A year-end research report released by the Shield Our Children Online Alliance (SOCOA) finds that the United Kingdom’s Online Safety Act has not delivered consistent protection for children from pornographic content since its age-verification enforcement provisions took effect on 25 July 2025.
The report, UK’s Non-Compliant Pornographic Websites, reviews Ofcom enforcement activity throughout 2025 and documents widespread non-compliance among pornographic websites subject to investigation for failing to meet age-assurance requirements under the Act.
“The intention of the Online Safety Act was to protect children, but our findings show that intention has not translated into effective protection in practice,” said Graham Hellier MBE, Founder of SOCOA.
According to the report’s findings, enforcement outcomes remain uneven. While some large platforms introduced age-assurance measures following regulatory action, many smaller and mid-sized sites continued to operate without what Ofcom defines as “highly effective age assurance” for months after the law came into force.
“Months after the law took effect, children could still access pornographic material with little more than a few clicks,” Hellier said. “That reality cannot be squared with the promise of the legislation.”
As of the end of 2025, Ofcom had issued confirmed financial penalties to three entities in connection with age-assurance and enforcement failures. Total penalties issued amounted to £1,125,000, with the majority imposed on a single UK-registered pornographic website operator.
The report identifies structural constraints that have shaped enforcement since July. Many investigated websites are operated by companies based outside the UK, frequently with opaque ownership structures that complicate accountability and limit regulatory reach. In several cases, operators failed to respond to statutory information requests, resulting in prolonged investigations.
“You cannot meaningfully enforce UK child-protection laws against companies that operate offshore, hide ownership details, and ignore regulators for months at a time,” Hellier said. “That is not a failure of effort, but a failure of the enforcement model itself.”
SOCOA’s year-end analysis also highlights circumvention as a persistent challenge. The report documents increased VPN usage following the introduction of age-verification requirements, enabling users to bypass site-level controls and undermining the intended protective effect of the legislation.
“Age checks that can be bypassed with a free VPN do not function as a safeguard,” Hellier said. “They function as an inconvenience, and children know how to get around them.”
Based on its findings, the report concludes that an enforcement model focused on individual website compliance faces inherent limitations in a global online environment, particularly where enforcement actions extend over lengthy investigation periods.
“What this year has shown is that chasing individual websites is a reactive approach that will always lag behind the scale of the problem,” Hellier said. “If we want real protection, the system itself has to change.”
