Investigation into the provider of two image board services for failing to comply with its duties under the Online Safety Act 2023

Today, 6 March 2026, Ofcom has opened an investigation into the provider of two image board services into whether it has complied with its duties.

Part 3 of the Online Safety Act (‘the Act’) imposes ‘Illegal Content Duties’ on providers of regulated user-to-user (‘U2U’) services. These include requiring all U2U and search services in scope of the Act to undertake an illegal content risk assessment.

In addition, Part 3 of the Act imposes duties on providers of regulated U2U services to take or use proportionate measures to:

1. prevent individuals from encountering priority illegal content – including but not limited to non-consensual intimate images (NCII) and Child Sexual Abuse Material (CSAM) – by means of the service; and
2. effectively mitigate and manage the risk of the service being used for priority offences or harm to individuals arising on the service as identified in the most recent ‘Illegal Content Risk Assessment’.

They must also implement systems and processes designed to allow users and affected persons to easily report illegal content, as well as operate a complaints procedure for users of their service.

Services must also include provisions in the terms of service specifying how individuals are to be protected from illegal content, apply those terms consistently and ensure the terms of service are clear and accessible.

Regulated U2U service providers can comply with the Illegal Content Duties by implementing measures recommended in Ofcom’s illegal content Codes of Practice for user-to-user services issued on 24 February 2025 (the ‘Codes of Practice’), or through alternative measures.

These duties came into effect on 17 March 2025.

Investigation

Ofcom has opened an investigation into the provider of two image board services into whether it has complied with its duties:

• to complete, and keep a record of, an illegal content risk assessment pursuant to section 9 of the Act; and
• to implement appropriate measures to prevent individuals from encountering priority illegal content, and effectively mitigate and manage the risk of the service being used for priority offences, pursuant to section 10 of the Act; and
• in respect of terms of service pursuant to section 10 of the Act,
• in respect of content reporting pursuant to section 20 of the Act; and
• in respect of complaints procedures pursuant to section 21 of the Act.

Ofcom’s investigation process

The Online Safety Act sets out the process Ofcom must follow when investigating a company and deciding whether it has failed to comply with its legal obligations.

Our first step is to gather and analyse evidence to determine whether a breach has occurred. If, based on that evidence, we consider that a compliance failure has taken place, we will issue a provisional decision to the company, who will then have an opportunity to respond to our findings in full, as required by the Act, before we make our final decision.

This is set out in more detail in Ofcom’s Online Safety Enforcement Guidance, sets out how Ofcom will normally approach enforcement under the Act.

Where we identify compliance failures, we can impose fines of up to £18m or 10% of qualifying worldwide revenue (whichever is greater). In the most serious cases of non-compliance, and where appropriate given risks of harm to individuals in the UK, we can seek a court order to require third parties to take action to disrupt the business of the provider. This may require third parties (such as providers of payment or advertising services, or Internet Service Providers) to withdraw services from, or block access to, a regulated service in the UK.

We will provide an update on this investigation in due course.