Age checks became the norm in Europe, the US got a 48-hour removal rule, and EU rules on AI labels began to apply in August. Here is the year in one page, in the order it happened, with what each official source says.
If you run an adult site that people in Europe or the US can reach, 2026 is the year in which regulators in most of these places said a “Yes, I’m 18” button is not an age check, a US law set a 48-hour deadline for platforms with user uploads to remove intimate images shared without consent, and EU transparency rules for AI-made content began to apply.
None of this happened overnight. Most of it was decided in 2024 and 2025 and came into force step by step. Below we go through the changes in date order, with what the official sources say. Every date names its source, and every source is linked at the end of the article; this is not legal advice.
In the UK, according to Ofcom (checked 19 October 2026), services that publish their own pornographic content have had age-assurance duties under Part 5 of the Online Safety Act since 17 January 2025, and the children’s safety duties for user-to-user and search services under Part 3 have applied since 25 July 2025, when the Protection of Children Codes came into force. Ofcom says every service that allows pornography must use highly effective age assurance; its guidance lists a tick box, a date-of-birth field or a disclaimer in your terms as not highly effective, and its placement guidance looks at whether anything explicit is visible before the check.
In the US, according to the Supreme Court docket for case 23-1122 (checked 19 October 2026), the Court upheld Texas’s age-verification law in Free Speech Coalition v. Paxton on 27 June 2025. Many other states have similar laws; each law’s text describes which sites and visitors it covers.
In France, Arcom has published a technical standard for age verification on porn sites, the “référentiel” (linked below). In Germany, the JMStV allows porn online only inside a closed user group; according to the KJM’s text of the treaty (checked 19 October 2026), the current version has applied since 1 December 2025.
According to the Data (Use and Access) Act 2025 (Commencement No. 5) Regulations 2026 on legislation.gov.uk (checked 19 October 2026), the offences of creating, or requesting the creation of, a purported intimate image of an adult without consent (Sexual Offences Act 2003, ss. 66E and 66F) came into force in England and Wales on 6 February 2026. The offence covers creating such an image, or asking someone to create it, not only sharing it. For adult sites, the topic comes up most with user uploads and AI tools. Our scanner flags wording that suggests an “undress” or nudify feature, because a label or an age check doesn’t change what such a feature makes.
According to AGCOM’s press release of 12 November 2025 (checked 19 October 2026), its age-verification decision, delibera 96/25/CONS, applies since 12 November 2025 to Italian and non-EU operators on AGCOM’s list. The rules describe “double anonymity”: a third-party certifier confirms that the visitor is an adult, and the site receives only that proof, not who the visitor is. AGCOM gave 12 November 2025 for listed sites established in Italy or outside the EU and 1 February 2026 for listed sites established in other EU countries; it published its list on 31 October 2025. According to AGCOM (Delibera 96/25/CONS, checked 20 Oct 2026), operators on AGCOM’s list must use age verification by independent certified providers. Under the procedure, AGCOM first sends a formal notice (diffida) with 20 days to comply and can then order blocking from Italy, as it did in Delibera 73/26/CONS. In April 2026 the Lazio administrative court annulled the part of the rules that applied to operators based in other EU countries; for them, AGCOM first has to go through their home country and the European Commission (TAR Lazio, judgment 6283/2026 of 7 April 2026; as of 20 October 2026).
According to the European Commission’s press release of 26 March 2026 (checked 19 October 2026), the Commission preliminarily found Pornhub, Stripchat, XNXX and XVideos in breach of the Digital Services Act for failing to protect minors from pornographic content; it describes their self-declaration checks as ineffective. The platforms can reply before any final decision.
Reminder: the DSA’s reporting duties (in force since February 2024, Art. 93 DSA). The DSA expects platforms where users can upload content to offer a way for anyone to report illegal content (Art. 16), to explain their decision to the uploader when they act (Art. 17), and to name contact points for authorities and users (Art. 11 and 12). Article 19 says micro and small enterprises are exempt from Section 3, the extra platform duties in Articles 19 to 28; Articles 11 to 17 sit outside that section.
The TAKE IT DOWN Act requires covered platforms to let people ask for removal of intimate images published without their consent, to explain that process in plain language, and to act within 48 hours of a valid request, including known identical copies. According to the FTC (checked 19 October 2026), this part applies from 19 May 2026, and the FTC enforces it. The Act’s definition of a covered platform centres on user-generated content and leaves out sites that mainly publish their own preselected content (TAKE IT DOWN Act § 4(3), set out as a note to 47 U.S.C. § 223a).
According to the European Commission’s FAQ on Article 50 (checked 19 October 2026), the transparency rules in Article 50 of the EU AI Act apply from 2 August 2026; providers of generative systems placed on the market before that date have until 2 December 2026 for the machine-readable marking in Art. 50(2). Under the AI Act (Art. 50(4)), deployers who publish realistic AI-generated or manipulated images, video or audio are expected to disclose it; for evidently artistic or fictional work, the Act describes a lighter disclosure. Under the AI Act (Art. 50(1)), AI chats must tell people they are talking to an AI. Under the AI Act (Art. 50(2)), providers whose own systems generate content must also mark it in a machine-readable way.
Regulation (EU) 2026/1744 (Official Journal of 24 July 2026, checked 20 October 2026) adds point (ba) to Article 5(1) of the AI Act, applying from 2 December 2026: it prohibits placing on the market, putting into service or using an AI system that generates or manipulates realistic images, videos, audio or similar material of an identifiable person’s intimate parts, or of an identifiable person engaged in sexually explicit activities, without that person’s freely given, specific, informed, unambiguous and explicit consent. Under the new Article 5(1a), for providers this covers systems intended for it, or where it is a reasonably foreseeable and reproducible outcome without adequate safeguards; for deployers, it covers using a system for that purpose.
For adult sites, this matters most where a site offers its own AI generator or an “undress” feature. Our scanner flags wording that suggests such a feature (check AI-04); it can’t see how a tool works inside.
Most of these changes point to the same three habits:
No451 scans your site the way a first-time visitor, a link-preview bot and a scraper see it, and shows what we found with evidence and a fix. The first result is free and needs no signup. We describe what we see, not what the law requires of you; for that, talk to a lawyer in the countries you care about.
Not legal advice. This page summarises and links to primary sources; it does not tell you what the law requires of your specific site. Related: Regulations by country · Why regulators say an “I am 18” button isn’t an age check · TAKE IT DOWN Act: the 48-hour rule
One free scan shows your age check, report routes and labels, with evidence and fixes.