Australians who use Apple devices can once again access the world’s most popular adult content site, Pornhub.
Author
- Toby Murray
Professor of Cybersecurity, School of Computing and Information Systems, The University of Melbourne
That’s because Aylo, the parent company of Pornhub, is taking advantage of recent child-safety features Apple has implemented in their devices in Australia. To use certain features – including access to adult content – Apple users now have to confirm they’re 18 .
This method of age verification is akin to an approach I originally proposed in The Conversation in 2024. Importantly, this could be the start of a broader shift in the tech industry to a model that ensures child safety online with lesser privacy risks than we have right now.
Australia’s new era of age assurance
Since March 2026 , Australians have typically had to prove they’re over 18 to access adult content online under new eSafety Commissioner requirements.
Some websites, including Pornhub, decided it was safer to simply block access to Australians, rather than rely on fallible age assurance methods .
Adult websites that chose not to block Australians predominantly turned to third-party identity providers such as Yoti, Persona, AgeGO and AgeVerif. Such platforms typically require users to upload selfies or video of their face, or to hand over credit card details or government identity documents.
There’s a number of drawbacks with this approach.
What’s wrong with how we currently do age assurance?
Adults wishing to prove they’re over 18 have to hand over sensitive, identifying information to a sea of identity providers. While these services are marketed as safe and privacy aware, the mere act of handing them your private information could reveal highly sensitive information about your online habits – especially when accessing adult content.
A data breach against an identity provider represents a significant risk for its users. Having many providers compounds that risk.
Privacy risks also exist for teens who are subject to repeated age checks when they want to access social media, online dating or chat applications.
And it’s been known for some time that none of the age assurance providers are infallible. Teens and children find ways to work around them and share that information with their friends.
Security is only as good as the weakest link. Having many providers creates lots of opportunity to find different workarounds.
How is Apple’s approach different?
Apple’s new online safety features cut out the weak link: identity providers. Instead of proving their age to many different providers, users instead prove their age once – to Apple.
This can happen the first time a user wishes to access sensitive content on any of their devices, or at the time they set up their Apple Account.
Apple has various methods for users to prove they are of age, including requiring government identity documents, credit card details, or the date of creation of their Apple ID account.
Importantly for adults, proving to Apple you’re 18+ reveals nothing about your online browsing habits.
Crucially for child safety, Apple devices default to mandatory safety settings for any users who haven’t proved they’re 18. This includes content filtering, such as blocking access to adult web sites, plus “communication safety” features that blur sensitive content in images and videos, such as nudity. These features integrate with Apple’s existing child-safety features.
The device can also share information about its user’s age with apps so they can implement additional safety protections. An example of this is Google’s SafeSearch feature, which blocks access to sensitive content in Google search and can’t be turned off if the user hasn’t verified they’re over 18.
Together, these features provide a child-safe by default experience in Australia, without the major drawbacks that come with using third-party identity providers.
Towards a universal model of online safety
I’ve argued before that tech companies should work together on online safety, with device makers like Apple doing age-assurance and implementing mandatory safety features for children.
Apple has now taken the lead in implementing this kind of model. Aylo is calling on Google and Microsoft to implement the same child-safe-by-default approach as Apple. And in August, Meta, the parent company of Instagram, Facebook and WhatsApp, argued for much the same thing.
Encouragingly, both Google and Microsoft have already built some of the necessary infrastructure. The next step is to use it to provide the same kind of default device-level protections Apple has now introduced.
Ultimately, what we’ll need is industry-wide standardisation, so parents and children alike see uniform safety enforcement regardless of what kind of devices they use, and websites and apps can easily and reliably learn a user’s age from their device.
In the short term, we will hopefully see other sites following Pornhub’s lead by relying on child-safety features and age assurance provided by the user’s device, rather than third-party identity providers.
Doing so would lay the foundation for a much safer online world for parents and children alike.
