Campaigners are "astonished" that the government's draft Online Safety Bill does not contain long-promised age verification checks for pornography.
Companies have invested heavily in the technology in recent years to prepare for legally-required checks.
But an earlier law requiring them was never enforced.
The government says the new bill will focus on online platforms where children are more likely to find pornography by chance.
This includes social media, but the law may not apply to many commercial adult sites because the current draft only covers websites containing user-generated content.
"I was completely astonished when I saw the bill," said John Carr, Secretary of the Children's Charities' Coalition on Internet Safety.
"Pornhub, xHamster, all of the big commercial pornography sites - the largest single source of pornography in the world - are outside the scope of the bill or could easily put themselves outside of the scope of the bill.".
They could do so by easily removing all user-uploaded content, he said - as Pornhub recently did within days of an investigation being launched into its user-generated content.
"They could do that and it would not affect their core business model in any way, shape or form," Mr Carr said.
Proposals to make all UK pornography users confirm their age before accessing explicit content was first mooted in 2016.
It was made law in the 2017 Digital Economy Act - but that was never brought into force after repeated delays, and fears it would not work.
It was officially dropped in 2019, but the government pledged "other measures" would achieve the same results.
"A strong case"
Culture Secretary Oliver Dowden told a meeting of the Digital, Culture, Media and Sport (DCMS) Committee that the Online Safety Bill was designed to deal with social media sites, where he believed the biggest risk with pornography was "kids stumbling across it".
He also suggested that most commercial porn sites "do have user-generated content on them, so most of them will be in scope".
But he left the door open to firm up the rules.
"I don't have a closed mind on this. If we could find a commensurate way of providing wider protection for children within it... I think there is a strong case for doing that," Mr Dowden said.
"Companies hosting user-generated content, video-sharing or live-streaming will need to prove to an independent regulator they can stop children accessing harmful content," a spokeswoman for DCMS said.
"Our new laws will therefore go further than the Digital Economy Act," she added.
John Carr said there were "two scurrilous rumours" circulating about the omission; that either it was a tactical move by the government, or that the authorities simply did not want to enforce it.
But Baroness Floella Benjamin, a House of Lords member who has campaigned on issues around pornography, said she believes parliamentary review will "add back the essential elements" of the older law.
"It was obvious that adult sites would simply drop interactive functionality to evade age verification," she said.
Over 5yrs ago spoke in @UKHouseofLords about sexual abuse on girls in schools by boys who performed what they saw on porn sites. Government need to bring in Age Verification to try and stop this, they can if they want to. If not they are failing our kids. https://t.co/JoObz0ttEj— Floella Benjamin (@FloellaBenjamin) March 31, 2021
"The elephant in the room is what happens to protect children over the next three to four years," she warned, because of the time it would take to develop and implement the rules.
"A seven-year-old will be a teenager before this new law comes into force," she said.
"It will come back in"
The Support Network for Adult Professionals - the UK adult industry body - said it had also been expecting the new law to cover age verification.
"We still think in time that it will happen. We believe Brexit and Covid made the government put it to one side," the group said.
After the years of back-and-forth, most companies have been set up to handle it - "but we think that some businesses are pleased it's not in yet," it added.
The Age Verification Providers Association, which represents firms providing the technology, said it interpreted Mr Dowden's comments as having "agreed to accept an amendment... to extend it to commercial pornographic websites".
It also said that the Online Safety Bill has greater commitments to privacy, which would benefit age verification systems.
It’s fair to say that it’s been a bumpy journey but it does now appear that we are approaching the right destination. We should not be surprised because @DCMS is trying to do something difficult & legally complex to protect children online, but should be commended for doing so.— Age Veri fication Providers Association (@The_AVPA) May 15, 2021
Co-chair Alastair Graham said: "It is great to see within the new bill a clear legal duty for data security. We can protect children from harmful or age-inappropriate content online, while not interfering with the privacy and freedoms of adults."
Mindgeek - the parent company behind Pornhub and many other adult websites - warned that "internet regulation is a difficult task that must balance user privacy with judicious enforcement".
"The challenge of age verification requires a global solution in order to ensure child protection laws are met, while avoiding the pitfalls of invasion of privacy and haphazard implementation," it said.