Investigation into the provider of Chat-Avenue and its compliance with duties to protect its users from illegal content

Background

Part 3 of the Online Safety Act (the ‘Act’) imposes ‘illegal content duties’ on providers of regulated user-to-user (‘U2U’) services. These duties require providers to:

• carry out, record and keep under review a suitable and sufficient illegal content risk assessment (section 9 of the Act);
• make and keep a written record, in an easily understandable form, of all aspects of every risk assessment under section 9 (section 23(2) of the Act);
• take or use proportionate measures to: (a) prevent individuals from encountering priority illegal content by means of the service, including child sexual exploitation and abuse (‘CSEA’) material; (b) effectively mitigate and manage the risk of the service being used for priority offences, including grooming offences, or harm to individuals arising on the service as identified in the most recent illegal content risk assessment (section 10(2) of the Act);
• implement systems and processes designed to minimise the length of time for which any priority illegal content is present and swiftly take it down when they are made aware of its presence (section 10(3) of the Act);
• have clear and accessible terms of service specifying how individuals are to be protected from illegal content and giving information about any proactive technology used by the service for the purposes of compliance with a duty (sections 10(5), (7) and (8) of the Act); and
• use systems and processes that allow users and affected persons to easily report content which they consider to be illegal (section 20(2) of the Act).

Regulated U2U service providers can comply with the illegal content duties by implementing measures recommended in Ofcom’s illegal content Codes of Practice for user-to-user services issued on 24 February 2025, or through alternative measures. The illegal content duties came into force on 17 March 2025.

Part 3 of the Act also imposes ‘protection of children duties’ on providers of regulated U2U services that are likely to be accessed by children. Such services were required to carry out a children’s access assessment by 16 April 2025 pursuant to Section 36(3) and Schedule 3, and a suitable and sufficient children’s risk assessment by 24 July 2025 pursuant to Section 11(2) and Schedule 3.

The protection of children duties require such providers to use proportionate systems and processes which are designed to effectively reduce the risk of harm to children from content available on their site and to prevent children from encountering certain types of harmful content – known as ‘Primary Priority Content’ – altogether. In particular, section 12 of the Act requires providers of services that fall under Part 3 of the Act, and allow one or more kinds of Primary Priority Content (including pornographic content), to use highly effective age verification or age estimation (or both) to prevent children from encountering that kind of content where identified on the service.

Regulated U2U service providers can comply with the protection of children duties by implementing measures recommended in Ofcom’s protection of children Codes of Practice for user-to-user services issued on 4 July 2025, or through alternative measures. The protection of children duties came into force on 25 July 2025.

Compliance activity and engagement

One of Ofcom’s key online safety priorities is for service providers to tackle child sexual abuse material (‘CSAM’) and prevent grooming. In March 2025, Ofcom launched an enforcement programme into measures being taken by file-sharing and file-storage services to prevent users from encountering or sharing CSAM, and has since opened numerous investigations concerning the risk of UK users encountering such content on these and other types of service.

In parallel, Ofcom has worked, and continues to work, with law enforcement and other organisations to identify services that present particular risks of harm to UK users in respect of grooming and other CSEA offences. During the course of this work, Ofcom encountered concerns about the risk to UK child users on Chat-Avenue, a chat service with open chatroom (including forums aimed at teens, kids and adults), private messaging, profile creation, video calling and media sharing functionalities.

Ofcom has engaged with representatives of the provider of Chat-Avenue in an attempt to address these concerns. However, despite this engagement, Ofcom continues to have serious concerns about the provider’s compliance with the Act and whether it is providing adequate protection to UK child users from the risk of grooming and other harms present on the service.

Investigation

Today, 21 April 2026, Ofcom has opened an investigation into the provider of Chat-Avenue to assess compliance with:

• the duty to complete a children’s access assessment, and suitable and sufficient illegal content risk assessment and children’s risk assessment pursuant to sections 9, 11 and 36 of the Act  
• the duty to make and keep an appropriate record of the risk assessments pursuant to section 23(2) of the Act;
• the illegal content duties in respect of priority illegal content and priority offences, including CSEA and grooming, pursuant to section 10 of the Act;
• the duty to use systems and processes that allow users and affected persons to easily report content which they consider to be illegal content pursuant to section 20(2) of the Act;
• the protection of children duties, in particular the duty to use highly effective age verification or age estimation (or both) to prevent children from encountering Primary Priority Content where identified on the service pursuant to section 12 of the Act.

Ofcom’s Online Safety Enforcement Guidance sets out how Ofcom will normally approach enforcement under the Act. This includes our approach to information gathering and analysis and the procedural steps we must take to fairly determine the outcome of the investigation.

Where we identify compliance failures, we can impose fines of up to £18m or 10% of qualifying worldwide revenue (whichever is greater). In the most serious cases of non-compliance, and where appropriate given risks of harm to individuals in the UK, we can seek a court order to require third parties to take action to disrupt the business of the provider. This may require third parties (such as providers of payment or advertising services, or Internet Service Providers) to withdraw services from, or block access to, a regulated service in the UK.

We will provide an update on this investigation in due course.

Contact

Enforcement team (OnlineSafetyEnforcement@ofcom.org.uk)