Ofcom’s investigation into social media platform X is already attracting attention against an international backdrop of multiple investigations. The ongoing investigation relates to reports of an AI chatbot being used to create and share sexual deepfakes of individuals, including children. How is Ofcom navigating the new landscape of increased online regulation?
Online Safety Act 2023
While the Online Safety Act 2023 became law in 2023, the duties under the act came into force in 2025. Ofcom is the regulator.
The act requires companies to safeguard UK users and establishes several regulatory duties, backed by civil and criminal sanctions, which apply to services that allow users to post content online or interact with each other (including social media services, online forums, dating services and instant messaging services). An important feature is the act’s extraterritoriality; it applies even if the companies providing those services are outside the UK, should they have links to the UK (for example, they have a significant number of UK users).
The act’s introduction was seen as a crucial advance in safeguarding from online sexual abuse. Last December, Ofcom fined an operator of adult websites £1m for not having robust age checks and a further £50,000 for failing to respond to an information request from Ofcom. This highlights the significant financial and reputational damage companies now face, not only from being found to have breached their duties under the act, but also for not engaging appropriately with Ofcom.
In respect of the act’s enforceability for services with no physical presence in the UK, the practical effect of the act is yet to be determined. Ofcom sought to demonstrate the act’s international reach in 2025 by issuing a £20,000 fine to a US-based image board site for failure to respond to information requests. In response, however, a jurisdictional challenge was raised seeking to establish that Ofcom was prohibited from enforcing the act against the site. Nevertheless, it is clear that in an era of global business, service providers across jurisdictions will need to assess cross-border compliance risks. Ofcom has also indicated that it will continue to build strong relationships with counterparts in other jurisdictions to align policy and approach.
At the end of 2025, Ofcom published its first assessment of how service providers were responding to their new duties and its priorities for 2026. As expected, high on the agenda is protecting children from sexual abuse and grooming, with a particular focus on ensuring that age checks are effective and that the services most used by children (Facebook, Instagram, TikTok, YouTube, Snapchat) provide comprehensive information in relation to how they are building stronger child protections.
Ofcom will also focus on the effective removal of terror and illegal hate content, as well as ensuring safer online experiences for women and girls. The regulator will also seek to strengthen its Codes of Practice, setting out the measures to comply with duties under the act. Key milestones anticipated by Ofcom are available as part of its published ‘road map to regulation’.
Ofcom has made its ambitions for online safety clear and we can expect to see those continue. They include a clampdown on providers that ignore Ofcom’s information requests, and it has made clear since the outset of the act that it expects the industry to work with it. This is demonstrated by its enforcement action to date, indicating that Ofcom will not hesitate to take action against platforms that fail to cooperate as prominently as it will pursue breaches of specific safeguarding duties.
The compliance remit of the act is broad and its potential ramifications significant, both in terms of civil penalties and potential criminal liability. Where it considers that service providers are not complying, Ofcom now has recourse to a wide range of investigatory powers, including requiring information and attendance at an interview, to enter and inspect premises, and to conduct an audit.
Where compliance failures are identified, Ofcom may impose civil penalties of up to £18m, or 10% of the service provider’s qualifying worldwide revenue (whichever is greater). It may also apply to the court for business services restrictions under the act. For the most serious cases, the act creates several criminal offences that can be committed by companies and individuals in relation to online communications and compliance with Ofcom’s investigatory and enforcement powers. These include specific provisions to extend liability to designated ‘senior managers’ and company officers. Sentences following conviction include fines without an upper limit and/or imprisonment for up to five years.
Aside from the regulatory perspective, there is also increasing public concern, adding further scrutiny to progress in this area. Ofcom reports that concern amongst adults is at an all-time high. Regular publicity by Ofcom about its enforcement activity seems likely.
Service providers must give careful consideration to their compliance programmes in the year ahead.
Key takeaways for businesses are:
- Understand your duties: The act brings with it new and significant duties. Businesses must review how they conduct their operations and ensure that they understand what measures are required to comply. Ofcom has extensive investigatory and enforcement powers backed by civil and criminal sanctions (including imprisonment). It is crucial that businesses consider the impact of the act and review their business operations.
- Do not ignore the regulator: The act creates several criminal offences in connection with failure to comply with Ofcom’s investigatory powers – companies, ‘senior managers’ and company officers risk significant fines and/or imprisonment. In addition, Ofcom expects full industry cooperation. It is important to note that these offences can also have significant financial and reputational ramifications in addition to the breach of a specific duty.
Marie-Elizabeth Bailey is an associate at Burges Salmon, Bristol
No comments yet