decision dated 4 December 2025 for failing to deploy highly effective age assurance, plus £50,000 for failing to respond to a statutory information request. Ofcom also imposed daily penalties for continued non-compliance.
- Itai Tech Ltd, operator of a "nudification" service, was fined £50,000 in November 2025 over age-check failures, with a further £5,000 for not complying with an information request.
The pattern worth noticing is that failing to answer the regulator is penalised separately from the underlying breach. Ignoring the letter is its own offence.
The American route: one ruling, many states
The US arrived at a similar destination by a different road. Texas House Bill 1181 requires a commercial entity to verify age where more than one-third of the material it publishes or distributes on a site is "sexual material harmful to minors". The Free Speech Coalition, an adult-industry trade association, challenged it on First Amendment grounds.
In Free Speech Coalition, Inc. v. Paxton, decided 27 June 2025, the Supreme Court upheld the law 6-3. Justice Thomas wrote for the majority, applying intermediate scrutiny and reasoning that the statute only incidentally burdens adults' protected speech. Justice Kagan dissented, joined by Justices Sotomayor and Jackson, arguing that strict scrutiny should apply because the law directly burdens adults' access to protected material.
The practical consequence is a patchwork. Age verification in the US is state law, so the rules, thresholds and penalties differ by state, and the map keeps moving as statutes take effect. That is precisely why you should distrust any article - including the many that circulate on this topic - that quotes a confident count of states without a date attached. Reporting on the tally openly disagrees with itself.
Some large platforms responded not by verifying but by withdrawing, blocking their sites in states that passed such laws rather than deploy checks. The result is that identical content can be reachable in one state and dark in the next.
Why rules written in London reach sites in Japan
This is the part that surprises people, and it is worth stating precisely because it is often described loosely.
The Online Safety Act is extra-territorial by design. Section 204(1) provides that references in the Act to an internet service, a user-to-user service or a search service "include such a service provided from outside the United Kingdom (as well as such a service provided from within the United Kingdom)".
What pulls an overseas service into scope is its links with the UK - for example, having a significant number of UK users, or targeting the UK as a market. Where a server sits, or where a company is incorporated, is not the deciding factor. The obligation follows the audience, not the hardware. A site operated entirely from Japan can therefore fall within the UK regime because of who visits it.
This explains a pattern readers notice without understanding: a Japanese-language service that never marketed itself to Britain may suddenly present an age check, restrict a region, or quietly become unreachable from a UK connection. That is not a content decision. It is a jurisdictional one.
How Japan's own rules differ - and why they are not the same thing
Japan regulates adult media through a fundamentally different lever, and confusing the two is the most common mistake in discussions of this topic.
The relevant provision is Article 175 of the Penal Code, which dates from 1907 and criminalises distributing, selling or publicly displaying an obscene object. Under the Ministry of Justice's official English translation, the penalty is imprisonment for up to two years, a fine of up to ¥2,500,000, or both; a 2011 amendment extended it to electronic records.
Here is the nuance that most explainers get wrong: Article 175 does not mandate pixelation. No Japanese statute specifies mosaic as a technical requirement. The mosaic is industry self-censorship - a prophylactic practice adopted so that material stays below the obscenity threshold the courts have drawn, and thereby avoids prosecution. It is caused by the law without being commanded by it. If you have read that "Japanese law requires mosaic", you have read something imprecise.
So the two systems answer different questions. Japan's rule governs what may be shown. The UK and US rules govern who may enter. A work can be fully compliant with Article 175 and still sit behind an age check in Britain - the mosaic has no bearing on whether an age gate is required, because the obscenity threshold and the age-assurance duty are unrelated legal tests.
What this means for you as a reader
A few practical, neutral observations follow from the rules above.
The check you meet depends on the operator, not the law. Neither Ofcom nor a US state dictates which method a site picks. Two services obeying the same duty may ask very different things of you - one a facial scan, another a bank confirmation, another an ID upload.
Not every method involves handing over a document. Facial age estimation and open banking are designed to answer the single question "is this person over 18?" without transmitting your identity or your financial detail to the site. Whether a given operator has implemented that well is a separate matter, and one worth considering before uploading anything.
Data handling is the live controversy. The objection to these regimes has never been that adults may see adult material - the laws preserve that. It is that verification creates records linking real identities to adult browsing, and those records can leak. That concern was central to the dissent in Paxton and to the digital-rights groups that opposed the UK duty.
Expect the map to keep changing. Age assurance is one of the fastest-moving areas of internet regulation anywhere. Treat any specific tally of jurisdictions - here or elsewhere - as a snapshot, and check the date on it.
FAQ
Does clicking "I am over 18" still count as an age check?
Not in the UK. Ofcom is explicit that self-declaration is not highly effective age assurance: a date-of-birth box or a confirmation button with nothing behind it fails the criteria of being technically accurate, robust, reliable and fair, because anyone can simply type a different year. Services that allow pornography have needed a genuine method since 25 July 2025.
Do these laws apply to sites operated from Japan?
They can. Section 204(1) of the UK's Online Safety Act states that references to an internet service include a service provided from outside the United Kingdom. What matters is whether the service has links with the UK, such as a significant number of UK users or the UK as a target market - not where the servers or the company are located. The obligation follows the audience.
Does an age check mean uploading my passport?
Not necessarily. Photo-ID matching is one accepted method, but Ofcom also names facial age estimation, open banking, mobile-network operator checks, credit card checks, digital identity services and email-based age estimation. Several of these are built to confirm only that you are over 18, without disclosing who you are. The operator chooses which to deploy, so the experience varies from site to site.
Is Japan's mosaic censorship a form of age verification?
No - they are unrelated legal questions. Japan's Article 175 of the Penal Code criminalises distributing obscene material, and the industry adopted mosaic pixelation as self-censorship to stay below the courts' obscenity threshold. No statute actually requires the mosaic. That rule concerns what may be shown; UK and US age verification concerns who may enter. A title can satisfy Article 175 and still sit behind an age gate in Britain.
What happens to a site that ignores the UK rules?
Ofcom can impose penalties of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater. It has already acted: AVS Group Ltd was fined £1 million in a decision dated 4 December 2025 for inadequate age assurance, plus £50,000 for not answering a statutory information request, and Itai Tech Ltd was fined £50,000 in November 2025 over age-check failures. Failing to respond to the regulator is penalised separately from the underlying breach.