Our approach to online safety supervision and compliance

We publish a range of resources to help regulated services comply with their duties. This includes a guide for services that contains digital tools and guidance to help services understand which rules apply to them, as well as offering tailored compliance recommendations. We also publish quarterly bulletins, host workshops and events, and run targeted awareness campaigns to keep the industry informed. We encourage services to subscribe to receive regular updates and event invitations.

We also regularly issue open letters to remind industry of our expectations on specific issues, as we did recently ahead of the UK election period and the World Cup.

This approach ensures that our expectations around compliance with the rules are as clear and accessible as possible. This information is particularly useful for smaller and medium-sized services. However, it inevitably relies on services being willing to engage and comply. 

We use our own research and gather external intelligence from a range of partners, including civil society, media and law enforcement, to continuously scrutinise the effectiveness of platforms’ safety measures. This helps us to understand the extent to which the online world is becoming safer for people in the UK. We also have the power to issue specific legally-binding requests for information from platforms to help with our ongoing monitoring or support our enforcement work, as well as conduct audits and interviews. We can also obtain a Skilled Person Report, which is where an independent expert is brought in to assess whether and how regulated services are addressing a specific compliance issue.

These tools enable us to drive change by ensuring we have the right evidence to assess harm and determine the appropriate course of action.  

This information gathering allows us to identify specific compliance issues. We engage regularly with the highest-impact services, allowing us to raise particular concerns and ensure the platform introduces specific changes to remedy an issue. For example, we received and assessed an illegal content risk assessment from Snap that we felt did not accurately represent risks on the service. Reviewing this document alongside evidence, we had grounds to take enforcement action against Snap, giving the company a final opportunity to address our concerns about its illegal content risk assessment in lieu of opening a formal investigation.  

Our goal of driving improvements in user safety often involves 1:1 engagement with individual services to ensure they comply with their duties. We initially make contact with a service to outline the rules and our expectations - sometimes through warning letters - which may be followed up through direct meetings, depending on the nature of the issue and how much we’ve already engaged with that company. 

For example, we recently worked with X to secure commitments to better protect UK users for illegal hate and terror content, which we will be monitoring to ensure the commitments are fulfilled.

In other cases, we may identify a need for wider compliance improvements across a group of services to “raise the ceiling” and encourage industry best practice, which warrants a more public call to action. For example, in April 2026, we publicly wrote to the services most used by children, setting out clear demands for further collective actions to better protect UK children. We were clear that if improvements were not made to address our concerns, then enforcement action would likely follow. This yielded a number of positive commitments, including Snap, Meta and Roblox committing to new anti-grooming measures, which we are now monitoring to ensure timely and effective deployment. We have also subsequently opened an investigation into whether TikTok is complying with its duties to protect children from harmful content.

This more informal, ongoing dialogue can be a very useful way of getting platforms to understand their duties and steering them to make improvements quickly – although the impact of these discussions is often less immediately visible to the public. This type of work is effective for focusing platforms’ attention where we think it matters most and, when appropriate putting public pressure on them to improve. However, it works when services are willing to engage with us - and follow through on their commitments. In some cases, this course of action is enough to remedy our concerns; other times, further follow up action will be necessary. 

We don’t rely exclusively on informal approaches. Where a potential compliance breach has occurred, we can move swiftly to launch an enforcement investigation.  We are one of the most active regulators on enforcement internationally, with investigations involving more than a hundred apps or other online services over the past 18 months.

Enforcement investigations are an essential part of our toolkit as they set important incentives for companies to comply with the Online Safety Act. However, they can take significant time and resources and are not the most suitable tool in all situations.

Opening an investigation involves gathering and evaluating evidence of harm to determine whether a breach has occurred and, if so, the appropriate course of action. This could include financial penalties or, in specific circumstances, business disruption measures.

We may do this if we have concerns about potentially significant harm, as we did with X after it launched an AI chatbot that generated sexualised imagery. 

We may also open an investigation if firms fail to make the necessary changes we have said they should. For example, we contacted several porn sites that hadn’t implemented age checks. Where those sites failed to engage or make the necessary changes, we opened investigations. Across our online safety work, we have imposed fines exceeding £6m so far.