8 September 2025 - Online safety laws to strengthen to protect people of all ages from self-harm content

The government will amend the Online Safety Act to make content encouraging or assisting serious self-harm a ‘priority offence’ for users of all ages, expanding protections beyond children to include adults. Tech companies will be legally required to proactively detect and remove this harmful material before it reaches vulnerable individuals. The new regulations are expected to come into force 21 days after parliamentary approval, anticipated this autumn.

8 September 2025 – Ofcom launches consultation on online safety super-complaints guidance

Ofcom has launched a consultation on super complaint guidance. Under the Online Safety Act, expert organisations representing users or the public can raise a ‘super-complaint’ with Ofcom. Super-complaints allow such expert organisations to present robust evidence and facts about the most significant online harms and restrictions on free expression arising on regulated online services. Ofcom’s draft guidance on super-complaints explains what super-complaints are, their role in online safety regulation, eligibility criteria for organizations looking to bring a super-complaint, rules and procedures for making a super-complaint, and the typical process Ofcom follows in relation to super-complaints. Responses to the consultation are to be submitted by 3 November 2025.

1 September 2025 – Ofcom launches third consultation to implement the online safety fees regime

Ofcom has launched its third consultation on guidance intended to aid providers in making a fees regime notification under the Online Safety Act 2023 (Fees Notification) Regulations 2025. The consultation sets out Ofcom’s proposed guidance on the process for preparing and submitting fees-related notifications. The guidance also outlines the details and substantiating evidence that should be included and provides instructions for accessing and using the fees portal which will be used to submit fees-related notifications. Ofcom is accepting responses to the consultation until 1 October 2025.

The online safety fees regime is expected to come into force later this year. Under the regime, regulated service providers with qualifying revenues above a specified threshold will be required to contribute an annual fee to Ofcom to cover the costs of discharging its new online safety functions.

28 August 2025 – Investigation into Duplanto Ltd and its compliance with the duty to prevent children from encountering pornographic content through the use of age assurance

Ofcom has opened an investigation into Duplanto Ltd, which runs a pornographic website, and will examine whether there are reasonable grounds to believe that the provider has failed, or is failing, to prevent children from encountering pornographic content on its site. This is now the 5th live investigation related to the new age-check requirements under the Online Safety Act, following 4 other investigations announced immediately after the new requirements came into force on 25 July 2025.

28 August 2025 – Ofcom expands its AVS Group Limited and Kick Online Entertainment S.A. investigations

Ofcom has announced it is expanding the scope of the existing investigation into AVS Group Limited and Kick Online Entertainment S.A. and will investigate their failure to respond to statutory information notices from Ofcom as well as their compliance with the requirement to introduce age checks for pornographic content. Ofcom is gathering the evidence and may issue provisional contravention notices if it finds that the rules have been broken.

27 August 2025 – 4chan launches legal action against Ofcom in US

4chan Community Support LLC and Lolcow LLC, the corporate entities behind the online forums 4chan and Kiwi Farms, have filed a legal complaint in a Washington D.C. federal court against Ofcom. They are seeking a declaration that Ofcom has no authority to enforce the Online Safety Act in the United States, along with a permanent injunction preventing the regulator from taking any enforcement action against the companies under the OSA. The complaint argues that the OSA conflicts with the free speech protections granted by the US Constitution and should not apply to American businesses with no physical presence in the UK. Ofcom maintains that any online service with UK users or that targets the UK market must comply with the OSA, regardless of where it is based.

The legal action follows Ofcom’s investigation into 4chan and the provisional notice of contravention issued on 13 August 2025. 4chan’s lawyers have alleged that Ofcom had provisionally decided to impose a £20,000 fine for failing to comply with two requests for information. Ofcom has not confirmed the fine but has stated that 4chan has not answered the information requests.

13 August 2025 – Investigation into 4chan and its compliance with duties to protect its users from illegal content

Ofcom opened an investigation on 10 June 2025 into the online discussion board 4chan, examining whether 4chan failed to respond to statutory information requests, to conduct and record a suitable illegal content risk assessment, and to comply with safety duties regarding illegal content.

On 13 August 2025, Ofcom issued 4chan a provisional notice of contravention, finding reasonable grounds to believe the provider failed to comply with two information requests under section 102(8) of the Act. Ofcom will consider any representations from 4chan before making a final decision, and the investigation into other potential breaches, including user protection from illegal content, remains ongoing.

11 August 2025 – Wikipedia loses challenge against Online Safety Act verification rules

Wikipedia, through the Wikimedia Foundation, has lost its legal challenge against the Online Safety Act’s categorisation regulations. Wikipedia argued that these rules, which impose the strictest obligations for Category 1 services, are too broad and could threaten the privacy and safety of Wikipedia’s users - for example, given that Wikipedia would be required to verify the identity of many Wikipedia contributors. The High Court rejected Wikimedia’s arguments but emphasised that Ofcom and the government must ensure Wikipedia is protected as the Online Safety Act is implemented, and did not give them unrestricted authority to impose measures that would significantly impede Wikipedia’s operations.

Although the decision means Wikipedia could still be subject to the strictest Category 1 rules, it does leave open the possibility for future legal challenges if Ofcom decides to classify the site in this way. The judgment acknowledged that Wikipedia is different from other user-to-user platforms and suggested that exemption from the stricter rules could still be considered upon review. 

31 July 2025 –Ofcom investigates 34 porn sites under new age-check rules

Ofcom has launched formal investigations into four companies operating 34 pornography websites to assess their compliance with new age-check requirements under the Online Safety Act. These rules, which came into force on 25 July 2025, require sites allowing user-uploaded pornographic content to implement highly effective age assurance measures to prevent children from accessing such material. The companies under investigation—8579 LLC, AVS Group Ltd, Kick Online Entertainment S.A., and Trendio Ltd—were prioritised due to the potential risk of harm and their large UK user bases.

Ofcom will now review evidence to determine whether these providers have breached their duties. If compliance failures are identified, provisional notices of contravention will be issued, allowing the companies to respond before final decisions are made. Ofcom has the authority to require corrective action, impose significant fines, and, in the most serious cases, seek court orders to disrupt business operations, including blocking access to non-compliant sites in the UK. Updates on these investigations will follow in due course.

25 July 2025 – Repeal of the UK’s Video-Sharing Platforms regime

On 25 July 2025, the UK’s Video-Sharing Platforms (VSP) regime was repealed, marking the end of four years as the country's primary framework for online safety regulation. All services previously regulated under the VSP regime are now subject to the Online Safety Act.

25 July 2025 – Online age checks must be in force from 25 July 2025

With the deadline for completing the first children’s risk assessments having passed on the 24 July 2025, the duties to protect children from harms online are now in force. From 25 July 2025, tech firms must implement robust age checks to prevent children from accessing online pornography and other harmful content, such as material related to self-harm, suicide, and eating disorders. Major platforms—including Pornhub, Bluesky, Discord, Grindr, Reddit, and X—have committed to deploying age checks across their services. Ofcom will enforce compliance, extending its oversight to all sites that allow user-shared pornographic content. The regulator will also monitor the largest platforms used by children, requiring them to assess and report on their child safety measures, particularly around content feeds and algorithms. Most UK parents support these new protections, though some doubt tech firms will fully comply. Ofcom warns that non-compliance will result in enforcement action.

21 July 2025 – Ofcom publishes its final transparency statement and transparency reporting guidance

Ofcom published its final transparency statement and guidance on transparency reporting. This guidance clarifies when and how Ofcom will use its transparency powers, outlining the process for transparency reporting under the Online Safety Act. The guidance details the requirements for providers of "categorised services"—such as social media, search, and pornography platforms listed on Ofcom’s public register—to publish transparency reports. These reports must include information specified by Ofcom in transparency notices, and the guidance explains the factors Ofcom will consider in determining what information must be disclosed. It also sets out how Ofcom will engage with stakeholders during the reporting process. Ofcom will also publish its own transparency report, which will analyse and draw conclusions from the reports submitted by service providers.

18 July 2025 – Ofcom publishes second consultation on online safety fees and penalties

Ofcom launched its second consultation on implementing the online safety fees and penalties regime. It provides draft guidance to help service providers calculate their Qualifying Worldwide Revenue (QWR), which determines whether they are required to pay fees under the Online Safety Act. The Act mandates that Ofcom’s costs for regulating online safety are recovered from certain providers of regulated services, specifically those whose QWR exceeds a threshold set by the Secretary of State. The recently laid regulations define QWR as the total revenue generated worldwide from relevant parts of a provider’s regulated services and require providers to use a ‘just and reasonable approach’ when apportioning revenue between regulated and other activities. The consultation remains open until 10 September 2025.

11 July 2025 – Ofcom publishes paper exploring how different tools can be used to identify deepfakes

Ofcom published a discussion paper examining tools to identify deepfakes—AI-generated fake videos, images, and audio—which threaten online safety. The paper evaluates four main ‘attribution measures’: watermarking, provenance metadata, AI labels, and context annotations. These tools aim to help users recognise AI-generated content and understand how it was created. The paper highlights that attribution measures can help users think more critically about content but should not place all responsibility on individuals. It stresses the need for clear communication, standardisation, and combining attribution with other interventions, as these measures can be manipulated or removed. The findings are intended to guide industry and policy, rather than set new rules, and will inform Ofcom’s future work under the Online Safety Act.

11 July 2025 – MPs demand stronger regulation of misinformation and AI content

A report from the Science, Innovation and Technology Committee (SITC) criticised the Online Safety Act (OSA) for failing to address the algorithmic spread of misinformation and the risks posed by generative AI. The committee highlights that social media companies, motivated by profit, have amplified false and harmful content. MPs warn that the OSA does not cover ‘legal but harmful’ content or provide sufficient oversight of recommendation algorithms. They call for a new regulatory regime based on public safety, free expression, platform accountability, user control, and transparency. Key recommendations include requiring platforms to deprioritise fact-checked misinformation, increasing algorithmic transparency, and introducing legislation to regulate generative AI. The report also identifies a gap in regulating the digital advertising market, urging stronger action against the monetisation of harmful content. The committee stresses the need to protect free speech while imposing proportionate restrictions on the spread of misinformation and calls for urgent government action to strengthen online safety.

9 July 2025 – Enforcing the Online Safety Act: Children’s risk assessments

Ofcom announced that several online services are now required to submit their written records of children’s risk assessments by 7 August 2025 or face potential enforcement action. This requirement forms part of Ofcom’s ongoing enforcement programme under the Online Safety Act, specifically targeting the protection of children online. On 24 April, Ofcom published its children’s safety codes of practice and accompanying guidance. Providers need to complete a suitable and sufficient children’s risk assessment in line with Ofcom’s requirements by 24 July 2025. Providers must not only carry out these risk assessments, but also make and keep a detailed written record, including how the assessment was conducted, its findings, and how it will be kept under review. Ofcom has now issued formal statutory information requests to a number of service providers.

30 June 2025 – Ofcom launches consultation on additional safety measures

Ofcom opened a new consultation seeking views on a further set of targeted safety proposals under the Online Safety Act. These latest proposals aim to limit the spread of illegal content through improvements to recommendation features and crisis response protocols, expand the use of proactive technologies, such as hash-matching and fraud detection, and enhance protections for children via stronger age assurance and livestream interaction controls. The consultation remains open until 20 October 2025.

26 June 2025 – Statement: Online Safety - fees and penalties

Ofcom has published its final policy statement following consultation responses on implementing the online safety fees and penalties regime under the Online Safety Act. The statement sets out final decisions on defining and calculating Qualifying Worldwide Revenue (QWR) for online safety fees and penalties, exemptions, and the QWR Notifications process. Ofcom has advised the Secretary of State on the QWR Threshold, expected to be laid in Parliament in Q4 2025, after which liable providers must submit their QWR notifications to Ofcom. Ofcom stated that for the first charging year, notifications need to be submitted within four months of the date on which the threshold regulations come into force. Ofcom’s decision on the UK referable revenue exemption has been submitted to the Secretary of State for approval, with an announcement on the outcome of the approval process to follow.

26 June 2025 – UK’s major porn providers agree to age checks from next month

Ofcom announced that from 25 July 2025, all sites and apps that allow pornography, including adult sites, social media, search and gaming services, must implement highly effective age checks to prevent children from accessing adult content. Major porn providers operating in the UK, including PornHub, YouPorn, RedTube, BoyfriendTV, Cam4, FrolicMe, inxxx, Jerkmate, LiveHDCams, MyDirtyHobby, Streamate, Stripchat and Tube8 have confirmed compliance. Ofcom has warned that it will take enforcement action against non-compliant services, such as imposing fines or applying for a court order to prevent the site or app from being available in the UK.

26 June 2025 – Age checks for online safety – what you need to know as a user

Ofcom explains the upcoming age check requirements under the Online Safety Act, coming into effect on 25 July 2025. All sites and apps allowing pornography must implement strong age verification to prevent children from accessing harmful content. This marks a major change in how adults in the UK access online pornography, moving beyond simple “over 18” clicks. Various secure methods—such as facial age estimation, open banking, digital ID services, credit card age checks, email-based age estimation, mobile network operator age checks and photo-ID matching—may be used to confirm users’ ages while protecting their privacy. Research shows that 8% of UK children aged 8-14 access porn monthly, highlighting the need for these measures. Sites failing to comply risk being blocked in the UK.Trying to track the staggered implementation of the UK Online Safety Act 2023 (“OSA”)? You are in safe hands here. See the latest updates and key dates below.

12 June 2025 – New online super-complaint regime due in force from 31 December 2025 under the Online Safety Act

The UK government published the Online Safety Super-Complaints (Eligibility and Procedural Matters) Regulations 2025, setting out the framework for a new super-complaint’ regime, which comes into force on 31 December 2025. The regime will allow eligible entities to escalate concerns to Ofcom about systemic failings by online services to protect users from harm. Super-complaints must include evidence and will trigger Ofcom’s duty to investigate and respond within a specified timeframe. To submit a super-complaint, an organisation must represent the interests of users or the public; be independent from the regulated services (some links allowed with safeguards); demonstrate online safety expertise; and be reliable in following Ofcom’s guidance. The draft regulations outline the procedural steps required to submit an admissible complaint for Ofcom’s consideration as well as the requirements for how Ofcom must respond to such complaints. Ofcom will publish guidance to support organisations when submitting a super complaint.

10 June 2025 – Ofcom opens nine new investigations under the Online Safety Act

Ofcom launched investigations into 4chan and seven file-sharing services – Im.ge, Krakenfiles, Nippybox, Nippydrive, Nippyshare, Nippyspace and Yolobit. Specifically, it is looking at whether these services have failed to put appropriate safety measures in place to protect UK users from illegal content and activity; complete – and keep a record of – a suitable and sufficient illegal harms risk assessment; and respond to a statutory information request. Ofcom also launched an investigation into porn provider First Time Videos LLC for potentially lacking effective age-verification tools on its pornographic websites.

14 May 2025 – Ofcom investigates Kick Online Entertainment

Ofcom launched two investigations into whether Kick Online Entertainment S.A (Kick Online), which is responsible for providing the pornography website Motherless.com, has failed to comply with its duties under the Online Safety Act. The investigations relate to the failure to complete and keep a record of a suitable and sufficient illegal risk assessment and to respond to Ofcom’s statutory information request. Ofcom is also considering launching an investigation as to whether Kick Online has put appropriate safety measures in place to protect its UK users from illegal content, particularly child sexual abuse material and extreme pornography.

9 May 2025 – Ofcom investigates two porn services under age assurance enforcement programme

Ofcom has announced that it is launching investigations into two pornographic services – Itai Tech Ltd and Score Internet Group LLC – under its age assurance enforcement programme. Both sites appear to have no effective age assurance in place and are therefore being investigated for a potential breach of their duties under the OSA. Highly effective age assurance duties for Part 5 services came into force in January 2025 and required services to act immediately to introduce effective age checks. Ofcom also requested that all Part 5 services provide details of their implementation timeline and a named point of contact, though certain services have failed to comply with this request and have not yet taken any steps to prevent children from accessing the pornographic material available on their services. Ofcom has stated that it will provide updates on the outcome of the investigations in due course.

24 April 2025 – Ofcom opens consultation on amending its Illegal Content Codes of Practice under the Online Safety Act

Ofcom launched a consultation proposing amendments to its Illegal Content Codes of Practice under the Online Safety Act. The changes would expand the application of ICU J1 (blocking and muting user accounts) and ICU J2 (disabling comments) to certain smaller user-to-user platforms that are likely to be accessed by children and present relevant risk factors. Ofcom is proposing that this extension will enhance consistency and raise child safety standards across a broader range of online platforms. The consultation closes on 22 July 2025.

24 April 2025 – Ofcom finalises child safety measures for sites and apps to introduce by July

Ofcom has finalised more than 40 practical measures for service providers to meet their duties under the Online Safety Act to protect children online. These measures include robust age checks, effective content moderation systems, and safer algorithm configurations, amongst others. They are designed to build on and complement the specific rules and requirements that Ofcom has already put in place to prevent children from encountering online pornography and to protect users from illegal online harms. Providers of services likely to be accessed by UK children must complete and record their children’s risk assessments by 24 July 2025 and implement safety measures to mitigate these risks by 25 July 2025.

9 April 2025 – Ofcom investigates online suicide forum

Ofcom launched its first investigation into an unnamed provider of an online suicide forum. The investigation will determine whether the service has failed to comply with its OSA duties, including: (a) putting appropriate safety measures in place to protect users from illegal content; (b) completing an illegal harms risk assessment and corresponding record-keeping duties; and (c) accurately responding to a statutory information request. Following several attempts by Ofcom to engage with the provider and an unsatisfactory response to a statutory information request. Ofcom has maintained that it will not hesitate to take enforcement action if the provider is found to be in breach of its OSA obligations (including imposing fines of up to £18m or 10% of qualifying worldwide revenue, whichever is greater). Ofcom will publish a report from the investigation once it is concluded.

27 March 2025 – Ofcom issues £1.05 million fine to provider of OnlyFans

Ofcom has fined the provider of OnlyFans, Fenix International Limited, £1.05 million for failing to accurately respond to statutory information requests about age assurance measures on the platform. On two occasions, Ofcom sought information from Fenix on the platform’s implementation of age checks and the effectiveness of the platform’s third-party facial estimation technology. Ofcom expects platform providers to have robust checks in place to ensure information is thoroughly reviewed and crosschecked before being submitted. As part of the Ofcom’s the request, Fenix reported that the ‘challenge age’ for its facial age estimation technology was set at 23 years old when it was in fact set at 20 years old, and it had taken the company over 16 months to discover this mistake, in addition to a further two weeks to then report the error to Ofcom. Ofcom found that Fenix contravened its duties in providing accurate reporting to Ofcom. The final fine did include a 30% reduction of the amount, because of Fenix accepting the findings and settling the case.

26 February 2025 – Ofcom finalises guidance on the exercise of its information gathering powers

Under the Online Safety Act, Ofcom has legal powers to gather information held by regulated companies and third parties to provide robust evidence for the purpose of investigations. Ofcom has now published its Guidance on the scope of these powers, the duties of services and other people to comply, and the potential consequences of non-compliance. The Guidance outlines the specific powers Ofcom has, including the power to issue information notices, the power to appoint a skilled person to provide a report, and the powers of audit, entry, and inspection. Ofcom has also provided examples of when these powers may be exercised, instructions on how to comply, and explanations of how datasets may be used during this process. Since the publication of the draft Guidance, Ofcom has mostly made changes to provide further details about the general mechanics of the powers, as requested by stakeholders in response to the open consultation. Ofcom has warned that non-compliance with these powers will result in enforcement action, namely the imposition of a financial penalty or the requiring of specific steps to be taken to come into compliance.

25 February 2025 – Ofcom publishes guidance on women and girls' online safety

Ofcom has published its guidance on measures for service providers to improve the online safety of women and girls. Ofcom has identified four key harms to focus on, namely online misogyny, pile-ons and online harassment, online domestic abuse, and intimate image abuse. In tackling these four harms, Ofcom has set out nine high-level actions for services to take to protect women and girls online, including conducting risk assessments, setting safer defaults, and taking appropriate action when online gender-based harms occur. Within each of these actions, Ofcom has additionally set out a number of examples of good industry practice to illustrate specific changes that can be implemented, including enforcement action taken against repeat violators, adding watermarks and metadata, and adding fact-checking and labelling. Ofcom has also opened a consultation on the draft guidance and is accepting responses until 23 May 2025.

24 January 2025 – Ofcom’s annual report on notices to deal with terrorism content and/or CSEA content

Ofcom has published its first annual report on notices to deal with terrorism content and/or CSEA content, largely drawing on Ofcom’s power to exercise Technology Notice functions under Chapter 5 Part 7 of the Online Safety Act. Ofcom must first advise the Secretary of State about minimum standards of accuracy in the detection of such content before the finalised standards can be published. As a result, Ofcom have not yet been able to assess whether there is any technology which meets any such minimum standards of accuracy. Furthermore, the report also outlined Ofcom’s preparatory work over the last year in relation to its Technology Notice functions, particularly the launching of Consultation: Technology Notices. Following a multi-stakeholder workshop and the commissioning of external consultancy research, the consultation has been launched to cover Ofcom’s policy proposals for advice to the Secretary of State on setting the minimum standards of accuracy, and draft guidance for Part 3 service providers. The deadline to respond to the consultation is 10 March 2025.

23 January 2025 – Ofcom fines video-sharing platform MintStars £7,000

Ofcom has issued a £7,000 fine to video-sharing platform (“VSP”), MintStars Ltd, for failing to adequately protect children from accessing online pornography. An investigation into the platform revealed that MintStars did not have sufficiently robust measures in place or implement measures effectively. Ofcom found that pornographic content could be accessed by any person who visited the site, both through ‘preview’ clips and by subscribing to creators’ content. The ‘self-declaration’ by users that they were over 18 was found to be an inappropriate form of age verification and represented a serious breach of the platform’s duties under the VSP regime. Ofcom’s investigation was concluded with the imposition of a £7,000 fine, reduced by 30% to reflect MintStar’s willingness to admit full liability for this breach, and the platform’s small size and financial position. Ofcom has repeatedly warned of its willingness to take action against non-compliant providers, particularly in the launch of its new enforcement programme to tackle services that display or publish pornographic content.

21 January 2025 – Ofcom launches digital safety toolkit for online services

In an effort to ensure wide-scale compliance, Ofcom has launched a digital toolkit to help online services comply with the Online Safety Act. The toolkit may be useful to any organisation that falls within the scope of the Act, but it has been designed to assist small and medium-sized providers of user-to-user services and search services. Upon answering a handful of questions, the tool will provide tailored compliance recommendations to the provider, including an overview of the required safety measures and how risks of illegal harms could arise on the service. The tool has been launched to help businesses better understand their responsibilities to complete an illegal content risk assessment and comply with safety duties, record-keeping, and reviewing. Ofcom has, however, reiterated that the responsibility to comply still lies with the service providers.

16 January 2025 – Ofcom publishes Children’s Access Assessment Guidance

All services in scope of the OSA are required to carry out children’s access assessments to determine whether their service, or a part of their service, is likely to be accessed by children under the age of 18. The guidance sets out the step-by-step process and recommended factors and evidence to consider at each stage. Child access assessments must be completed by 16 April 2025. The statement also confirms that where a service provider fails to complete an assessment, the service will be treated as likely to be accessed by children and may face enforcement action taken by Ofcom, including significant financial penalties and remedial action.

16 January 2025 – Ofcom publishes guidance on age checks to protect children online

Ofcom has published its industry guidance on highly effective age assurance for Part 5 services to protect children from encountering harmful content and pornographic material online and Part 3 services for the user-to-user aspects of a service.

The final guidance confirms the criteria for ‘highly effective’, being technically accurate, reliable, and fair. The guidance also provides some examples of methods that could be considered HEAA, including credit card checks, digital identity services, email-based age estimation, photo ID matching, and facial age estimation, and those that will not suffice, such as self-declaration, debit cards (which in the UK do not require a user to be over the age of 18), and general contractual restrictions.

Part 5 services that publish their own pornographic content must act immediately to introduce effective age checks, but Part 3 services must introduce highly effective age assurance methods by July 2025.

16 January 2025 – Ofcom publishes Age Assurance and Children’s Access Statement

Ofcom has published an overview of the confirmed approach to child access assessments and highly effective age assurance (HEAA). The statement explains Ofcom’s duties together with providing supporting information they must include from a statutory perspective including evidence relied on and their impact assessment carried out in respect of the proposals. It also provides a summary of key themes in responses to its previous consultation and explains how they have responded to consultation comments in their final guidance.

16 December 2024 – Ofcom publishes a consultation on Technology Notice powers

Ofcom has published their consultation on the framework underpinning their Online Safety Technology Notice powers to tackle terrorism and child sexual exploitation and abuse (CSEA) content. The consultation outlines their policy proposals for minimum standards of accuracy for accredited technologies. Their proposed approach would require applicants to complete an accreditation application form and an audit-based assessment before being pooled into categories of technologies and independently performance tested. It also outlines Ofcom’s draft Technology Notice Guidance for service providers. The guidance is expected to cover 8 sections, including: a summary of the legal framework; Ofcom’s approach to the assessment; what might prompt an exercise of the powers; what to expect when Ofcom is considering issuing a Notice; the stages of Ofcom’s process to decide whether to issue a Notice; next steps following the issuing of a Notice; and the disclosure of information about the exercise of Ofcom’s functions. Responses to the consultation will close on 10 March 2025.

16 December 2024 – Ofcom publishes an update on next steps as regulations come into force

Ofcom has published its first-edition codes of practice on tackling illegal harms under the Online Safety Act. The publication of these codes means that providers now have until 16 March 2025 to complete their illegal harms risk assessment and must start implementing safety measures to mitigate these risks from 17 March 2025. Ahead of these deadlines, Ofcom has reiterated the extent of its enforcement powers. Namely, Ofcom has the power to fine companies up to £18m or 10% of their qualifying world revenue (QWR), as well as the power to apply for a court order to block a site in the UK. Ofcom has also outlined the most important changes delivered by the codes and guidance. These changes include senior accountability for safety; better moderation, easier reporting, and built-in safety tests; and protecting children from sexual abuse and exploitation online.

16 December 2024 – Statement by the SoS approving the categorization thresholds

Government has approved Ofcom’s draft Regulations setting out the threshold conditions for Category 1, 2A and 2B services under the Act. The threshold conditions are: (1) Category 1: (i) services with content recommender systems and a user base of 34 million UK users; or (ii) services with content recommender systems, the ability for users to forward or re-share existing content on the service, and a user base of 7 million UK users; (2) Category 2A: non-vertical search services with more than 7 million UK users; or (3) Category 2B: user-to-user services that allow users to send direct messages and have more than 3 million UK users.

20 November 2024 – Government publishes a draft Statement of Strategic Priorities covering online safety policy priorities

The government have published a draft Statement setting out their strategic priorities for online safety, marking the first time the power is being exercised by the government. The purpose for the statement is to set out priorities for Ofcom to consider when exercising its regulatory functions and to guide the government’s implementation of the Online Safety Act. Ofcom will also have to report back to the Secretary of State on what action it has taken to ensure the priorities are being upheld. The five priorities include (1) safety by design, (2) transparency and accountability, (3) agile regulation, (4) inclusivity and resilience, and (5) technology and innovation. 

15 November 2024 – Ofcom reiterates important dates for Online Safety Act compliance

With the first new duties taking effect towards the end of 2024, Ofcom has created a table to explain the important milestones for compliance. The table includes compulsory duties and optional deadlines to respond to consultations, outlining both the start date and the completion date for each milestone. The keyword search feature also allows users to find deadlines specific to their service type. As the earliest start date is December 2024, online service providers are encouraged to make use of the table and the guidance links provided to ensure their compliance with the new duties.

8 November 2024 – Ofcom publishes an open letter to online service providers regarding Generative AI and chatbots

Ofcom has published an open letter to UK online service providers to clarify how the Online Safety Act will apply to Generative AI and chatbots. The letter comes in the wake of the recent news surrounding the misuse of AI, including the use of a Generative AI chatbot platform to create ‘virtual clones’ of real people and deceased children. Ofcom have reiterated what is regulated under the OSA and how it applies to Generative AI chatbot tools and platforms. The letter strongly urges online service providers to prepare now to comply with the relevant duties using the draft Codes of Practice, with the first duties beginning to take effect from December 2024.

24 October 2024 – Ofcom publishes a consultation on a fees and penalties regime

Ofcom has published the first consultation on a new fees and penalties regime to respond to breaches of the Online Safety Act. Fees will be calculated based on providers’ qualifying worldwide revenue (“QWR”) which will then be used to calculate the maximum penalty cap that can be imposed on providers. Ofcom has now drafted secondary legislation to define QWR for the purposes of these calculations. The consultation also proposes a different approach when group undertakings are found jointly and severally liable, with the maximum penalty cap being the greater of £18 million or 10% of the QWR of the provider and every group undertaking related to the provider at the time. Responses to the consultation will close on 9 January 2025.

17 October 2024 – Ofcom publishes a progress update on the roadmap to regulation

Ofcom has provided an update on their progress since the Online Safety Act became law. The update outlines what Ofcom have done to implement the new rules, including publishing their media literacy strategy and publishing proposals for how services should approach content that is harmful to children. The progress report also outlines Ofcom’s intended next steps, focusing on illegal harms (Phase 1), child safety, pornography and the protection of women and girls (Phase 2), and categorisation and additional duties for categorised services (Phase 3).

The roadmap has been updated since the last progress report in October 2023. The implementation plan for Phase 1 remains largely unchanged, except for two additional consultations now proposed: one in December 2024 on minimum standards of accuracy and accreditation for terrorism notices, and another in Q2 2025 on additional measures.

Phase 2 has been reprioritised, with Ofcom accelerating certain implementation steps:

• The consultation on protecting women and girls has been advanced from Q2 2025 to February 2025.
• The timeline for completing children’s access assessments has been moved up from Q2 2025 to Q1 2025, with children’s risk assessments shifted forward from Q3 2025 to Q2 2025.
• The enforcement of the protection of children Codes is now expected in July 2025, earlier than the previous Q3-Q4 2025 timeframe.

These changes have led to Phase 3 being deferred to 2026, instead of 2025 as initially planned. Additionally, the updated roadmap outlines plan for Ofcom to issue advice on fee thresholds in April 2025 and release final guidance for super complaints in Q4 2025.

13 September 2024 – Government makes intimate image abuse a priority offence

The Government announced that the act of sharing intimate images without consent will be classified as a priority offence, which is the most serious type of offence under the Online Safety Act.

7 August 2024 – Ofcom publishes an open letter to online service providers

Ofcom has published an open letter urging UK online service providers to take immediate steps to prevent their platforms from being used to incite hatred, violence, or other illegal activities. The letter reiterates the need for proactive measures ahead of the Online Safety Act’s full implementation, noting that once the final codes of practice are released later this year, platforms will have three months to assess and mitigate risks, and must swiftly address illegal content.

2 August 2024 – Consultation opened: torture and animal cruelty and update on timing for illegal content assessments

Ofcom is consulting on updating its draft illegal harms codes and guidance under the Online Safety Act to include animal cruelty and human torture as content that platforms must address. This follows the November 2023 consultation, where animal cruelty was recognized as a late addition to the Act. The regulatory documents will be published alongside the Illegal Harms Statement in December 2024.

Following the publication of the documents, providers will have three months to conduct their illegal content risk assessment. This assessment will incorporate proposals from the torture and animal harms consultation, the illegal content discussed in the November 2023 consultation, and the findings from the May 2024 protection of children consultation.

The consultation period will run until 13 September 2024.  

26 July 2024 – Consultation opened: draft transparency reporting guidance and online safety information guidance

Ofcom is consulting on draft statutory transparency reporting guidance covering the process that it will adopt for deciding what providers must include in their transparency reports. The guidance will also include how information from these reports will be used to inform Ofcom’s transparency report.

Additionally, Ofcom is seeking input on its proposed online safety information guidance. The proposal outlines when and how Ofcom may exercise its powers, designed to be adaptable to account for the specific circumstances in which these powers might be applied.

The consultation period will run until 4 October 2024.  

17 July 2024 – Consultation closed: protecting children from harms online

Ofcom will consider all the responses and publish a regulatory statement and conclusions. 

8 May 2024 – Consultation opened: protecting children from harms online

Ofcom published the second major consultation focusing on the proposal for how user-to-user services and search services should protect children from harmful content. The proposal includes draft Children’s Safety Code, draft Children’s Risk Assessment Guidance, and draft Children’s Access Assessment. The consultation will end on 17 July 2024.

19 April 2024 – Ofcom publishes principles for media literacy by design

Following a consultation on good media literacy ‘by design’ is for social media, search, video sharing and gaming services, Ofcom suggested 14 common principles categorised under the following:

1. Proactivity, priority, transparency and accountability;
2. User-centric design and timely interventions; and
3. Monitoring and evaluating.

The principles align with what is expected for services regulated under the OSA.

1 April 2024 – Additional provisions from the OSA coming into force

Sections 101 (information in connection with an investigation into the death of a child) and 102 (information notices) came into force under the Online Safety Act 2023 (Commencement No. 2) Regulations 2023.

25 March 2024 – Consultation opened: additional duties applicable to online sites and apps

The regulator started the third phase of online safety regulation regarding extra duties for categorised services (i.e. those falling into Category 1, 2A or 2B). These extra obligations include empowering users with content control tools, safeguarding journalistic content, combating fraudulent advertising, and issuing transparency reports. To formulate codes of practice and guidance, Ofcom invites stakeholders to provide evidence, with a formal consultation scheduled for 2025 to incorporate feedback and finalize the regulatory framework.

5 March 2024 – Consultation closed: guidance for serving providers publishing pornographic content

The regulator closed the second out of four major consultations According to Ofcom’s timeline, final guidance and Parliamentary approval is expected in 2025. Ofcom also published additional materials, including draft guidance, covering online pornography regulation.

29 February 2024 - Ofcom advises the government on categorisation of services

Following research and industry consultation, Ofcom submitted its advice to the Secretary of State on the categorisation of services. In its recommendation, Ofcom sets out thresholds for each service category:

1. Category 1 - Thresholds should target services meeting either of two conditions:

   a. Condition 1: Using a content recommender system, with over 34 million UK users.
   b. Condition 2: Allowing content forwarding or resharing, using a content recommender system, with over 7 million UK users.

2. Category 2A - thresholds should target search services (excluding vertical ones) with over 7 million UK users.
3. Category 2B - thresholds target services allowing direct messaging, with over 3 million UK users.

23 February 2024 – Consultation period closed: protecting people from illegal harms

Ofcom will consider all the responses and plan to publish a regulatory statement and conclusions around the end of 2024. The code of practice is then expected to be submitted for Parliamentary approval.

21 February 2024 – House of Commons Committee Report: Preparedness for online safety regulation

The Committee of Public Accounts published recommendations to the government, including the importance of meeting implementation deadlines for the OSA and for Ofcom to work on ensuring they are well-placed to monitor and enforce the OSA.

31 January 2024 – Additional provisions from the OSA coming into force

Part 10 of the OSA, which deals with communications offences, came into force through the Online Safety Act 2023 (Commencement No. 3) Regulations 2024.

29 January 2024 – Overseas regulators published

The Online Safety (List of Overseas Regulators) Regulations 2024 specify overseas regulators for the purposes of section 114, covering cooperation and disclosure of information among them and Ofcom. The list includes the European Commission and regulators from Australia, Ireland, Netherlands, Germany and France.

10 January 2024 – The Online Safety Act 2023 (Commencement No. 3) Regulations 2024

The regulation was passed and will bring into force Part 10 of the OSA on 31 January 2024. Part 10 creates various new offences such as sending flashing images, sending false communications, encouraging or assisting serious self-harm and threatening communications. The section also establishes extra-territorial application for such offences and liability of corporate officers.

10 January 2024 – Additional provisions from the OSA coming into force

Many provisions of the OSA came into force through the Online Safety Act 2023 (Commencement No. 2) Regulations 2023, including the remaining provisions of section 72 (Further duties about terms of service) which deals with ensuring that user-to-user service includes clear and accessible provisions in the terms of service informing users about their right to bring a claim for breach of contract.

19 December 2023 – The Online Safety Act 2023 (Commencement No. 2) Regulations 2023

The regulation was passed and will bring into force many provisions of the OSA on 10 January 2024 and 1 April 2024.

5 December 2023 – Consultation opened: guidance for serving providers publishing pornographic content

The second consultation focuses on draft guidance to assist providers of online services that publish or display regulated provider pornographic content in complying with their age assurance and record-keeping obligations under the OSA.

21 November 2023 – The Online Safety Act 2023 (Commencement No. 1) Regulations 2023

The regulation establish that subsections (2) and (7) of section 114 of the OSA come into force on 22 November 2023. These subsections deal with cooperation with overseas regulators.

9 November 2023 – Consultation opened: protecting people from illegal harms online started

As the first of four major consultations that Ofcom will publish for the OSA, the consultation focuses on proposals for how internet services that enable the sharing of user-generated content and search services should approach their new duties relating to illegal content.

26 October 2023 – The Online Safety Act 2023 received royal assent and became law in the UK

The law applies to online service providers that permit users to exchange user-generated content and to search engines. Find out more in a write-up when it was introduced.