Online Safety Act

Since March 2025, when the first of the online safety Codes became enforceable (Illegal Content Codes of Practice), Ofcom has launched five programmes and investigated 69 platforms for compliance failures under the UK’s Online Safety Act (OSA). Six months on, Ofcom has issued an update on 11 of the ongoing investigations. Current areas of focus include: 

• Failure to respond to information requests - Ofcom has issued a GBP20,000 fine against one provider that failed to respond to information requests, with penalties of GBP100 per day now accruing. Two further providers have been sent provisional decisions on their failure to respond and will have an opportunity to make representations to Ofcom ahead of its final decision. 

• Monitoring Geoblocking - some providers have taken steps to prevent UK users from accessing their sites, aiming to remove their service from scope of the OSA, rather than implement OSA safety measures. Ofcom has closed four investigations against file-sharing sites who opted for this approach but continues to monitor their availability in the UK and may reopen investigations if needed. 

• Use of hash-matching tech post-enforcement - Ofcom raised compliance concerns with two file-sharing services, who have since adopted perceptual hash-matching technology to detect and remove child sexual abuse material (CSAM), in line with Ofcom’s Illegal Content Codes.

The OSA applies to user-to-user and search services, including social media, messaging platforms, and forums, regardless of location if they target UK users. Companies must conduct risk assessments for illegal content and implement proportionate safety measures. Non-compliance risks substantial penalties: up to GBP18 million or 10% of global revenue, and potential criminal liability for senior officers. Alongside its enforcement activities, Ofcom is still carrying out implementation work for certain aspects of the OSA. The next stage in Ofcom's ongoing implementation roadmap is to publish a register of Category 1 and 2 providers who will face enhanced duties. Originally intended to be finalised in Summer 2025, the register was delayed following a legal challenge to the secondary legislation setting the thresholds as to which services will be categorised.