UK telecoms regulator Ofcom has laid out how porn sites could verify users’ ages under the newly passed Online Safety Act. Although the law gives sites the choice of how they keep out underage users, the regulator is publishing a list of measures they’ll be able to use to comply. These include having a bank or mobile network confirm that a user is at least 18 years old (with that user’s consent) or asking a user to supply valid details for a credit card that’s only available to people who are 18 and older. The regulator is consulting on these guidelines starting today and hopes to finalize its official guidance in roughly a year’s time.

The measures have the potential to be contentious and come a little over four years after the UK government scrapped its last attempt to mandate age verification for pornography. Critics raised numerous privacy and technical concerns with the previous approach, and the plans were eventually shelved with the hope that the Online Safety Act (then emerging as the Online Harms White Paper) would offer a better way forward. Now we’re going to see if that’s true, or if the British government was just kicking the can down the road.

“Our research shows that pornography is all too readily accessible to children online today, and that children as young as eight and nine are accessing porn sites,” Ofcom’s online safety lead Gill Whitehead tells me in an interview. “The majority of those are coming across it accidentally and stumbling across it on the web.” Ofcom’s press release cites research that suggests nearly eight in 10 children have seen “violent pornography depicting coercive, degrading or pain-inducing sex acts” before turning 18.

Ofcom lists six age verification methods in today’s draft guidelines. As well as turning to banks, mobile networks, and credit cards, other suggested measures include asking users to upload photo ID like a driver’s license or passport, or for sites to use “facial age estimation” technology to analyze a person’s face to determine that they’ve turned 18. Simply asking a site visitor to declare that they’re an adult won’t be considered strict enough.

Once the duties come into force, pornography sites will be able to choose from Ofcom’s approaches or implement their own age verification measures so long as they’re deemed to hit the “highly effective” bar demanded by the Online Safety Act. The regulator will work with larger sites directly and keep tabs on smaller sites by listening to complaints, monitoring media coverage, and working with frontline services. Noncompliance with the Online Safety Act can be punished with fines of up to £18 million (around $22.7 million) or 10 percent of global revenue (whichever is higher). 

The guidelines being announced today will eventually apply to pornography sites both big and small so long as the content has been “published or displayed on an online service by the provider of the service.” In other words, they’re designed for professionally made pornography, rather than the kinds of user-generated content found on sites like OnlyFans. That’s a tricky distinction when the two kinds often sit together side by side on the largest tube sites. But Ofcom will be opening a consultation on rules for user-generated content, search engines, and social media sites in the new year, and Whitehead suggests that the both sets of rules will come into effect at around the same time.

In practice, a tube site may choose to treat them the same. “If they have a mix of professional porn and user-generated porn, then they may wish from a practical perspective to apply this approach for everything,” she says. Pornographic content that consists only of text is not covered by today’s guidelines.

A key complaint with the UK’s last attempt to mandate age verification for pornography were the privacy concerns. But despite Whitehead’s assurance that Ofcom worked with the UK’s data protection regulator, the Information Commissioner’s Office, to develop its guidelines, digital rights campaigners with the Open Rights Group (ORG) aren’t convinced.

“It is very concerning that Ofcom is solely relying upon data protection laws and the ICO to ensure that privacy will be protected,” ORG program manager Abigail Burke said in a statement. “The Data Protection and Digital Information Bill, which is progressing through parliament, will seriously weaken our current data protection laws, which are in any case insufficient for a scheme this intrusive.”

“Age verification technologies for pornography risk sensitive personal data being breached, collected, shared, or sold. The potential consequences of data being leaked are catastrophic and could include blackmail, fraud, relationship damage, and the outing of people’s sexual preferences in very vulnerable circumstances,” Burke said, and called for Ofcom to set out clearer standards for protecting user data. 

There’s also the risk that any age verification implemented will end up being bypassed by anyone with access to a VPN. When I ask, Whitehead admits that there’s no “silver bullet” when it comes to online safety. However, she says the measures are still worthwhile if they can help stop children from accidentally encountering adult content. “I think the law and the duty of care on tech firms to keep users safe is part of a wider set of measures that includes education and includes parental conversations with children and all of these things can work together to really help keep children safe online,” she says. 

What remains to be seen is to what extent pornography providers will engage with the UK’s age verification measures. Although Pornhub’s owner Aylo (then known as MindGeek) complied with a Louisiana law requiring users to verify their ages with government ID in January, it later blocked users from accessing its services entirely in other states that introduced similar rules like Mississippi, Virginia, Utah, and Arkansas. Aylo did not respond to The Verge’s request for comment on the UK’s Online Safety Act.