Closed
Ofcom
Snap Inc (‘Snap’), with respect to its service Snapchat
15 January 2026
15 January 2026
On 3 March 2025, we opened an enforcement programme to monitor whether providers are complying with their illegal content risk assessment (‘ICRA’) and record keeping duties under the Online Safety Act 2023.
After reviewing Snap’s ICRA record for Snapchat, Ofcom raised concerns about the suitability and sufficiency of Snap’s assessment. In response, Snap provided a revised ICRA record but we did not consider that the changes it made addressed our concerns.
In particular, we remained concerned that Snap:
- did not appear to have addressed or assigned an overall risk level in respect of all kinds of priority illegal content; and
- where it had, its assessment of risk may not have accurately reflected, in line with our guidance, the likelihood of that content occurring on the Snapchat service or the chance of that service being used to commit or facilitate an offence.
We subsequently entered a period of compliance remediation with Snap, giving them one final opportunity to address or remedy our compliance concerns in lieu of opening an investigation.
Section 9(2) of the Online Safety Act 2023.
Background
Ofcom is the UK’s online safety regulator. Under the Online Safety Act 2023 (‘the Act’), we are responsible for ensuring that services have systems and processes in place to protect UK users from illegal online content and protect child users in the UK from content harmful to children.
To ensure service providers are aware of the risks posed to users of their service, the Act requires user-to-user and search services to carry out a suitable and sufficient illegal content risk assessment (‘ICRA’). This is a legal obligation and requires service providers to assess the risks associated with priority offences and other illegal content on their services. Service providers must also make and keep a written record, in an easily understandable form, of all aspects of every ICRA, including details about how the assessment was carried out and its findings.
On 16 December 2024, Ofcom published Risk Assessment Guidance and Risk Profiles to help service providers comply with the ICRA duties. We also published Record Keeping and Review Guidance to assist providers in meeting their record keeping and review duties.
On 3 March 2025, we opened an enforcement programme to monitor whether providers are complying with their ICRA and record keeping duties under the Act.
Under the programme we requested the ICRA records from a number of providers of in-scope services and have used this information to monitor how our ICRA and record keeping guidance are being applied by industry, as well as identifying possible compliance concerns.
Our concerns
After reviewing Snap’s ICRA record for Snapchat, Ofcom raised concerns about the suitability and sufficiency of Snap’s assessment. In response, Snap provided a revised ICRA record, but we did not consider that the changes it made addressed our concerns.
In particular, we remained concerned that:
- Snap did not appear to have addressed or assigned an overall risk level in respect of all priority offences and resulting illegal content; and
- the risk levels it did assign may not have accurately reflected, in line with our guidance, the likelihood of that content occurring on its service or the chance of its service being used to commit or facilitate an offence.
Accurate risk levels for each kind of priority illegal content and other illegal content are important because they help service providers understand what mitigations may be needed to reduce risks to UK users, including through Ofcom’s recommended measures in our illegal content Codes of Practice, or alternative measures.
Consequently, Ofcom informed Snap that it was conducting an Initial Assessment to consider whether enforcement action may be appropriate.
Compliance Remediation
After it was notified of Ofcom’s Initial Assessment, Snap gave assurances to Ofcom, including from senior management, that it was willing to conduct a full and meaningful review and revision of its ICRA in respect of Snapchat. In light of these assurances, we offered Snap an opportunity to engage in compliance remediation with our Enforcement team - a short period of focused engagement, which gives a service provider a final opportunity to address or remedy compliance concerns in lieu of opening a formal investigation.
As part of the compliance remediation process, Snap undertook a comprehensive reassessment of the risk levels it had previously assigned across all identified harms and submitted its revised ICRA record in respect of Snapchat to Ofcom on 1 December 2025.
Our response
Snap has demonstrated a willingness to genuinely engage with the compliance remediation process and understand the risks posed by its service. Having reviewed Snap’s revised ICRA record in respect of Snapchat, we have seen significant and meaningful change to its assessment of risk on the Snapchat service. Consequently, we have decided to close this period of compliance remediation with Snap and take no further action at this time. To note, our decision to close compliance remediation does not constitute Ofcom taking a view on whether Snap’s revised ICRA in respect of Snapchat is compliant with the Act. We welcome Snap’s constructive engagement with Ofcom during this process.
Our enforcement programme will remain open, and we will continue to monitor whether providers are complying with their ICRA and record keeping duties under the Act.
We also continue to monitor regulated services more generally to assess their compliance with the Act including the measures they have implemented to protect users from illegal content.