UK will outsource porn site age verification to private industry, potentially handing porn streaming giant MindGeek a monopoly on the system and private data
John Herrman / New York Times : Tweets: @naomiohreally and @finck_m Tweets: Naomi O'Leary / @naomiohreally : The aim of a new UK law was to protect children from porn online. Instead, it may crown one foreign porn company a monopoly, in charge of verifying age and storing the personal details of everyone accessing porn from the UK https://www.nytimes.com/... Michle Finck / @finck_m : Worthwhile read for anyone interested in digital regulation that has it all: regulatory intermediaries (gone wrong?), porn, blockchain (used by, not replacing an intermediary), digital power, circumvention, and - to my surprise - even Luxembourg. https://www.nytimes.com/...
Context & Ripple Effects
This 2019 report lands mid-arc for UK online-porn regulation: parliament's earlier digital economy bill had already drawn criticism for extending offline content standards to video sites, and the government now chose enforcement-by-outsourcing — delegating age verification to private companies rather than a state system. The structural worry flagged at the time was that the delegate could be an incumbent: MindGeek, the Luxembourg-based operator behind Pornhub, whose ownership and $460M-revenue scale were opaque enough to warrant a later Financial Times ownership investigation.
The years since tested the design. Ofcom eventually imposed robust checks including photo ID matching and facial age estimation, Aylo (MindGeek's successor name) committed to approved age assurance by July 2025 — and the outcome inverted the law's intent: non-compliant sites grew UK traffic while compliant ones declined, with Pornhub itself reporting that seven of the top ten 'free porn' search results went to non-compliant sites.
First-order effects
- UK adults accessing porn would have their age-verification data held by a private intermediary potentially controlled by MindGeek — the largest commercial beneficiary of compliant traffic — concentrating sensitive browsing-linked personal data in one foreign company's hands.
- Smaller adult sites face an immediate compliance fork: route their UK users through a rival-operated verification layer or risk blocking UK access entirely.
Second-order effects
- Compliance becomes a competitive liability rather than an equalizer — the measured traffic shift toward non-compliant sites rewards evasion, pressuring other operators to delay or avoid certification and pushing UK users toward workarounds.
- Whoever operates the verification layer gains a regulatory chokepoint over every competing site's access to UK visitors, converting a legal mandate into durable platform-gatekeeper leverage.
Third-order effects
- The episode is a template case for delegated digital regulation: outsourcing compliance to private intermediaries can concentrate power and data in exactly the incumbents a law nominally constrains, a design question that recurs wherever states require identity or age checks without building state infrastructure.
- If verification mandates spread to other jurisdictions and content categories, the market structure they create — a few accredited private verifiers sitting between regulators and users — becomes a standing target for privacy regulation and circumvention economics alike.
The trend: Age-verification mandates are turning delegated compliance duties into market power for the platforms they regulate, with enforcement design — state-run versus outsourced — deciding who ends up holding the data.