London / Berlin, 7 September 2026 — The UK communications regulator Ofcom has imposed a £730,000 penalty on the operator of the free tube Xgroovy.com, splitting the sanction into £700,000 for operating without highly effective age assurance and £30,000 for ignoring a statutory information request. After enforcement began, the site first added an age-check layer Ofcom accepts as capable of being “highly effective,” then cut the UK off entirely by geoblocking British IP addresses.
That sequence is the story for operators, not the headline number. Age checks arrived only after the breach window had closed. The UK market was then abandoned. The corporate owner remains unnamed. And a daily £200 penalty is still running until the missing information is delivered, or until 3 November 2026.
Not Grooby — and not an unnamed “porn site”
Early consumer write-ups treated the target as anonymous. Ofcom’s own notice is more precise: the provider of Xgroovy.com failed its duties between July 2025 and November 2025. The Confirmation Decision was issued on 3 September 2026 and published the following day. A non-confidential version of that decision is still promised “in due course.” Until then, every official document uses the same formula: “the provider of Xgroovy.com.”
That opacity is itself a compliance fact. Ofcom can fine a service it can identify by URL even when the operator will not confirm a company name, registered office or qualifying worldwide revenue. The regulator has said it will pursue collection for HM Treasury regardless of where the publisher sits. Whether that produces cash is another question: earlier this year Ofcom disclosed that Belize-linked AVS Group Ltd had still not paid its £1 million age-check fine.
A mid-tier tube that absorbed displaced traffic
Xgroovy is not a boutique niche site. Independent traffic panels put it in the global top few hundred websites, with on the order of 100 million-plus visits a month in mid-2026 and Germany consistently among its largest country markets after the United States. Semrush’s July 2026 snapshot showed about 126 million visits, with Germany at roughly 11 percent of traffic. The product is a classic ad-supported tube: high volume, multi-daily updates, long-tail niches, downloads, and a mix of amateur and scraped mainstream clips. The domain has been live since around 2019.
That profile explains why Ofcom opened the file when it did. Age-assurance duties for porn services took effect on 25 July 2025. The major tubes either installed “highly effective age assurance” (HEAA) or left the UK. Traffic did not disappear; it migrated. Ofcom has said repeatedly that it prioritises investigations where user numbers rose because competitors put checks in place. Xgroovy was pulled into that second wave on 10 September 2025, in a batch covering five operators and 22 sites that Ofcom said collectively drew more than eight million unique UK visitors a month.
The 12-month enforcement clock
The file did not move quickly because the operator engaged. It moved because the operator did not.
- 10 September 2025 — investigation opened.
- 23 September 2025 — first statutory information request; no response.
- 19 November 2025 — scope expanded. That date also marks the end of the period Ofcom later treated as the core age-check breach.
- 30 March 2026 — information request reissued to new contact details obtained from the site. Still no reply.
- 16 June 2026 — provisional notice of contravention under section 130 of the Online Safety Act.
- 3 September 2026 — Confirmation Decision.
- 4 September 2026 — public announcement of the £730,000 penalty.
The legal hooks matter for anyone running a tube. Ofcom found a breach of section 12 of the Act — the child-protection duty that applies to user-to-user services — not only the Part 5 “publisher porn” duty in section 81. A tube that hosts third-party videos is treated as a U2U service. The extra £30,000 sits on section 102(8): failure to answer a legally binding information request on time. That second fine is now almost a standard rider on Ofcom adult cases. Kick Online Entertainment, Fapello’s provider, Youngtek Solutions, 8579 LLC and AVS all collected an information-request add-on.
France got there first — with a block, not a cheque
The UK fine is not Xgroovy’s only European problem. France’s Arcom issued Décision n° 2026-35 on 28 January 2026, formally putting “the company publishing xgroovy.com” on notice. Inspectors had recorded, on 13 November 2025 and again on 22 January 2026, that pornographic content was reachable without any check that the user was an adult — a breach of article 227-24 of the French criminal code as applied through the SREN law. The publisher had 15 days to stop minors encountering the content.
There was no meaningful response. In March 2026 Arcom moved to ISP blocking and search delisting, an administrative route that does not wait for a judge and is designed to take effect within 48 hours. Arcom president Martin Ajdari described xGroovy at that point as the pornographic site on which minors were spending the most time — a direct consequence of larger, more visible platforms either verifying or walking away from France. Arcom can fine up to €150,000 or 2 percent of worldwide turnover, more on repeat offending. It chose the block.
Two regulators, one pattern: no answer to the first letter, late or cosmetic compliance, then exit from the regulated territory. The UK prices that behaviour. France removes the URL from the open web.
Where this sits on Ofcom’s scorecard
By mid-July 2026 Ofcom said it had opened 23 investigations covering 88 adult services. On its telling, 73 percent of those services had either put in age assurance or blocked UK users. It had already fined seven providers across 24 sites: 8579 LLC (£1.35m), AVS Group Ltd (£1m), Kick Online Entertainment S.A. (£800k), the provider of Fapello (£630k), Youngtek Solutions Ltd (£500k), First Time Videos LLC (£80k) and Itai Tech Ltd (£50k). Xgroovy is the next confirmed penalty after that list. The statutory ceiling remains £18 million or 10 percent of qualifying worldwide revenue, whichever is greater. These adult fines are still far below that cap. They are large enough to matter to a mid-tier tube, and they are being used as signalling tools.
On the same day as the Xgroovy announcement, Ofcom issued provisional contravention notices to Cyberitic, LLC (including shesfreaky.com) and ZD Media (a cluster that Ofcom lists as including hello.porn, homo.xxx, max.porn, ok.porn, ok.xxx, perfectgirls.xxx, pin.porn, pornhat.com, pornhat.one and pornstars.tube). Those files are not closed. Operators in that cohort should assume the Xgroovy template — breach window, information-request rider, then either HEAA or a UK geoblock — is the working model.
What the case actually tells the trade
First, geoblocking does not wipe historic liability. Fapello’s operator geoblocked the UK after Ofcom moved and still took a £600,000 age-check fine plus £30,000 for silence. Xgroovy followed the same path. Leaving Britain after the fact is a traffic decision, not a defence.
Second, silence is separately billable. The £30,000 plus £200 a day is small next to the main penalty. It is also the easiest part of the file for Ofcom to prove. Contact details on a site are enough to start the clock. Changing those details mid-investigation only bought Xgroovy a second request, not a free pass.
Third, “we added AV later” is not enough. Ofcom’s wording is careful: the provider introduced a method capable of being highly effective, then geoblocked. Capability is not the same as a completed compliance audit across every entry point, app, mirror and embed. Operators who bolt on a vendor widget and assume the file is closed are reading the guidance more generously than Enforcement is.
Fourth, traffic displacement is now an enforcement input. Sites that grew in the UK after July 2025 because Pornhub, Aylo properties and other large tubes restricted access are exactly the inventory Ofcom said it would rank by harm and growth. Mid-tier tubes that treated the UK as a windfall market are the current target set.
Fifth, collection and identity remain the weak point. A £730,000 order against an unnamed provider is a press release and a legal instrument. It is not automatically a payment. For B2B readers that cuts both ways: the headline risk is real, but so is the unevenness. Compliant European operators pay for vendors, conversion loss and support. Non-responsive offshore tubes may treat the fine as a cost of not having a UK bank account.
The German and EU reading
Germany is already a top traffic source for Xgroovy. That does not put the site under Ofcom. It does mean a large share of the audience Ofcom just locked out of the UK still sits in the DACH market, where KJM-recognised AVS rules, BPjM practice and the forthcoming shape of EU-level age-assurance expectations are a different compliance stack. France has shown it will block. The UK has shown it will fine and then keep fining for unanswered letters. Italy has already run certified AVS plus block lists. The commercial question for platforms, payment partners and ad networks is no longer whether age assurance is “coming.” It is which jurisdiction they intend to keep, which they will geoblock, and whether they can document HEAA before a regulator writes the first information request.
George Lusty, Ofcom’s director of enforcement, put the message in one line: put effective age checks in place, or expect fines; ignore legally binding requests, and expect more of the same. Xgroovy is the exhibit. The company name, when Ofcom finally publishes the decision, will be the footnote.