The introduction of mandatory age verification for online pornography in the UK was a landmark moment in digital regulation. From 25 July, major pornography providers operating in the UK were required to verify that their users were over 18, with Ofcom empowered to investigate and sanction those who failed to comply. The aim was simple: protect children from content that is harmful to their development.
The implementation of these measures has been anything but quiet. Some providers moved swiftly to integrate robust age checks, recognising both their legal obligation and moral responsibility. Others took a different path, withdrawing from the UK market entirely. And some, despite months of preparation time, remained non-compliant and quickly found themselves under Ofcom’s scrutiny. Enforcement action has already begun, and with it comes an important lesson for the broader online safety landscape, compliance is driven not only by regulation, but by the visible application of that regulation.
Enforcement changes behaviour
The early days of age verification have shown that when clear rules are combined with meaningful enforcement, the industry responds. The cost of non-compliance is no longer hypothetical; it can mean fines, reputational damage, market restrictions, or removal from search listings. For some, that cost has outweighed any resistance to change.
The lesson here extends well beyond pornography. Regulation alone does not guarantee change; it must be matched with visible, credible, and persistent enforcement. Without that, there is a risk that only a fraction of platforms will take the necessary steps, while others will delay or avoid action entirely.
The parallel with NCII prevention
In July, Ofcom published its draft Additional Measures codes for consultation, signalling its intention to require platforms to use perceptual hashing to prevent the re-sharing of non-consensual intimate images (NCII). This is a step forward we strongly welcome. The potential here is clear: an evidence-based, privacy-preserving solution that stops harmful content from resurfacing again and again, reducing trauma for victims and creating a safer online environment.
But as with age verification, publication of a requirement is only the beginning. The real test will be how quickly platforms integrate these measures and how effectively regulators ensure they do. We have already seen, in the context of child sexual abuse material (CSAM), that adoption of hashing technology remains patchy despite being an established requirement for many. Without timely enforcement, there is no reason to believe NCII prevention will be different.
Ready to meet demand
Through StopNCII.org, we are ready to support platforms in meeting these emerging obligations. Our infrastructure has been designed for scale from the outset, and we already work with some of the largest global platforms as well as smaller, specialist services who have integrated smoothly. Across SWGfL’s safeguarding portfolio, we support tens of thousands of schools, colleges, and professionals a track record that demonstrates our capacity to deploy technology at scale and manage complex, multi-stakeholder ecosystems.
We are investing in the next phase of StopNCII’s infrastructure now, ensuring it can accommodate the thousands of platforms Ofcom has indicated could fall within scope. This work is funded from charitable reserves in anticipation of both early adoption from forward-looking platforms and, crucially, regulatory enforcement that brings the rest into alignment.
The cost of inaction is higher than the cost of compliance
There is a financial reality here. For platforms, the investment required to implement perceptual hashing is far outweighed by the potential cost of non-compliance. Beyond regulatory fines, there are reputational risks, user trust considerations, and the operational disruption that comes from being investigated or sanctioned.
The age verification rollout has shown that avoiding compliance is rarely a sustainable strategy. Those who act early not only avoid enforcement risks but also position themselves as leaders in protecting their users. The same will be true for NCII prevention.
Enforcement as the catalyst for change
Ultimately, the success of the proposed NCII measures will depend on the resolve of regulators to act quickly and decisively when platforms fail to engage. This is not only about encouraging slow adopters, it is about ensuring that those who actively avoid their obligations do not undermine the safety of victims. We expect Ofcom, supported by government, to ensure enforcement is not just possible, but visible and effective.
We remain optimistic that many platforms will see the moral and operational case for early adoption. But optimism must be underpinned by action. Without enforcement, change will be uneven, and the potential impact of these measures will be diminished.
Looking ahead
The parallels between age verification and NCII prevention are clear. Both aim to protect vulnerable users from harm. Both rely on technology that is already available and proven. And both require regulatory intent to be matched by decisive enforcement to achieve universal adoption.
StopNCII.org is ready when the regulations are ready. The infrastructure is in place, the partnerships are growing, and the potential for impact is significant. The cost of inaction, for victims and platforms alike, is far too high to ignore.
