Online safety & content laws in United Kingdom (2026)

Legal framework

Online Safety Act 2023 (Royal Assent 26 October 2023), enforced by Ofcom as the designated online safety regulator

Key points: internet & online safety in United Kingdom

1. 01Phased Duty Commencement

   Phase 1 illegal-content duties came into force on 17 March 2025; Phase 2 children's safety duties took effect on 25 July 2025. Phase 3, covering the Register of Categorised Services (Categories 1, 2A, 2B) and associated enhanced duties for the largest platforms, was delayed to July 2026 following a successful legal challenge by the Wikimedia Foundation against the categorisation regulations.

   legislation.gov.uk techuk.org cms-lawnow.com

2. 02Age Verification Obligations

   Since 25 July 2025, platforms likely to be accessed by children must deploy 'highly effective' age assurance (photo ID, biometric, or credit-card checks) to prevent under-18s from accessing pornography and content promoting self-harm, suicide, or eating disorders. Ofcom's Protection of Children Codes of Practice (April 2025) specify acceptable methods. A UK Government consultation on further expansion of age-verification requirements closed 26 May 2026.

   ofcom.org.uk ofcom.org.uk

3. 03Enforcement Powers and Penalties

   Ofcom may impose fines of up to £18 million or 10% of qualifying worldwide revenue (whichever is greater) for breaches. In the most serious cases it may seek court orders for 'business interruption measures', including ISP blocking and withdrawal of payment or advertising services. By February 2026, Ofcom had opened investigations into more than 90 platforms and issued six fines, including an £800,000 penalty against Kick Online Entertainment and a £1.35 million penalty (the largest to date) against 8579 LLC.

   ofcom.org.uk inforrm.org

4. 04Platform Liability and Extraterritorial Scope

   The OSA imposes duties of care on both UK-based and global platforms that have a 'significant number' of UK users or target UK users as a market. User-to-user services, search engines, and app stores are in scope. Category 1 providers (the largest, once the register is finalised) will face additional obligations, including user-identification verification and user-empowerment tools.

   legislation.gov.uk mayerbrown.com gov.uk

5. 052026-27 Regulatory Priorities

   On 8 May 2026, Ofcom published a refreshed regulatory roadmap for March 2026-May 2027, setting three enforcement priorities: strengthening child protection, tackling illegal hate content, and improving online safety for women and girls. Ofcom also opened a formal investigation into X (Grok AI) in January 2026 for potential CSAM-related failures, and a separate investigation into Joi.com (Novi Ltd) for age-assurance gaps, signalling expanding scrutiny of AI-generated content.

   wiggin.co.uk burges-salmon.com

6. 06Legal Challenges to the Regime

   The OSA has faced judicial scrutiny: the Wikimedia Foundation's challenge to categorisation regulations concluded in August 2025, contributing to the delay of Phase 3. In May 2026, Meta commenced judicial review proceedings against Ofcom in the High Court, contesting how OSA administrative fees are calculated.

   thenextweb.com techuk.org

Timeline of decisions

1. 1 Mar 2026Enforcement · official
   Ofcom fines 4chan £520,000 for age-verification failures under OSA

   Ofcom imposed a £520,000 penalty on 4chan for failing to implement robust age checks required by the Online Safety Act 2023, part of a broader enforcement wave in which Ofcom also fined AVS Group £1.05m and 8579 LLC £1.35m. By end of January 2026, 77 of the top 100 pornography sites had age assurance in place.

   Ofcom

2. 12 Jan 2026Enforcement · official
   Ofcom opens formal OSA investigation into X over Grok AI-generated CSAM and NCII

   Ofcom launched a formal Online Safety Act investigation into X Internet Unlimited Company after reports that its Grok AI chatbot was generating and sharing child sexual abuse material and non-consensual intimate images. This was the first major OSA enforcement action targeting a mainstream social media platform's AI features.

   Ofcom

3. 25 Jul 2025Decision · official
   Online Safety Act Phase 2: Children's Protection Codes of Practice become enforceable

   Ofcom's Children's Safety Codes, requiring platforms likely accessed by under-18s to complete child risk assessments and implement over 40 protective measures covering suicide, self-harm, eating disorders, pornography, grooming and bullying, became legally binding. Non-compliance carries fines up to £18m or 10% of global revenue.

   Ofcom

4. 17 Mar 2025Decision · official
   Online Safety Act Phase 1: Illegal harms safety duties become enforceable

   The first wave of Online Safety Act duties, requiring user-to-user and search platforms to assess and mitigate risks from illegal content including terrorism, CSAM, fraud and hate speech, became enforceable by Ofcom. Within months Ofcom had opened 21 investigations across 69 sites and apps.

   Ofcom

5. 16 Dec 2024Guidance · official
   Ofcom publishes finalised Illegal Harms Codes of Practice

   Ofcom released its Statement on Protecting People from Illegal Harms Online, setting out binding Codes of Practice that all in-scope platforms must follow to comply with Online Safety Act illegal-content duties. The statement gave platforms a three-month window to complete risk assessments before enforcement began in March 2025.

   Ofcom

6. 26 Oct 2023Law · official
   Online Safety Act 2023 receives Royal Assent

   After more than four years of consultation and parliamentary scrutiny, the Online Safety Act became law, establishing a statutory duty of care for user-to-user and search services, designating Ofcom as the dedicated online safety regulator, and creating a tiered risk-based compliance regime. It is widely regarded as one of the world's most comprehensive internet content regulation frameworks.

   legislation.gov.uk

7. 2 Sept 2021Guidance · official
   ICO Age Appropriate Design Code (Children's Code) becomes enforceable

   The one-year implementation grace period for the ICO's Age Appropriate Design Code expired, making its 15 privacy-by-default standards, including data minimisation, no nudging, and high privacy defaults, legally enforceable under UK GDPR for any online service likely to be accessed by under-18s. The Code was the first of its kind globally and directly influenced equivalent legislation in California.

   ICO

8. 16 Oct 2019Decision · official
   Government abandons Digital Economy Act 2017 age-verification scheme for online pornography

   Culture Secretary Nicky Morgan announced that Part 3 of the Digital Economy Act 2017, the world's first mandatory online age-verification law, would not be commenced, citing implementation complexity and preferring the broader duty-of-care model proposed in the Online Harms White Paper. The provision was formally repealed by the Online Safety Act 2023.

   UK Parliament

9. 8 Apr 2019Guidance · official
   Online Harms White Paper published by DCMS and Home Office

   The government published its landmark Online Harms White Paper, proposing a statutory duty of care on internet companies enforced by an independent regulator with powers to sanction or block non-compliant platforms. This was the direct policy precursor to the Online Safety Act and established the UK's regulatory philosophy of platform accountability for user safety.

   DCMS / Home Office

10. 23 May 2018Law · official
    Data Protection Act 2018 enacted, mandating creation of ICO Children's Code

    The Data Protection Act 2018, which transposed GDPR into UK law, received Royal Assent. Section 123 specifically required the Information Commissioner to produce a Code of Practice on age-appropriate design for online services, providing the first statutory recognition of children's distinct online privacy rights and the legal basis for the subsequent Children's Code.

    legislation.gov.uk

11. 27 Apr 2017Law · official
    Digital Economy Act 2017 enacted, world's first mandatory online age-verification law

    The Digital Economy Act 2017 received Royal Assent, making the UK the first country globally to legislate a mandatory age-verification requirement for commercial pornographic websites under Part 3. Though never commenced and ultimately abandoned in October 2019, the Act established the age-assurance policy direction that resurfaced in the Online Safety Act 2023.

    legislation.gov.uk

12. 17 Jul 2003Law · official
    Communications Act 2003 enacted, Ofcom established, online messaging offences codified

    The Communications Act 2003 merged five separate regulators into Ofcom, the unified communications regulator that would later become the UK's online safety regulator. Section 127 criminalised sending grossly offensive, indecent, obscene, or menacing messages via public electronic communications networks, extending criminal liability to internet communications for the first time.

    legislation.gov.uk

Sources

1. 1.legislation.gov.uk/ukpga/2023/50
2. 2.gov.uk/government/publications/online-safety-act-explainer/online-safety-act
3. 3.ofcom.org.uk/online-safety/illegal-and-harmful-content/statement-protecting-people
4. 4.ofcom.org.uk/online-safety/protecting-children/age-checks-to-protect-children-onli
5. 5.ofcom.org.uk/online-safety/protecting-children/Ofcom-fines-porn-company-800k-for-f
6. 6.cms-lawnow.com/en/ealerts/2025/12/2025-uk-online-safety-act-round-up
7. 7.techuk.org/resource/online-safety-act-categorisation-register-pushed-back-to-jul
8. 8.commonslibrary.parliament.uk/research-briefings/cdp-2025-0043/
9. 9.mayerbrown.com/en/insights/publications/2025/08/the-online-safety-act-enters-phase-2
10. 10.wiggin.co.uk/insight/ofcoms-online-safety-update-for-2026-2027/
11. 11.inforrm.org/2026/03/11/ofcom-steps-up-online-safety-act-enforcement-with-two-furt
12. 12.burges-salmon.com/articles/102mi1g/ofcom-and-the-online-safety-act-in-2026/
13. 13.thenextweb.com/news/meta-judicial-review-ofcom-online-safety-act-fees-may-2026