This is a fascinating and brazen story, because I believe PH might be solely relying on the user agent being at least iOS 26.4…
PH don't have an app (not permitted in App Store), they only have a website, there is no Apple Declared Age API for the web yet, and device and user attestation (PrivacyPass and private access tokens) don't yet include signed age information (they're used for proof of human to skip CAPTCHAs).
The key fact here is that iOS 26.4 requires device age verification, in which the user must be confirmed to be 18 to keep adult websites enabled in the UK. It moves iOS from a default-on position for adult content to default-off.
In today's press release, Aylo is supportive of Apple's "trailblazing" device age verification in iOS 26.4, so much so that they are welcoming "eligible age-confirmed UK iOS users back to PornHub" today.
So it appears Aylo/PH is relying on the version of iOS being 26.4, seemingly checking the browser-reported user agent is at least "iOS 26.4". But — this information is a browser header which is unverified and user-controllable.
Absolutely wild. Ofcom will not like this, once they see people work around this, setting their user agent to "iOS 26.4" with simple tools.
Device age verification is good and the right way forward, but Aylo aren't using it. They look to be counting on the version of iOS reported in the browser