Welcome to the latest Online Safety industry bulletin, bringing together key updates, actions and resources relating to the Online Safety Act.
This quarter has seen significant developments in Ofcom’s implementation of the Online Safety Act. We have launched new enforcement action, published the register of categorised services, published an open letter to set out clear expectations for service providers under the Online Safety Act, and published a blog on our approach to supervision and compliance.
Where relevant, service providers should now be preparing for new transparency reporting obligations for categorised services, additional duties for categorised services to publish a summary of their risk assessment, and the implementation of hash matching technology to tackle non-consensual intimate images.
We have continued our work to improve protections for children online. This includes new enforcement activity focused on age assurance, the launch of a new ‘vet your vendor’ resource to help providers assess their age assurance arrangements, and further work on what highly effective age assurance should look like for the under 16 social media ban and other new age restrictions.
This bulletin highlights several upcoming publications that may affect or be of interest to your service, including our decisions on Additional Safety Measures, our report on content harmful to children, our report on children’s use of app stores, and our consultation on new requirements to take down non-consensual intimate images.
What's in this bulletin
- Taking action on online safety
- What you need to do
- What you need to know
- Resources and support
- What else is coming up for Ofcom
Taking action on online safety
Raised expectations for services
In August, we issued an open letter reinforcing our expectations for providers in scope of the Online Safety Act and also published a blog post about our approach to supervision and compliance. We explain how we use a mix of communication, supervision, engagement and enforcement to ensure companies are doing the things they need to, to keep users safe. Our open letter reminds service providers that existing safety duties remain fully in force despite a planned social media ban for under-16s and new age restrictions.
The message is clear that services should continue to act now to tackle illegal content and protect children, not wait for new legislation. We will continue to monitor compliance closely and will not hesitate to take enforcement action where service providers fail to meet their obligations.
Enforcement progress
We have continued our enforcement work where providers of online services are failing to meet their duties under the Online Safety Act, focusing our efforts where we consider the risk to UK users (particularly children) to be greatest.
Protecting children: In July, Ofcom fined the provider of fapello[dot]com £630,000 for failing to implement highly effective age assurance to prevent children encountering pornographic content, and for failing to respond to a formal information request. This follows non-compliance identified during Ofcom’s investigation. The provider has since blocked access to the service from the UK.
Protecting children: In September, Ofcom fined the provider of Xgroovy[dot]com £730,000 for failing to implement highly effective age assurance to prevent children encountering pornographic content, and for failing to respond to a formal information request. This follows non-compliance identified during Ofcom’s investigation. The provider has since introduced age checks and blocked access to the service from the UK.
Protecting children: In September, Ofcom closed its investigation into First Time Videos LLC. The provider paid an £80,000 penalty for failing to implement highly effective age assurance to prevent children encountering pornographic content.
Protecting children: In June, Ofcom opened an investigation into Bit Hive, the provider of Eporner.com, to assess whether it is complying with its duties to prevent children from encountering pornographic content through highly effective age assurance. The investigation will also assess compliance with duties relating to children’s access assessments.
Protecting children: In July, Ofcom opened an investigation into TikTok to assess whether it is complying with its duties to protect children from harmful content, including whether its age assurance measures are highly effective at determining whether users are children.
Protecting children: In September, Ofcom opened an investigation into Aylo, the provider of Pornhub, to assess whether it is complying with its duties to prevent children from encountering pornographic content through highly effective age assurance. The investigation will also assess its compliance with duties relating to children’s access assessments.
Illegal content: In September, Ofcom launched an enforcement programme to assess whether services that present particular risks of harm to UK users are complying with their duties to prevent users from encountering or sharing non-consensual intimate imagery (NCII). The programme will focus on measures used to detect and prevent the upload and dissemination of NCII, including the use of hash matching technology or any alternative measures.
Protecting children and Illegal content: In October, Ofcom opened an investigation into Meta to assess whether it has complied with the duties to carry out further suitable and sufficient illegal content and children’s risk assessments before making significant changes to the design or operation of its service. The investigation will examine whether Meta failed to comply with these duties in relation to the launch of Instants on Instagram.
Protecting children: In September, Ofcom issued provisional decisions to Cyberitic, LLC, ZD Media s.r.o., Web Prime Inc and the provider of porntrex[dot]com following investigations into their compliance with duties to prevent children encountering pornographic content through the use of highly effective age assurance.
Illegal content: Based on the evidence gathered and analysed so far, Ofcom has decided to focus its investigation into XIUC's compliance with its duties to protect people in the UK from illegal content, enabling the case to progress in a timely and efficient way.
What you need to do
Relevant service providers must use hash matching to detect intimate image abuse online
In June 2026, we published a statement setting out our decision to recommend certain service providers use ‘hash matching’ to detect intimate image abuse online.
This will apply to:
- Providers of user-to-user services that are high risk of intimate image abuse and either:
- whose principal purpose is the hosting or dissemination of regulated pornographic content; or
- are file-sharing and file-storage services; or
- have more than 700,000 monthly active UK users.
- Providers of large user-to-user services that are medium risk for intimate image abuse;
- Providers of large general search services.
We have launched an enforcement programme to assess the measures being taken by services that present a particular risk of harm to UK users to comply with their duties in respect of non-consensual intimate images, with a particular focus on ‘hash matching’ technology or any alternative measures used.
New legislation has passed requiring service providers to take down non-consensual intimate images within 48 hours, and we will consult on these new duties with a view to bringing this into force in 2027.
Additional risk assessment duties for Category 1 and 2A services
The categorisation register, published on 10 July 2026, sets out which services are categorised under the Online Safety Act and therefore subject to additional duties.
Category 1 and 2A providers must publish summaries of their most recent illegal content risk assessments and, where relevant, children’s risk assessments. We have advised them to do so by November 2026. They must also provide Ofcom with copies of the corresponding assessment records as soon as reasonably practicable after they are completed or updated.
Answer our questionnaire on skilled persons
To better understand the availability and suitability of skilled persons to provide reports under the Online Safety Act, we are inviting stakeholders to share their expertise through a Preliminary Market Engagement questionnaire. This will help us to understand the capabilities and interest in the market, and support our ability to hold services to account for keeping UK users safe online. The deadline for responses is 29 October 2026.
This questionnaire will help us develop our future approach to appointing skilled persons. We are seeking input from organisations and experts with relevant technical, risk, regulatory and assurance expertise. This will help ensure our processes for arranging these reports are robust, proportionate and capable of supporting independent, high-quality assessments where required.
What you need to know
Updates on transparency reporting
All categorised services must publish transparency reports containing information specified by Ofcom in transparency notices that are issued annually to providers of categorised services.
On 25 November, we will begin two parallel eight-week processes, both closing on 20 January:
1. Public consultation on the impact assessment
We will seek views on the impact assessment for our proposed approach to developing transparency notices.
2. Representations on service-specific draft notices
We will issue draft transparency notices to the providers of categorised services. We will give service providers the opportunity to provide feedback on the information that we are proposing they publish, as well as feedback on the reporting format and proposed publication timeframe.
Categorised services are encouraged to participate in both processes.
Statements and decisions
Call for evidence on women and girls’ online experiences
We have published a Call for Evidence to seek fresh insights into women and girls' online experiences since the publication of our guidance for tech platforms last year. We want to understand any changes in online gender-based harms, whether women and girls have seen changes in their online experiences, and actions taken by services, over the past year and where risks and harms remain. The Call for Evidence will be open until 4 November 2026.
Industry Fees Update
The tariff for the initial 2026/27 charging year has now been set at 0.02232%, and invoices are being issued throughout October.
We will also shortly publish the list of providers who notified us that they are liable to pay fees for the initial charging year on our Online Safety fees webpage. Further details, such as the precise QWR or the amount of fees paid by an individual provider, will not be published. Ofcom’s Online Safety fees team will contact providers directly if we have any questions about their submissions.
Queries about the MID Portal or Online Service Portal should be sent to OSFeesMID@ofcom.org.uk. For all other Online Safety fees queries, contact OSFeesRegime@ofcom.org.uk.
Resources and support
Ensuring your age assurance process is highly effective - a new resource
Age assurance is a cornerstone of the Online Safety Act and the basis for children’s online safety.
Service providers are ultimately responsible for ensuring their age assurance process is highly effective.
If you use a third-party age assurance vendor, Ofcom expects you to conduct regular due diligence on them. To support your due diligence conversations, we have created an easy to use vet your vendor resource.
What else is coming up for Ofcom
Additional Safety Measures statement
Before the end of the year, we will publish our decisions on our Additional Safety Measures, first consulted on in June 2025.
Age assurance developments
In June, Ofcom was asked by government to conduct a rapid assessment of what highly effective age assurance looks like for determining whether someone is over 16 to help inform parliamentary debate on the social media ban and other new age restrictions.
This assessment will set out the age assurance methods we consider could be capable of being highly effective at 16, as well as other considerations included in the request from the Secretary of State.
We expect to consult on our guidance for services, following the publication of the draft regulations.
We also expect to publish our report on children's use of app stores in due course. This report will consider whether the wider use of age assurance or other measures would improve the protection of children through app stores, to inform DCMS’s decision on whether to bring app stores into scope of the Online Safety Act. For more details, see Ofcom's Online Safety Roadmap.
Content Harmful to Children report
We will soon be publishing our statutory review and report on content harmful to children. This report will present the outcome of our review of the incidence of content harmful to children on regulated services, and of the severity of harm that children in the UK suffer, or may suffer, as a result of this content.
It will also include advice as to whether and how, in Ofcom’s opinion, it is appropriate to make changes to the categories of primary priority content and priority content in the Online Safety Act.
Deceased Child Users statement
In the coming weeks, we will publish our Statement and final Guidance on the deceased child user duties. The Guidance will help relevant services understand and comply with their duties when dealing with requests from bereaved parents for information about their child's use of a service.
Upcoming consultation on new duties for services on non-consensual intimate images
We will consult on the new duties on services to take down non-consensual intimate images within 48 hours of being reported by the end of 2026.
New duties arising from future Government legislation
Updates on new duties arising from future Government legislation, including the planned age-based restrictions announced on 15 June and implementation of the new duties included in the Crime & Policing Act, will follow in due course. Our latest statement on these announcements can be found here.