Internet & Online Safety - United Kingdom

Phase 1 illegal-content duties came into force on 17 March 2025; Phase 2 children's safety duties took effect on 25 July 2025. Phase 3, covering the Register of Categorised Services (Categories 1, 2A, 2B) and associated enhanced duties for the largest platforms, was delayed to July 2026 following a successful legal challenge by the Wikimedia Foundation against the categorisation regulations.

Since 25 July 2025, platforms likely to be accessed by children must deploy 'highly effective' age assurance (photo ID, biometric, or credit-card checks) to prevent under-18s from accessing pornography and content promoting self-harm, suicide, or eating disorders. Ofcom's Protection of Children Codes of Practice (April 2025) specify acceptable methods. A UK Government consultation on further expansion of age-verification requirements closed 26 May 2026.

Ofcom may impose fines of up to £18 million or 10% of qualifying worldwide revenue (whichever is greater) for breaches. In the most serious cases it may seek court orders for 'business interruption measures', including ISP blocking and withdrawal of payment or advertising services. By February 2026, Ofcom had opened investigations into more than 90 platforms and issued six fines, including an £800,000 penalty against Kick Online Entertainment and a £1.35 million penalty (the largest to date) against 8579 LLC.

The OSA imposes duties of care on both UK-based and global platforms that have a 'significant number' of UK users or target UK users as a market. User-to-user services, search engines, and app stores are in scope. Category 1 providers (the largest, once the register is finalised) will face additional obligations, including user-identification verification and user-empowerment tools.

On 8 May 2026, Ofcom published a refreshed regulatory roadmap for March 2026–May 2027, setting three enforcement priorities: strengthening child protection, tackling illegal hate content, and improving online safety for women and girls. Ofcom also opened a formal investigation into X (Grok AI) in January 2026 for potential CSAM-related failures, and a separate investigation into Joi.com (Novi Ltd) for age-assurance gaps, signalling expanding scrutiny of AI-generated content.

The OSA has faced judicial scrutiny: the Wikimedia Foundation's challenge to categorisation regulations concluded in August 2025, contributing to the delay of Phase 3. In May 2026, Meta commenced judicial review proceedings against Ofcom in the High Court, contesting how OSA administrative fees are calculated.