Ofcom and the Online Safety Act in 2026

One month into 2026 and Ofcom’s investigation into social media platform “X” is already attracting attention against an international backdrop of multiple investigations. Whilst ongoing, the investigation relates to reports of an AI chatbot being used to create and share sexual deepfakes of individuals, including children. In this article, we look at how Ofcom is navigating the new landscape of increased online regulation and what we might expect from 2026.

The Online Safety Act 2023

Whilst the Act became law in 2023, duties under the Act came into force in 2025 for which Ofcom is the regulator.

The Act requires companies to safeguard UK users and establishes a number of duties, alongside criminal offences, which apply to services that allow users to post content online or interact with each other (including social media services, but also extending to online forums, dating services and instant messaging services). Importantly, the Act applies even if the companies providing those services are outside the UK should they have links to the UK (for example, they have a significant number of UK users). 

The introduction of this Act was seen as a crucial advancement in the safeguarding from online sexual abuse and, in December 2025, Ofcom fined an operator of adult websites £1 million for not having robust age checks. The company was also fined a further £50,000 for failing to respond to an information request from Ofcom.

This highlights the significant financial and reputational damage that companies now face not only from being found to have breached their duties under the Act, but also for not engaging appropriately with Ofcom as its regulator. 

In respect of the Act’s enforceability for services with no physical presence in the UK, the practical effect of the Act is yet to be determined. In 2025, a US-based image board site raised a jurisdictional challenge against Ofcom seeking to ban Ofcom from attempting to enforce the Act against them. Our colleagues explore this further in this article. However, what is clear is that service providers across jurisdictions will need to assess cross-border compliance risks.

What can we expect from 2026?

At the end of 2025, Ofcom published its first assessment on how providers of regulated services were responding to their new duties as well as its priorities for 2026. As expected, high on the agenda is protecting children from sexual abuse and grooming, with a particular focus on ensuring that age checks are effective and that the services most used by children (Facebook, Instagram, TikTok, YouTube, Snapchat) provide comprehensive information in relation to how they are building stronger child protections.

In addition, Ofcom will also focus on effective removal of terror and illegal hate content, as well as ensuring safer online experiences for women and girls. Ofcom will also seek to strengthen its Codes of Practice which will set out the measures recommended by Ofcom in order to comply with duties under the Act.  

Asides from the regulatory perspective, increasing public concern in relation to online safety will add further scrutiny to Ofcom’s progress in this area with Ofcom reporting that concern amongst adults is at an all-time high with 48% wanting more safety measures online. This is likely to prompt regular publicity by Ofcom in relation to its enforcement activity.  

Key take-aways for your business

• Understand your duties: The Online Safety Act brings with it new and significant duties. Businesses must review how they conduct their operations with respect to these duties. A company can commit a criminal offence for failing to do so. Criminal liability also extends to ‘senior managers’ in certain circumstances (which in some cases may be sanctioned by imprisonment). It is therefore crucial that businesses consider the impact of the Act and review their business operations to ensure compliance. We can assist you in understanding your duties and ensuring compliance within your business.
• Do not ignore the regulator: The Act also establishes a number of ‘enforcement offences’ in connection with a failure to comply with the powers exercised by Ofcom, such as information requests or notices. It is crucial to note that these are separate criminal offences that can also have significant financial and reputational ramifications. We can assist you with how to manage communications with Ofcom, as well as responding to any investigation and/or regulatory enforcement action including those with an overseas or cross-border element. 

If you would like to discuss the implications of any matters discussed in this article, please contact Guy Bastable and Marie-Elizabeth Bailey in Burges Salmon’s Corporate Crime & Investigations team. 

This article was written by Marie-Elizabeth Bailey