Ofcom—written evidence (IOS0039)

House of Lords Communications and Digital Select Committee inquiry:

The Online Safety Act: implementation and impact

1. Summary

1.1                 The Online Safety Act 2023 (OSA) marked a fundamental change: for the first time online services serving users in the UK must assess their risks and put systems in place to reduce illegal harm and protect children. Before the OSA the tech industry had faced almost no safety regulation since social media came to prominence 20 years ago. Ofcom’s aim in operating the new online safety regime is clear: a safer online life for people in the UK, with the strongest protection for children, while respecting privacy and freedom of expression.

1.2                 At Ofcom, around 450 people work specifically on online safety, combining policy, supervision, enforcement, technology, data, legal, analytical and research expertise. In this new area of regulation we have pioneered dedicated supervision of the largest and riskiest services, an approach now replicated by regulators in Australia and Ireland. We have also helped lead a global approach to online safety through international partnerships and establishing a global network of regulators. Over time the focus of our work has moved from building policy, to preparing industry, to now driving compliance and enforcement since the duties became enforceable in March 2025.

1.3                 We have a strong track record of implementing the OSA, launching our consultation on illegal-content duties just days after Royal Assent and we have met all the deadlines set by Parliament. Our Illegal Harms and Protection of Children Codes are, as far as we know, the most comprehensive and wide-ranging in the world.

1.4                 It is important that we are driven by the evidence. Ofcom runs a comprehensive research programme involving surveys, measurement of online use, platform audits and ‘avatar’ research showing what users may encounter. We also collect information from services and intelligence from civil society, academia, regulators and law enforcement. Our dedicated Data and Intelligence team and monitoring programme uses this information to inform our regulatory priorities and compliance decisions, built from a detailed picture of people’s real experiences online. This helps us keep the implementation of the Act rooted in people’s lived experience of the online world.

1.5                 We are making change happen. Taking the example of age checks, our evidence suggests the number of checks being completed has grown 23-fold. Among the 100 most-used adult services, 63 (including all the top 10) now have strong checks in place, and 11 more have blocked UK access. When we investigated ten services over hosting child sexual abuse material, six became unavailable to UK users, three came into compliance and one investigation remains open. Under our watch, X has committed to faster timelines for reviewing hate and terror content. X and Etsy have changed their policy on 3D-printed weapons. A prominent suicide site has introduced a UK block. Services have introduced mechanisms allowing relevant bodies to report and reduce online fraud. After we challenged the platforms most used by children to go further, Snap committed to adopting our measures to prevent grooming, while Meta and Roblox also introduced stronger protections. We have subsequently opened an investigation into TikTok on the grounds of failure to protect children from harmful content. Another major, ongoing investigation is into the Grok AI chatbot, relating to suspected intimate image abuse and child sex abuse material. These are just some examples of how we are making the online world safer.

1.6                 We are under no illusions that there is still a long way to go. After two decades without regulation, the industry does not yet have a mature, pro-active, responsible safety culture. Most companies are based in the United States, far from UK or European public policy debates. It is disappointing but perhaps not surprising that the response of some services to the risks that they pose to children has been wholly inadequate. An important insight into prevailing corporate cultures is that virtually none of the big social media services currently enforce their own minimum age requirements effectively, even though these are set out in their own terms and conditions.

1.7                 The OSA established a novel regime in a new regulatory field and we have learned a lot since the first parts of the Act came into force in March 2025. Our experience has been that supervision can often secure meaningful changes more quickly than formal enforcement cases and we are now being more precise about specific changes that we require services to make. We have run more enforcement cases than any of our international peers over the past 18 months but there have been several instances of small services based overseas questioning our jurisdiction, failing to comply with the OSA and refusing to pay fines. We know that harmful experiences have not fallen far or fast enough, with around seven in ten children still able to recall encountering harmful content recently. It is important that we always follow legal process and we operate in a highly litigious environment, but we also hear the criticism that our processes can be slow. As Sir Ian Cheshire set out in his letter to the former Secretary of State for Science, Innovation and Technology, we are reviewing our operating model, capabilities and enforcement strategy to ensure that we are set up for the next phase of the online safety regime, including implementing the social media ban. We are also committed to being more transparent, while recognising our legal and operational constraints on how we handle sensitive information.

1.8                 Our vision for the future is online safety regulation that anticipates risk, concentrates on the harms that matter most to people in the UK and proves its impact through measurable improvements in online users’ lives. The OSA is already being built upon. This year Parliament has been expanding the coverage of online safety regulation, including with 48-hour takedown of non-consensual intimate images and the creation of new priority offences. The Government’s commitment to a social media ban for under 16s, and related policies, is a major addition. Focusing on the operational effectiveness of the OSA, we recommend that Government and Parliament consider targeted reforms that would assist Ofcom’s implementation and help us go further and faster. These include more usable business disruption powers, reviewing the ‘safe harbour’ status of codes of practice, greater clarity about the rules that relate to AI services, and clarifying expectations with respect to the use of proactive technology, including content identification tools.

1.9                 We welcome the Committee’s Inquiry, and look forward to the opportunity for constructive debate, both about Ofcom’s implementation of the OSA and how the regime itself could be improved. We have always sought to be transparent about our work and engage extensively with parliamentarians both formally and informally, and are keen to build and improve on this engagement.

2.              Introduction

The Online Safety Act’s regulatory approach

2.1                 The Online Safety Act (OSA) established comprehensive safety regulation of the tech sector for the first time in the UK. The OSA is extremely broad, covering over 100,000 services and setting out more than 130 priority offences. At its core it requires user-to-user services[1] and search services[2] to assess the risk of their services exposing users to illegal content and content harmful to them, and to have proportionate systems and processes designed to reduce these risks and protect their users from harm.

2.2                 The OSA establishes a regulatory framework that aims to drive systemic change in the industry. Ofcom’s job is to ensure that tech firms have appropriate safety systems and processes in place. One of the reasons Parliament took this approach was that the sheer volume of online content – research published earlier this year estimated that 269 million posts were published on a typical day on TikTok – would quickly overwhelm a reactive content takedown regime.[3] This approach to online safety regulation has also been adopted internationally, notably in the EU Digital Services Act, and with Australia currently moving from a content takedown to a systems and processes approach.

2.3                 However, our experience is that the OSA is commonly assumed to be a content takedown regime, with the presence of illegal content or content harmful to children on a platform seen to be evidence of a breach of the Act. It is important to be clear: the OSA requires firms to design their services with appropriate safety systems but it does not require them to prevent all illegal or harmful content being uploaded to their sites and apps, nor to proactively search for this content. Consequently, under the OSA, illegal or harmful content on a service – even in large quantities – does not in itself demonstrate that a service has breached its duties and Ofcom does not have the powers to direct firms to remove specific content or close particular accounts. Proving a breach under the OSA requires Ofcom to evidence that a service’s systems are insufficient to meet its duties. This involves examining why the suspected breach occurred, recommending proportionate improvements in the company’s systems and processes and sanctioning non-compliant practice. This is more complex and slower, but ultimately more impactful, than simply finding illegal or harmful content is present or identifying individual users who behave in harmful ways.

2.4                 The OSA places some restrictions on Ofcom’s ability to require firms to use ‘proactive technology’ that could be used to detect and block illegal and harmful content pre-and post-upload, because of the risks this technology poses to privacy and free expression. Instead, the core relevant requirement on user-to-user services is to remove illegal content,[4] or shield children from content harmful to them, only once they are aware of it. Services need to make a judgement on whether a particular item of content is illegal or harmful, which may be unclear,[5] and the OSA does not require that services have to get every judgement about this right.

2.5                 It is worth noting that the OSA takes a broad harm-based approach but does not address a series of wider concerns such as addiction or compulsive use, and mis-information and dis-information are not named as harms in the Act (though policies on both are included in some of the platforms’ terms of service).

About this submission

2.6                 In the next few sections, we explain what we have learned from implementing the OSA over the past three years. We describe how we have:

• Established the Online Safety Group at Ofcom, ensuring we have the right strategy, skills and resources to implement the Act;

• Laid the policy foundations necessary to bring key duties into force;
• Built a model for driving compliance across regulated services, including industry guidance, direct engagement with services and enforcement;

• Developed our research and evaluation programme to ensure that all our regulatory activity is underpinned by the best evidence and intelligence available to us; and

• Established relationships with partners in the UK and internationally to ensure we act in concert, where possible, to achieve shared objectives.

2.7                 We then look at the changes we have seen across key areas of concern to Parliament: protecting children, tackling illegal content, and protecting women and girls. This includes industry change (such as commitments or implementation of measures), as well as some data on user outcomes. The evidence on improvements to user outcomes on the largest platforms has, to date, been largely underwhelming. We have used this data to hold services to account, while continuing to monitor and evaluate both industry compliance and the extent to which compliance translates into safer experiences for UK users.

2.8                 At the end of this document, we set out areas for further consideration in our internal review, and for further debate as this Inquiry progresses. 

3. Setting up the regime

Establishing the Online Safety Group at Ofcom

3.1                 To design and deliver the online safety regime, we harnessed Ofcom’s established regulatory capabilities, alongside bringing in dedicated expertise from the technology and third sectors. Having had teams working on online safety since 2020, in 2023 we formally set up the Online Safety Group to regulate the online service sector under the OSA. It comprises:

• A strategy team, to set strategic direction, oversee programme delivery, triage emerging issues and establish the super-complaints process;

• Policy teams, responsible for translating the legislation into effective rules and guidance for services;

• Supervision teams, who work with the sector to understand risks, assess compliance and drive improvements in safety;

• Technology experts, to help us understand how services and safety measures work in practice, spot new risks and keep regulation up to date as technology changes;

• A data and intelligence team, responsible for coordinating internal and external data sources and turning it into intelligence to inform regulatory decision-making;

• A dedicated Enforcement team, which is part of the cross-Ofcom Enforcement function but works closely with Online Safety teams.

3.2                 The core group is supported by functional teams across Ofcom, including lawyers, researchers, economists, behavioural scientists and international experts. In total, around 450 people work specifically on online safety regulation in Ofcom.

Laying the policy foundations

3.3                 We set ourselves an ambitious roadmap to implement the OSA. This involved starting quickly, for example launching the consultation on illegal content duties just days after Royal Assent of the OSA in October 2023. We have met all statutory deadlines and delivered ten policy statements, including establishing within 18 months our core Codes on Illegal Content and Protection of Children and associated guidance for services to follow.[6] The OSA requires that we consult on most of this work, publishing detailed proposals and supporting evidence to enable feedback from a wide range of stakeholders, including industry, civil society, academia, other regulators, and members of the public. The level of detail required in a regulatory consultation means that complex consultations have tended to take around a year from consultation launch to resulting statement. We know this has been a source of criticism of Ofcom and we are looking at ways to speed up our consultation process. However this is complex regulation in a novel area and consulting thoroughly when we set policy reduces the very real risk of legal challenge, which could delay implementation at later stages.

Building a compliance model

3.4                 As we developed the policy foundations for the new regime, we also built the structures and processes to monitor and drive safety improvements and compliance with the law. Bringing such a large and diverse set of sectors into compliance for the first time requires driving significant behavioural change in the industry, and to do this we have developed and deployed different compliance approaches.

3.5                 Industry engagement. We have sought to explain this complex regime as clearly and simply as possible, including setting out the practical steps firms must take to comply. Given the scale and diversity of the market, we promote compliance through a range of activities and resources, such as guidance, digital tools, webinars and YouTube videos, letters, regular industry bulletins and targeted campaigns. This has included industry-wide communications (for example, we have assessed over 1,000 pornography websites for the presence of age assurance and sent more than 500 letters to providers to set out their duties, with nearly a quarter of these letters resulting in immediate implementation of age assurance or a geo-block) as well as highly-targeted interventions (for example our small but risky taskforce wrote to 14 services that host legal but harmful content, including suicide and self-harm content, violent and graphic content, and eating disorder material, to direct them to block UK children more effectively; as set out in our recent Enforcement bulletin, seven of them have geoblocked the UK, two have introduced age checks, and three are being addressed by our Enforcement team.

3.6                 Direct supervision. We chose to invest in a dedicated supervision function to drive rapid behavioural change and have supervisory relationships with around 45 services. This involves engaging directly with the largest and/or riskiest services, to set clear expectations and drive change through early engagement, undertake close scrutiny of how services design and run their systems, and enable practical and swift remediation of problems. Our strategy has been to focus our resources where risks are highest and our scope to secure improved protections is greatest, and we continue to adapt as services, technologies and harms change. We were the first to adopt this approach to online safety regulation and it has been replicated by international peer regulators such as the eSafety Commissioner in Australia and Coimisiún na Meán in Ireland. Supervision is driving tangible results – for example, in May we secured commitments from X to speed up takedown times to protect UK users from illegal hate and terror content. These targets, if met, will give UK users some of the strongest protections on X globally.

3.7                 Enforcement. Formal enforcement action will always be an essential part of the model, for dealing with the most serious compliance issues, deterring non-compliance, or where other routes to securing change have not worked. Our enforcement toolkit includes information-gathering powers, warning letters, compliance remediation processes, formal investigations and civil sanctions, business disruption measures and, in limited circumstances, criminal prosecutions. We have been more active in enforcement than any of our international peers over the past 18 months, opening 40 formal investigations covering over 100 different online services.

3.8                 Given the sheer scale and diversity of services in scope of the OSA, it is not possible for Ofcom to pursue non-compliance in each and every case. We prioritise action against services and issues that will have most impact on user safety in the UK.

Setting priorities

3.9                 We are now simultaneously working to drive compliance where duties are live, implementing the remaining parts of the OSA, working on expansions to the existing Act that have been introduced since it passed and preparing for new legislation beyond the Act. That involves intentional choices about where to focus our efforts. To set priorities, we take account of evidence of harms and perspectives shared by a wide range of stakeholders including victims’ groups, civil society organisations, law enforcement partners and other public bodies. We are transparent about our prioritisation through Ofcom’s Plan of Work, on which we consult each year and publish in April. Our plans are guided by the evidence alongside our statutory duties and the Government’s Statement of Strategic Priorities.[7]

3.10            We focus our compliance work on the areas where the risks to users are greatest and where our intervention can have the greatest impact. Our key areas of proactive focus are strengthening protections for children, tackling illegal content including hate and terror content, and reducing harms that disproportionately affect women and girls online.

3.11            We also respond to emerging issues and as new risks escalate. We have established a process to test new concerns against these priorities and ensure we intervene quickly and effectively when necessary. For example, when evidence emerged of the use of Grok to produce potentially illegal imagery at the end of 2025, we moved rapidly to assess the concerns, and opened an immediate investigation into X, acting before any other regulator globally. We have sought to strike an effective balance between proactively focusing on enduring harms, and responding to new issues when the evidence suggests these are significant.

Working in partnership

3.12            We have developed close relationships with public bodies, civil society organisations and industry bodies whose partnership is essential to us achieving the OSA’s objectives. These include other UK regulators, especially the Information Commissioner’s Office, whose support was essential in developing codes of practice measures that provide sufficient protection for users’ privacy, and with whom we have worked closely to ensure an aligned position on age assurance.[8] We have signed Memoranda Of Understanding with the Internet Watch Foundation and South West Grid for Learning whose support is essential to services’ detection of child sex abuse material and intimate image abuse. We work closely with the National Crime Agency, Online CSEA Covert Intelligence Team and other security and law enforcement partners who provide evidence of illegal harm and support our assessment of online harms.

3.13            International cooperation is vital to achieving a coordinated approach to this global industry, and Ofcom has played a leading role in building shared global positions and sharing best practice on online safety. We were one of the founder members of the Global Online Safety Regulators Network (GOSRN) in 2022, chairing it in 2024-25, and overseeing joint policy statements on age assurance[9] and regulatory coherence.[10] In 2025, we established a trilateral co-operation group with the European Commission and the eSafety Commission in Australia and committed to working collaboratively on online safety, as well as establishing strong working relationships with national regulators around the world.

3.14            In such a nascent area of regulation, we recognise that it is early days for global cooperation and coherence. We believe that this can and should strengthen significantly over time. Policies to better protect children have significant potential for deep and broad international regulatory coherence, with an increasing number of regulators empowered with a mandate and tools to regulate for this goal. Ofcom’s principles-based approach to highly effective age assurance was an international forerunner and is coherent with the European Commission’s DSA Article 28 Guidelines, as well as GOSRN. New rules introduced in Brazil earlier in 2026 also follow this principles-based model. Greater coherence will facilitate more consistent and effective compliance for services, greater public trust and ultimately better protections for children.

Evidencing our decisions

3.15            Ofcom is an evidence-based regulator, which means that our decisions at every stage should be informed by the best available evidence. We have created a dedicated Data and Intelligence team to collate evidence from a wide range of sources and turn it into actionable intelligence to support decision-making.

3.16            Our evidence comes from a combination of external sources and our own research programmes, including:

• Ofcom-commissioned research, including detailed tracking of online behaviours over time by both adults and children (including exposure to harmful content, use of safety tools, responses to changes in platforms design and emerging risks); passive measurement to track where adults and children go online; platform audits to assess how design features influence user behaviour; and avatar studies to see first-hand the content users can be exposed to;

• Information from regulated services. We have statutory powers enabling us to gather information from services, and have issued more than 500 formal ‘requests for information’.

• Other external data sources. We use the datasets, studies and reports that civil society organisations, academia and other partners generate. Some of this is publicly available, while some we access via data-sharing agreement with strategic partners, including other international and domestic regulators and law enforcement agencies.

3.17            To take one example, our July 2026 report on age assurance[11] drew on evidence from a range of sources including surveys and studies on children’s online experiences, specific research into children’s experiences of age checks and use of VPNs, formal information requests to services and a dedicated Call for Evidence. We have also set up a Monitoring & Evaluation Programme to gather systematic data regarding the use of safety measures by firms, and the risks and harms experienced by users.

3.18            We use the evidence we collect to:

• Publicly inform the debate and account to Parliament;

• Continually understand risks and how harm manifests, to inform policy interventions;

• Design safety measures for our Codes of Practice that are technically feasible, proportionate to the risk of harm, and effective in reducing harm;

• Monitor actions taken by regulated services, assess compliance, and to raise concerns about potential non-compliance;

• Determine whether enforcement action is warranted;

• Continually monitor and evaluate whether safety outcomes are being achieved, and adapt our approach based on what works well and where further action is needed; and

• Provide the public with clear, accurate information about risks, and how to stay safe online.

3.19            Our experience has surfaced two significant challenges, which we are working to address. The first is determining which specific safety measures have most impact in ensuring a safer life online for UK users. There are many technological and social factors influencing online safety outcomes, and the intended outcomes are not always easy to measure.

3.20            Secondly, while we have seen extensive compelling third-party evidence of harmful content or experiences, robust third-party evidence of system failings – of the kind we need to require firms to improve – is hard to gather, and has proved rare. Evidence of illegal content on a site is not sufficient, in isolation, to prove the OSA’s rules have been breached. We have held workshops with civil society organisations to discuss the types of evidence they hold that may be useful to us, and have also published guidance in setting up the Super-complaints regime, which provides a structured way for third parties to bring evidence of systemic failings to us.[12]

3.21            Both of these challenges have their roots in the current absence of a mature safety culture in the industry. Company metrics typically focus on engagement and business outcomes, not safety of users. A key task for the years ahead is to establish best practice and new norms across the sector.

4.               Industry change and user outcomes

Industry’s response to regulation

4.1                 Generally, companies engaged constructively with us as we introduced the new rules and many have made material changes in response to their new duties. But, as demonstrated by our research into users’ experiences online, the industry has not done enough to improve user safety. We make three observations from our experience to date:

4.2                 First, driving change is quickest and most effective when we can be clear and directive about the solutions we expect services to use to comply. For example, we have had some of our quickest and most significant success in obtaining compliance with highly effective age assurance in the porn industry, and the use of CSAM content detection tools such as hash matching, because the rules and the measures were clear and specific.

4.3                 Where the available solutions are unclear, assessing compliance and pushing for improvements is harder. This is also complicated by the OSA’s provision that firms do not have to adopt the measures in our codes of practice – they can use ‘alternative measures’ to comply, as long as they document those measures and explain how they achieve compliance. Determining whether those alternative measures are sufficient to achieve compliance can be complicated.

4.4                 Second, several companies have demonstrated their appetite to legally challenge decisions they feel are not consistent with our evidence or legal powers. As well as Wikimedia’s challenge to the Government on the categorisation process, Meta has brought two judicial review challenges relating to the fees regime (which Epic Games has said it intends to join); Meta, TikTok and X have challenged our request for data to inform our monitoring and evaluation programme; Youngtek have appealed our enforcement decision against it, and 4chan have brought a challenge in the US courts challenging our jurisdiction to regulate it. We are also currently aware of appeals to the Upper Tribunal being brought against four of Ofcom’s decisions to include services on Ofcom’s register of Categorised services. Other regulators, including the Australian eSafety Commissioner and Comisiun na Mean, have also faced a pattern of legal challenges from major services. While such challenges can bring useful legal certainty in a new regime, defending against them diverts resource and can slow down delivery.

4.5                 Third, the OSA is built on the assumption of services having economic and reputational incentives to engage constructively and therefore that firms will respond to requests for information, make changes when directed to do so and pay fines. In most cases, this assumption has proved correct, including with many small but risky services (see examples above). But some services – particularly those that intend to do harm and which are often based outside the UK – will never respond constructively to regulation.

4.6                 In these cases our business disruption powers to restrict access to specific sites and apps, or require third parties such as payment providers to withdraw their services, may be the most effective tool available to us to secure greater protections for people in the UK. This requires Ofcom obtaining a court order. As we set out later, our experience to date is that there would be value in these powers being made more readily usable. However, even a business disruption order cannot be used to ‘take a site down’ globally, or to prevent people in the UK accessing a service when abroad or through a VPN. Some sites, such as those on the dark web or operated by extremist or terrorist organisations, are better addressed by law enforcement.

4.7                 The rest of this section describes the changes we have seen and lessons we have learned in the particular areas that have been the focus of our early compliance work.

Protecting children

4.8                 Protection of children is foundational to the regime. Services cannot protect children if they do not know which users are children, and the Act sets clear priorities for protecting children from both illegal contact (such as grooming) and harmful content (such as pornography, suicide, self-harm and violent content).

4.9                 Since Ofcom’s requirements came into force in July 2025, the implementation of age assurance has led to significant changes in children’s ability to access risky sites and apps. In the adult sector, we have focused on driving compliance for the top 100 most used porn sites. As of August 2026, the top 10 services in the UK all have age assurance in place, using at least one method from our guidance. This accounts for 18% of all UK traffic to adult sites.​ Within the top 100 most used services, 63 have age assurance, and a further 11 have geo-blocked the UK – meaning 74% of these services are inaccessible to children in the UK without use of circumvention measures. Where services have not complied, we have pursued enforcement action, having opened 23 investigations covering 88 porn sites, of which roughly half have concluded with the sites either blocking UK users or introducing age assurance. However, this is a dynamic market which includes a longtail of at least 20,000 identified adult sites and the ‘top 100’ changes often. While we have made good progress to protect children from pornography, there will inevitably remain non-compliant sites.

4.10            We are also seeing a shift to increasing use of age-checks beyond the adult sector. We tracked 32 of the services most used by children and found that over 69 million age checks were completed in the second half of 2025, a 23-fold increase on the previous six months.[13] Reddit, X, Discord, Grindr, Xbox, Steam, Bumble, Tinder and Hinge have all introduced age checks, while Meta has expanded protections for teenagers across Instagram, Facebook and Messenger through its Teen Accounts programme. Apple has also introduced age checks for U18s on their phones and tablets, prioritising the UK in its rollout. These measures are directly affecting children’s online experiences – since the children’s safety duties came into force, children aged 8-17 have increasingly reported being asked to prove their age (51% up from 41%).[14]

4.11            In tackling child sexual abuse and exploitation online, we have targeted some of the highest-risk services to monitor their implementation of hash matching (a technical measure that helps identify and prevent the re-uploading of known child sexual abuse material). Evidence from our law enforcement partners shows that file-sharing and file-storage services are particularly susceptible to being used for the sharing of child sexual abuse material. We therefore opened an enforcement programme into the measures being taken by such services to prevent users from encountering child sexual abuse material. Through this programme, we have intervened with eleven services: six are no longer available (due to geo-blocking or complete withdrawal of the service), four came into compliance following our engagement, and one investigation is still ongoing. In April 2026, we launched an investigation into Telegram, based on evidence regarding the alleged presence and sharing of child sex abuse material on the platform. Working closely with law enforcement, we have also opened two formal investigations into ‘chat sites’ aimed at teenagers that present particular risks of harm to UK users in respect of grooming and other child sexual exploitation offences.

4.12            Children’s exposure to harmful content, particularly on the services they use most, remains concerning. Ofcom research from the end of 2025 showed that children were encountering similar levels of harmful content as before the duties came into force: when prompted with a list of harmful content, around seven in ten children recalled being exposed to at least one piece of harmful content in a four-week period. Personal feeds continue to be the most likely route through which 11-17s said they were exposed to harmful content.[15]

4.13            This led us to issue a public challenge in March 2026 to Instagram, Facebook, YouTube, TikTok, Snap and Roblox across four areas: enforcing their minimum ages, having failsafe grooming protections in place, making their feeds safer for children and not testing their products on children. In their responses to our demands, there were new commitments made to child safety. Snap committing to adopt all our anti-grooming measures by default – such as ensuring stranger adults cannot contact children – and to using highly-effective age assurance to ensure these protections are available to all UK children. Meta and Roblox also committed to stronger anti-grooming protections, while Discord – although not part of our public challenge – has responded to pressure to reduce grooming risks and introduced a request system for messages from unknown adults.

4.14            The industry has a long way still to go. The response of some services to well-evidenced risks to children has been wholly inadequate. We have opened an investigation into TikTok on grounds of failure to identify children and protect them from harmful content. Ofcom research also shows that widespread minimum age policies of 13 are still not being properly enforced by tech companies, with 72% of children aged 8-12 accessing their sites and apps.[16] Despite not being explicitly required by the Online Safety Act, we have called on platforms to enforce their minimum ages using highly effective age assurance. This is especially important as we prepare to enforce social media restrictions for under-16s, where it will be essential that services know which of its users are children. In October we will provide an assessment of how highly effective age assurance can be used in the context of a social media ban for under-16s. In the meantime, we have been clear with industry that we expect full compliance with existing duties under the OSA.[17]

Tackling illegal content

4.15            In addition to our work on illegal child sexual exploitation and abuse (described above), our work on illegal harms has focused particularly on measures to identify, assess, remove and reduce the spread of illegal hate and terrorist content. This relies primarily on effective content moderation and user reporting systems.

4.16            Earlier this year, we secured public commitments from X to tackle the removal of illegal hate and terrorist content, some of which it has made only for the UK. These commitments include faster timelines for reviewing hate and terror content and strengthened reporting processes. We are now monitoring X closely to ensure they deliver on these commitments. We have acted quickly and pre-emptively where possible around incidents that present a high-risk for the proliferation of hate and terror content, issuing open letters to services following the Belfast riots and in advance of this summer’s World Cup. These letters have set clear expectations for services on their duties relating to hate and terror content.

4.17            Data on user outcomes shows minority groups continue to be disproportionately affected by hateful content, a finding which is consistent with conclusions of third-party experts.[18] Over eight in ten adults (85%) from minority ethnic groups have encountered online hate in the last year.[19] The equivalent figure for LGBTQ+ users is 90%. People from minority ethnic groups are more likely to encounter racism, trolling, pile-ons and content encouraging extremism compared to the wider online population,[20] and LGBTQ+ adults are more likely than others to encounter homophobia (78% vs. 47%) and transphobia (78% vs. 50%).[21]

4.18            The definition of ‘illegal’ hate content in the Online Safety Act reflects criminal law and is relatively narrow, covering only material that represents a criminal offence, such as threats or abuse likely to cause fear or alarm or harassment or distress, or intending to provoke violence or stir up racial or religious hatred or hatred on grounds of sexual orientation. Much of the most offensive content experienced by minority groups is not prohibited by the OSA, reflecting a judgement made by Parliament during passage of the OSA not to impinge on freedom of expression. This content can be very distressing for the targets of abuse, who often feel they have no recourse to action against serious harm that they and their families experience day by day. It also poses a challenge for enforcement, as it is often difficult to determine whether content that a platform has left up is, in fact, illegal. We are now commissioning work from expert bodies to help us test platforms’ systems against robust samples of illegal hate speech.

4.19            We have taken enforcement action concerning other kinds of illegal content, for example against a suicide forum that hosted illegal content encouraging or assisting suicide with links to a number of UK deaths. Following our investigation, the site implemented a geo-block with the effect that the vast majority of UK users who do not use a VPN to mask their country location are now no longer able to access the site. Our engagement also led to major search engines removing links to the website from search results and we have written to internet service providers (ISPs) to make clear that our net neutrality guidance does not prevent them from including suicide material in their content filters.

4.20            However, this case illustrated that no UK-specific regulation can entirely prevent access to a site if users employ methods to conceal their location, such as a VPN. We do not have power to make providers of regulated services change their services globally to comply with OSA requirements. This means that UK users may still be able to access non-UK versions of a service by means of a VPN or similar tools that mask their location, and thereby circumvent the safety measures under the OSA.

4.21            Partners in law enforcement, academia and civil society have supported our work on addressing other illegal harms. Working with the National Crime Agency and Counter Terrorism Policing, we have encouraged services to take action against content relating to 3D-printed weapons, such as blueprints and instructional content. X and Etsy have already updated their policies in response, and several services are now also incorporating a dataset created with these partners to strengthen their content moderation systems against 3D-printed weapons.

4.22            On fraud, we have driven services to implement a ‘trusted flagger’ process, allowing relevant bodies to report fraud online. Most of the relevant services now have a trusted flagger process in place, with several describing partnerships and reporting channels for collaboration on fraud in their illegal content risk assessments.[22] We continue to monitor the impact on fraud reporting and take down. Our draft Fraudulent Advertising Codes of Practice, which were published in July 2026, will provide significantly greater protections for users. They propose that relevant firms should institute checks of advertiser accounts, prevent firms from placing advertisements for financial products where they are not authorised to do so, stop accounts that have previously posted fraudulent ads from advertising in the UK, and operate accessible advertisement libraries. We expect to publish these codes in final form by summer 2027.

Protecting women and girls

4.23            Evidence is clear that women and girls are disproportionately affected by certain types of online harm, especially those involving personal attack or abuse. Female politicians, journalists, athletes and many others are more likely to experience abuse than men, and this prevents many from pursuing jobs they love or having their voice heard online. Women who have experienced domestic abuse can be particularly vulnerable as perpetrators often use online platforms to amplify and continue abuse.

4.24            Over 1 in 10 (14%) of women believe that it is impossible to avoid seeing harmful or offensive photos or videos if you go online. Women are also less likely than men to believe the benefits of going online outweigh the risk (62% vs 71%) and the internet is good for society (28% vs 41%). Both these indicators have decreased since before the Act came into force - in 2023, 67% of women believed the benefits of going online outweighed the risks (now 62%) and 34% agreed that the internet was good for society (now 28%).[23]

4.25            Reflecting this, the OSA required Ofcom to publish voluntary guidance on protecting women and girls, which we did in November 2025 following extensive consultation with civil society, academics, and researchers, as well as with organisations representing men and boys.[24] The guidance focuses on tackling misogynist abuse, pile-ons, stalking and coercive control, and image-based abuse, such as the non-consensual sharing of intimate images including deepfakes. The guidance calls on service providers to prioritise women and girls’ safety and sets out practical, ambitious good practice steps for firms to make their platforms safer. While the guidance is focused on tackling the harms disproportionately faced by women and girls, we believe its implementation will help raise safety outcomes for all users online.

4.26            In summer 2027, before the FIFA Women’s World Cup, we will publish a report holding the tech platforms to account on how they have applied our guidance. Work to produce this report has started with a Call for Evidence published on 9 September 2026. This seeks evidence from civil society and all interested stakeholders on how far industry has implemented our guidance. We are also engaging directly with services. This work will help inform our future engagement with platforms on women’s online safety. Our 2027 report will shine a light on which services are trying to create a safer life online for women and girls and which are not, helping users to make informed choices about how they spend their time online.

4.27            In the meantime, this year our focus has been on tackling intimate image abuse, a priority illegal harm that is widespread and has a profound and devastating impact on survivors and victims. The year began with reports of the use of the Grok AI chatbot to create and share suspected intimate image abuse and child sex abuse material. We initially contacted X about this on 5 January, and opened an enforcement investigation on 12 January. Following engagement with survivors, victims and advocacy organisations, we also opened an investigation into the provider of two online image boards hosting intimate image abuse in March 2026. Both investigations are ongoing.

4.28            To ensure service providers have effective processes to detect intimate image abuse and reduce its spread online we fast-tracked our decision to recommend the use of 'hash matching' technology for this content. From 30 September 2026 in-scope firms will be required to use hash matching technology to prevent the upload and sharing of known intimate image abuse. In anticipation of this deadline, we have been engaging with services across the sector to promote compliance, and setting up evidence gathering and monitoring tools to allow us to take swift and effective enforcement action against in-scope services that fail to implement hash matching. On 9 September 2026 we launched our associated public enforcement programme.

4.29            Intimate image abuse is illegal, and hash-matching represents a clear, measurable way of tackling it. More broadly, some harms that disproportionately affect women and girls are legal and therefore the Act does not impose duties on services to restrict access, except in the case of children.

5. Looking ahead

Operational review

5.1                 In July 2026, as Sir Ian Cheshire joined as Ofcom’s new chair, we launched a wide-ranging review to look at our organisational set up for the next phase of Online Safety regulation. The review will look forward to the expansion of our duties are about to expand with the social media ban and reflect on 18 months of driving compliance with the OSA.

5.2                 This review will conclude in the late autumn and covers:

• our organisational structures and operating model for the next phase of online safety regulation;

• the balance between policy development, compliance and enforcement activity, particularly as litigation becomes an increasingly prevalent feature of the regime, and how we can use all our tools as effectively as possible to drive change;

• how we ensure we have the right people in the right places and the right capabilities to deliver at pace;

• how we can prioritise the issues that matter most to UK users and develop tightly focused compliance programmes that maximise impact while also retaining scope to respond to emerging issues;

• how we best measure and demonstrate impact through clear outcomes, high-quality data and evidence, and a robust approach to success measurement;

• whether there are targeted improvements to the enforcement framework and our powers that would help us to deliver our duties more effectively; and

• how we can improve how we explain and account for our work publicly, particularly to Parliament.

5.3                 We hear the critique that the pace of change is too slow. Our legal duties and the regulatory process do place constraints on the pace of our work – we need to consult stakeholders on policies, ensure our decision-making is based on robust evidence, take account of human rights law and give firms the opportunity to make representations on our decisions, among other things. However, we are committed to finding ways to work faster, while continuing to focus relentlessly on better outcomes for users. We would welcome the opportunity to discuss this further with the Committee once our review is published.

Legislative reform

5.4                 We understand that the Committee is considering whether there are issues with the OSA that mean it is not working as intended. While any changes would be for Government and Parliament to determine, we think there are several areas that could be considered for reform. All of these would need further detailed consideration, and there would be pros and cons of any changes.

The design of the OSA duties and Ofcom’s role in setting codes

5.5                 We do not have powers to require providers to consider and mitigate risks of harm that might flow generally from how they are designed and their potentially harmful impact on users (such as addictive behaviour), rather than primarily on how they expose users to content that is illegal or children to content that is harmful to them. Questions of the overall scope and purpose of the Act, including which harms are covered, are however fundamentally political in nature and are for Government and Parliament to decide.

5.6                 There has been significant debate about the ‘safe harbour’ nature of Ofcom’s codes of practice. The OSA is clear that a provider which adopts the measures described in our codes of practice is deemed compliant with the associated safety duties. We cannot find firms non-compliant unless we can prove that they have not adopted our codes measures, and that any alternative steps they take are inadequate, even if we identify flaws in their systems or unmitigated risks more generally.

5.7                 Schedule 4 to the Act requires codes measures to be sufficiently clear and detailed, proportionate, and technically feasible. This means the Act requires the regulator to be specific about every codes measure, and assess its impacts and proportionality. Therefore, we cannot put in place a generic measure that providers should mitigate all risks identified in their risk assessments. Such a measure would not be consistent with the OSA or be enforceable by Ofcom.

5.8                 These provisions, in combination, effectively place the onus on the regulator to anticipate risks that fall within specific categories, and to determine proportionate measures to address them, rather than on the providers of regulated services to mitigate and manage risks of harm that are, or should be, reasonably foreseeable to them.

5.9                 We have told providers that we expect them to act proactively to manage risks of harm, have adequate systems to protect their users from all risks, and not roll back on commitments to users in the UK where they have already made them, even if that goes beyond our codes. That is what we think people in the UK should be able to expect from these services. We use our supervisory engagement to do what we can to secure improvements, for example, via voluntary commitments. But there are clear limits to what we can achieve via enforcement using formal powers given the safe harbour, and ‘clear and detailed’ requirements of the OSA.

5.10            In considering options in this area, Government and Parliament would need to consider how to balance broader requirements (for example ensuring that some or all firms address all reasonably foreseeable risks, or take all proportionate steps to address such risks) with the risk that such requirements are too vague to be enforceable, and fail to provide firms with adequate legal certainty.

Business Disruption Measures

5.11            Under the OSA Business disruption measures (BDMs) are intended as a last resort. They require a court order, as they represent a significant regulatory intervention with impacts on users’ freedom of expression, and the OSA imposes high legal thresholds upon Ofcom in applying for BDMs, and the court in granting them.

5.12            We have to show ongoing non-compliance by a service before we can make a BDM application. This is a high bar which limits how easily we can have recourse to BDMs. We think our powers to use BDMs could be strengthened, while maintaining robust safeguards to protect freedom of expression and other fundamental rights, and are discussing possible reforms in this area with Government.

5.13            However, given BDMs involve a court-led process, they would not be a quick or cost-effective solution even if some of the constraints on our use of them were reduced.

Proactive technology

5.14            The OSA limits our ability to require or recommend in our codes that providers make use of proactive technology, including content identification technology.[25] We can only include proactive technology measures in codes that relate to the illegal content, children’s and fraudulent advertising duties (and not the duties on categorised services regarding terms of service or user empowerment). In doing so, we must have regard to the accuracy, effectiveness and lack of bias achieved by these technologies. This means we need robust evidence on these points before we can propose such measures, and this tends to favour codes measures prescribing specific existing technologies – such as hash-matching – over broader measures requiring firms to innovate or consider a range of possible technical solutions.

5.15            We may not recommend in our codes the use of proactive technology to analyse user-generated content communicated ‘privately’, or metadata relating to that content. We have published guidance on how we may interpret ‘publicly’ and ‘privately’ within the OSA for these purposes and been clear that ‘private’ refers to the manner of communication (not the content of the communication, whether it is marked ‘private’, or of a sensitive or personal nature). But in services where access to content is limited to a small number of people, or technically restricted, or where content cannot easily be shared or forwarded – for example in many messaging services - our ability to include measures in codes to ensure firms detect illegal or harmful content is limited.

5.16            In considering options in this area, it is important to acknowledge that the current restrictions on use of proactive technology are a response to the significant impacts of such tools on privacy and freedom of expression. The prospect of firms routinely scanning all content uploaded to their platforms, even if they are doing so in order to weed out illegal material or content harmful to children, rightly requires careful consideration, as requirements to do so – if not carefully designed – could represent disproportionate infringements of human rights. Ofcom is required to act in line with human rights law, and we will continue to do so in reaching decisions on what measures we can and cannot impose in this area. It would be helpful for Government and Parliament to reassess and clarify whether the OSA’s approach to proactive technology remains in line with their expectations.

AI services

5.17            Since the OSA became law in October 2023, with a focus on tackling harms on social media and search services, the use of AI tools and services has increased significantly. The scope of the OSA currently applies to AI services that fulfil the Act’s definition of a user-to-user service, search service, or a publisher of pornographic content. Many of the most popular AI chatbots do meet the definition of one (or more) of these service types and are regulated under the Act. For example, ChatGPT Search is regulated as a search service.

5.18            However, some AI chatbots are not currently covered by the Act. For example, chatbots are not subject to the Act’s duties if they only allow people to interact with the chatbot itself and no other users, do not search multiple websites or databases when giving responses to users and cannot generate pornographic content. Likewise, even for AI chatbots within scope of the Act, not all content they generate is regulated. For example, the content generated by AI chatbots regulated as search services is itself generally not within scope of the Act if it is generated without searching the internet. This has caused challenges for our compliance and enforcement work as it is often very complex for a regulator to determine whether AI-generated content has been generated by searching the internet, and therefore to determine whether it is regulated content.

5.19            The Government has announced that it intends to amend how the Act addresses various harms linked to AI services, including:

• Using a power granted by the Crime and Policing Act 2026 to bring further AI services within scope of the Act’s illegal harms duties, via secondary legislation;

• Restricting under 18s from AI chatbot services whose primary purpose is to provide sexual relationships. Under 18s will also be restricted from accessing features on general purpose chatbots that enable sexually explicit interaction; and

• Requiring AI chatbots will have to introduce regular breaks for under 18s to help support healthier habits.

5.20            We are working with the Government to ensure that these changes are effective within the wider framework of the Act. Given the focus of the OSA on illegal activity and specified types of content harmful to children, it is not clear these changes would help to address other risky uses of AI services, such as potentially harmful health advice, or new and emerging potential harms such as emotional attachment.

Annex A – Online Safety Links

Online Safety industry bulletins

Investigations

Since April 2025, Ofcom has opened 40 formal investigations, of which 20 remain ongoing, and concluded 5 periods of enforcement led compliance remediation.

Preventing children from encountering pornographic content

Protecting users from illegal and/or harmful content

Compliance with illegal content risk assessment and other duties

Research/further reading

Report on the use of age assurance – This report, published in July 2026, assesses how sites and apps used age checks to protect children from online harm over the first year of deployment, with a particular focus on the first six months following the start of protection of children duties in July 2025. In summary, the report finds that age checks were deployed at unprecedented scale, but that more action from the tech industry is needed to further strengthen protections for children across the system.

Children’s online experiences – This report, published in May 2026, brings together findings from our research programme to understand how children experience the online world, including their use of services and exposure to harmful content before and after new children’s safety duties came into force.

Experiences of hateful content – Ofcom commissioned a survey of UK adults aged 18+ about their experiences of encountering hateful content online over the 12 months to February 2026. Among other findings, the research found that 77% of UK adult internet users encountered hateful content during the previous year, and 58% said they saw online hate every week during this period.

Experiences of using online services – The Online Experiences Tracker is a quantitative tracking survey that examines people’s attitudes to, and experiences of using online services. These attitudes/experiences could be positive or negative, including potentially encountering harm online. We conduct this research twice a year, most recently in January 2026.

8 September 2026

27