With regulators in the UK and EU continuing to sharpen both the framework for online safety and expectations on age assurance, child safety, illegal content, data protection and platform accountability over the summer, there are significant new implications for in-scope businesses and those responsible for governance.
The headlines included a high-profile US court settlement involving proposed protections for under-18s on social media platforms. UK businesses and businesses with a UK consumer base should pay particular attention to developments from the UK regulators.
The message from the summer has been the need for a joined-up approach to compliance, demonstrated through Ofcom's recent enforcement action under the Online Safety Act, the ICO's continued focus on children's data and compliant processing, and the European Commission's latest designations under the Digital Services Act. This all highlights the need for a coordinated legal strategy across regulatory, privacy, consumer, product and governance teams.
Taking each of the main developments in turn:
The acceleration of enforcement action by Ofcom
In August, Ofcom's Supervision teams concluded an extensive sweep of platforms hosting content harmful to minors which proactively targeted non-compliant services.
In early September, Ofcom fined online pornography provider Xgroovy £700,000 for failing to have effective age assurance methods in place to protect children, and a further £30,000 for failing to respond to a legally binding information request. Ofcom's position is that highly effective age assurance is central to the Online Safety Act regime. The case also illustrates once again that Ofcom is willing to use financial penalties, including daily fines which accrue after penalties have been levied, where core safety duties are not met; and that failures to engage with the regulator can create an additional and separate exposure.
Ofcom's wider enforcement work on file-sharing services is also significant. File-sharing services can be exploited to distribute child sexual abuse material at scale. Ofcom has said that, because of its enforcement programme, several services have deployed hash-matching technology to mitigate this risk or taken steps to prevent UK users from accessing their sites by adopting geoblocking technologies.
Conseqeuntly, user-to-user, hosting, file-sharing or communications services should expect Ofcom to review paper policies and to test the technical and operational controls used to reduce illegal-content risks. The takeaway is that compliance teams should make sure that these controls also form part of their compliance procedures; and that the technical efficacy of such controls is properly detailed in contracts throughout the procurement pipeline.
Child safety and age assurance remain at the centre of the UK regime
Child safety remains central to UK online safety regulation. The UK government has confirmed that the under-16 social media ban is still scheduled to come into force from spring 2027 and that the Burnham government will stick to the timeline inherited from the previous administration. Ofcom is preparing for that regime and is carrying out a rapid assessment of highly effective age assurance at 16, which it is expected to publish in October. The government has indicated that the necessary amendments to the Children's Wellbeing and Schools Act 2026 will be laid before parliament in December with the aim of passing the legislation before Christmas. In the meantime, Ofcom has reminded platforms that existing Online Safety Act obligations continue to apply, including illegal content duties and child safety duties.
Businesses affected by the ban should continue to deliver their resilience plans in accordance with this 2027 timeline. Those services who have not conducted customer profile audits should do so to confirm the number of under 16 users and effectively manage/remove them to achieve compliance. They should also be taking steps to progress the integration of highly effective age assurance to identify under-16 users into their services to support the ban. In addition, they should adopt robust supporting user terms and policies which recognise the specific obligations relating to 16–17-year-olds, including the proposed use of curfews and the ban on infinite scrolling, livestreaming and stranger chat functions and which clearly set out the measures which the platforms are adopting to comply.
The government has also announced this week that it will introduce legislation requiring tech companies to strengthen protections on devices and platforms to prevent children from taking, sharing or viewing nude images, helping tackle grooming, exploitation and abuse before harm occurs.
The ICO has also issued an update on its Children's code strategy. Data protection obligations apply independently of any minimum-age rule or service-access restriction. Services likely to be accessed by children must continue to consider the Children's code, age-appropriate design, privacy-by-default, transparency, profiling, geolocation and the use of children's personal information. The ICO has also expanded its work into mobile gaming and age-assurance providers, which means compliance programmes should not treat online safety and children's privacy as separate workstreams.
New EU developments have implications for the largest UK services
In July, the European Commission issued preliminary findings that the accounts of a high-profile social media company which were held by minors did not meet the safety standards required under the Digital Services Act (DSA).
It has now designated ChatGPT as a Very Large Online Search Engine, and Reddit and Roblox as Very Large Online Platforms, under the DSA. Each service declared that it reaches at least 45 million average monthly users in the EU, triggering the designation threshold. The official designations bring additional compliance obligations for the platforms and search engines.
The designation starts a four-month clock. By January 2027, the services must comply with the DSA's additional obligations, including assessing and mitigating systemic risks linked to illegal content, risks to minors, users' physical and mental wellbeing, fundamental rights, electoral processes and public security.
Although the DSA is an EU regime, it remains relevant for UK in-house teams. Many UK businesses operate services with EU users, contract with designated platforms, advertise through them, rely on their moderation systems, or need to understand how new EU risk-assessment, transparency and audit obligations will directly affect the largest UK-based platforms. Of particular note is the designation of a conversational AI service as a search engine by the European Commission under the DSA as it adds in additional compliance considerations for businesses assessing the regulatory treatment of AI-enabled search, recommendation and content discovery tools.
What do I need to do now?
Online safety has quickly developed into a mainstream legal risk that sits alongside privacy, consumer protection, product governance and regulatory engagement. The immediate priority for companies is to help the business move from awareness to showing evidence of compliance. This can be delivered by adopting a coordinated online safety strategy which includes documenting risk assessments, regularly testing age-assurance and child-safety decisions, clarifying compliance ownership obligations across legal, product and compliance teams, and preparing for more active regulator scrutiny. Organisations need to show that they have understood the risks, that they have made reasoned decisions and embedded controls into day-to-day operations and contracts. The companies who have put in place robust processes will be in a stronger compliance position if questions are asked by regulators, boards, customers or the media.
