United Kingdom

[GB] Ofcom fines AVS Group GBP 1 million over children’s access to pornography and failure to supply information

IRIS 2026-1:1/25

Alexandros K. Antoniou

University of Essex

On 3 December 2025, the UK’s communications regulator Ofcom fined AVS Group Ltd GBP 1 million for failing to deploy "highly effective" age assurance under section 12 of the Online Safety Act 2023 (OSA), and a further GBP 50 000 for failing to respond to a statutory information request, backed up with daily penalties if non-compliance persists. The decision covers a portfolio of adult sites and requires compliant age checks to stop children encountering pornographic content. It is the clearest signal yet that Ofcom has moved from programme oversight to active enforcement of the child-protection duty at pace.

The enforcement backdrop is that earlier, on 16 January 2025, Ofcom opened an enforcement programme under the Act to oversee compliance with age assurance duties relating to pornographic material. The initial focus was on services falling within Part 5 of the Act (namely, sites that publish or display their own pornographic content), reflecting section 81 requirements that took effect on 17 January 2025. On 25 July 2025, the programme was widened to Part 3 services that allow users to upload or generate pornographic content. Within days of that expansion, on 30 July 2025, Ofcom opened an investigation into the AVS Group under the expanded programme.

The investigation covered multiple AVS sites (including e.g. pornzog.com, txxx.com and associated ".tube" domains) and invoked section 12 of the OSA, which imposes a duty on providers of Part 3 services that allow pornographic content to ensure that children are prevented from encountering such content through the use of "highly effective" age assurance. On the day the investigation opened (30 July), Ofcom also issued AVS with a formal information request under section 100 of the Act, requiring information relevant to the inquiry.

By late August 2025, Ofcom announced that AVS had not responded to the information request and thus expanded the investigation to consider a separate potential failure: non-compliance with the duty to respond accurately to an information request under the Act. Following evidence gathering, Ofcom issued AVS with a provisional notice of contravention (section 130) in October 2025, setting out its provisional view that AVS had failed, and was failing, to comply with section 12, and that it had infringed section 102(8) of the OSA by failing to respond to Ofcom’s statutory request within the specified time frame (AVS was given 20 working days to make representations before a final decision).

The final step was taken on 3 December 2025, when Ofcom issued a confirmation decision against AVS (acting under section 132). The regulator determined that AVS had not complied with section 12 and that the failure was ongoing. Its reasoning focused on the absence of any age assurance measures on some services during the relevant period and, importantly, on the inadequacy of measures deployed elsewhere. In particular, AVS had rolled out a photo-upload check mechanism that did not include "liveness" detection (i.e. a check that confirms the image is captured from a live, present user rather than a photo, screenshot, video, or synthetic image). Ofcom considered that such a method was vulnerable to simple workarounds as it could be circumvented by children (e.g. by uploading a photograph of an adult) and was therefore incapable of meeting the statutory bar of the Act (of note, the relevant period identified was 25 July 2025 to at least 25 November 2025).

In consequence, Ofcom imposed a GBP 1 million penalty for the section 12 contravention (set in accordance with its penalty guidelines) and required AVS to implement highly effective age assurance across all remaining AVS websites lacking compliant measures. Additionally, Ofcom set a daily penalty rate of GBP 1 000 for any continuing non-compliance with section 12, signalling in essence: install robust age checks promptly or the meter runs. As regards the information-request, a further penalty of GBP 50 000 was imposed for the breach of section 102(8) by not responding to a statutory request for information within the required time. Ofcom also ordered AVS to disclose a complete list of the sites it operates, with a GBP 300 daily penalty until it complies.

In parallel, Ofcom has indicated that it continues to investigate the compliance of other services with age verification duties and that it will take action where appropriate. In particular, its age assurance enforcement continues to widen beyond the AVS case. On 25 November 2025, the regulator took the following steps: it issued a separate fine against Itai Tech Ltd (operator of the nudification site Undress.cc) for inadequate age checks and non-compliance with an information request; it issued provisional decisions against additional providers (8579 LLC and Kick Online Entertainment S.A.) for similar alleged failings; it opened new investigations covering other providers responsible for around 20 pornography sites; and it expanded certain probes to assess whether firms have properly answered statutory information requests. Taken together, supervision has now shifted to active, system-wide enforcement across both age verification duties and information-gathering obligations.