Sponsored

Thirteen months after the Online Safety Act’s illegal-content duties came into force on 17 March 2025, Ofcom has shifted the regime from supervisory dialogue to enforcement. The regulator now has more than 20 formal investigations open across pornography services, smaller user-to-user platforms and at least one service on the Category 1 register, with people close to the file confirming several probes are approaching the provisional penalty notice stage — the formal precursor to a final fine of up to £18 million or 10 per cent of qualifying worldwide revenue.

The shift was telegraphed in Dame Melanie Dawes’s annual letter to the Department for Science, Innovation and Technology earlier this month, which framed 2026 as Ofcom’s ‘first delivery year’ under the Act. It coincides with the bedding-in of the children’s safety duties, in force since 25 July 2025, which require highly effective age assurance on services likely to be accessed by children — the most politically contentious slice of the regime to enforce.

From codes to cash

The enforcement pipeline now draws from three buckets. The largest covers small and mid-sized adult content services that missed the deadline for highly effective age assurance — a cohort Ofcom signalled in its winter update it would pursue without an extended grace period after running supervisory engagement through the autumn. The second covers user-to-user platforms that failed to complete or evidence the illegal content risk assessment required since March 2025; here the regulator is leaning on its information-gathering powers under section 100 of the Act before deciding whether to escalate.

The third, and most legally consequential, bucket targets services on the Category 1 register published last summer, the largest user-to-user platforms carrying the heaviest compliance burden. Ofcom has been careful not to name targets but its public case-update disclosures confirm at least one Category 1 service is under formal investigation tied to its content recommender systems and the illegal-content moderation duties at sections 10 and 11 of the Act.

Age assurance becomes the test case

The age-assurance file is where compliance officers expect the first headline case law. Ofcom’s children’s safety codes require services likely to be accessed by children to deploy ‘highly effective’ age assurance, defined by four principles — technical accuracy, robustness, reliability and fairness — rather than any single technology. The 5Rights Foundation and Internet Matters have both pressed for tougher enforcement, while industry submissions through techUK have flagged implementation costs running into seven figures for medium-sized platforms, particularly where third-party age estimation vendors are involved.

Two judicial review threats, one floated by a trade body for adult-content services and a second by an open-source social platform, are likely to deliver the first principle-level court tests of the regime later this year. City lawyers tracking the cases expect proportionality of remedies, rather than the underlying statutory duties, to be the contested terrain.

What to watch through the summer

Three milestones now matter. Ofcom is due to publish a refreshed register of risks for illegal harms before the parliamentary recess, which will tighten the risk-assessment expectations services have been measuring themselves against. The Secretary of State is expected to lay the statutory instrument adjusting the categorisation thresholds, a draft DSIT has confirmed is in inter-ministerial clearance and which could pull additional services into Category 2A and 2B duties. And the first final penalty notice, which competition and tech lawyers expect before the autumn, will set the tone for whether Ofcom’s enforcement settles around the proportionate compliance-partnership framing Dawes has favoured publicly, or hardens into something closer to the early GDPR fines pattern. For Britain’s consumer-facing tech sector, the next two quarters decide which.

Finance & Markets Correspondent
Covers: Finance, capital markets, technology investing

David Whitmore covers the intersection of capital and code — the funding rounds, market structures and policy moves that shape how money flows through the technology economy.