The UK’s online safety regime has entered a new and defining phase. The Online Safety Act 2023 (OSA) is fully operational in 2025 – shifting from theoretical obligations on paper to real-world enforcement. Ofcom, the empowered regulator, has begun implementing its detailed supervision programmes, moving from guidance towards active compliance monitoring and sanctions. The most serious breaches could lead to investigations, fines of up to 10% of a company’s global revenue (or £18 million, whichever is higher) and even business restriction measures against persistent offenders.
Background and Legislative Framework
The OSA was introduced at a time when online child abuse image crimes and grooming were at a concerning high; it was felt that ground-breaking legislation was needed to improve safety on the internet. The Government’s aim was to modernise the UK’s online regulatory structure and make the UK one of the safest online environments globally without stifling free expression or contravening ECHR Article 10.
At its most foundational level, the OSA establishes a statutory duty of care for online platforms that host user-generated content or provide search services. These duties focus broadly on three policy aims: reducing illegal content, protecting children from harmful material (including pornography) and improving systemic risk management on platforms. Crucially, the Act has extraterritorial reach – platforms based outside the UK are still captured if their services are accessible to UK users.
Key Duties on In‑Scope Services
Platforms within the scope of the Act are subject to a range of interrelated obligations:
- Illegal content obligations require platforms to detect and reduce users’ exposure to unlawful material, including terrorism and child sexual abuse. Platforms must also apply proportionate and effective moderation systems and maintain ongoing processes to assess and manage these risks.
- Child protection and ageassurance requirements mandate that platforms hosting adult or otherwise harmful material implement strong ageverification measures and embed safetybydesign principles – ensuring that child safety considerations are integrated into the platform’s foundational design.
- Additional obligations for larger or ‘categorised’ services – typically the most influential digital platforms – impose stricter accountability measures. These include enhanced transparency reporting and senior management oversight to ensure sustained compliance with safety standards.
Ofcom’s Role and Enforcement Powers
Ofcom now serves as a central authority in UK digital regulation. Acting as both regulator and enforcer, it issues codes of practice and guidance to support compliance. Beyond guidance, Ofcom wields broad investigative powers, including information‑gathering rights, audit authority, and the ability to compel timely responses to formal notices.
In cases of non‑compliance, Ofcom may impose administrative fines, issue enforcement notices requiring corrective actions or apply for service restriction orders effectively blocking access to offending platforms in the UK. The Act also creates potential criminal liability for senior managers who obstruct investigations or fail to take reasonable steps to ensure compliance.
Implementation
Implementation has been deliberately phased to balance regulatory readiness with industry adaptation:
Phase one (2024): introduction of illegal content and risk assessment duties.
Phase two (mid‑2025): rollout of child safety provisions, including age‑assurance frameworks for pornography and harmful content.
Later phases: introduction of transparency, user empowerment and governance measures for categorised services.
For example, Ofcom has announced plans to issue guidance on the disclosure of information relating to a “deceased child’s use of their platform”. It has also launched consultations throughout 2025 on draft codes covering illegal harms, fraudulent advertising, content moderation standards, and technical specifications for age‑assurance systems.
Enforcement Action to Date
Although Ofcom’s enforcement powers have only recently come into force, early actions already signal its intent to enforce compliance rigorously. In December 2025, Ofcom fined AVS Group Ltd £1 million under section 12 OSA (requirement to prevent children from viewing pornographic content through statutory age-assurance methods). Further to the fine, the company must take immediate steps to implement effective age-assurance, or face a daily rate penalty.
Ofcom’s public reports emphasise that systemic failures, rather than isolated content moderation decisions, will remain the primary focus of enforcement. This approach aligns with Ofcom’s broader commitment to fostering a safer digital environment while avoiding overreach into individual content removal.
Practical Implications for Online Services
The OSA framework demands extensive organisational, technical, and governance reforms across the digital sector:
Governance and accountability: Boards are expected to embed online safety within their enterprise risk frameworks and assign clear accountability for compliance.
Operational adaptation: Platforms must enhance contentmoderation capabilities and deploy ageassurance mechanisms that align with Ofcom’s regulatory standards.
Regulatory engagement: With Ofcom expanding its datagathering and auditing functions, regulated services should prepare comprehensive documentation, data sets and transparency reports in anticipation of potential reviews.
The overarching message is clear: the Online Safety Act has moved beyond aspiration to active enforcement. As Ofcom strengthens its compliance record and the regime develops, proactive engagement and demonstrable adherence will be integral to responsible digital governance.
For more information on our Legal Services at Taylor Hampton Solicitors see HERE: If you have been affected by any of the issues and would like to get in touch confidentially, please contact us by sending an email to [email protected] or calling +442074275970.
Disclaimer
This article provides general guidance only and does not constitute legal advice. Always seek professional legal advice tailored to your specific situation before acting.