Open
Duties under the Online Safety Act (‘the Act’) to protect children from harmful content by implementing highly effective age assurance.
24 July 2025
Ofcom is opening a programme of work, or ‘enforcement programme’, to monitor whether providers of services likely to be accessed by children whose principal purpose is the dissemination of ‘Primary Priority Content’ are complying with their duties to use highly effective age assurance to prevent children of any age from encountering it.
One of our priorities for the new Online Safety regime is to promote the implementation of robust age checks by services whose principal purpose is the dissemination of content harmful to children. The main objectives of this programme are to monitor compliance with the relevant duties in the Act, to monitor how our guidance on highly effective age assurance is being applied by industry, and to support the adoption of best practice.
Section 12 of the Act
Ofcom’s ‘Small but Risky Services’ Compliance Taskforce is a dedicated team focused on identifying and driving compliance from regulated services with small userbases that pose a disproportionate risk of serious harm to UK users.
On 24 July 2025, Ofcom launched an enforcement programme focussing on services whose principal purpose is the hosting or dissemination of ‘Primary Priority Content’ or ‘Priority Content’, to ensure such services used highly effective age assurance to prevent children from accessing the service. Since then, the Compliance Taskforce has monitored and carried out active engagement with providers of 14 services that represent a significant risk of harm to children from the harmful content they host or disseminate. Today we are providing an update on progress.
Geo-blocks implemented:
Following proactive engagement by the Compliance Taskforce, seven of the identified services, each of which were dedicated to hosting particularly harmful types of content - including suicide and self-harm content, violent and graphic content, and eating disorder content - have geo-blocked the UK and are no longer accessible to UK users (including children) as at the date of this update. This includes five services dedicated to hosting graphic violence and serious injury content, and two dedicated to hosting suicide content.
The Compliance Taskforce continues to monitor the effectiveness of geo-blocks that have been put in place and assess the need for further action.
Warning letters:
Providers of three identified services who failed to engage have been sent warning letters from Ofcom’s Enforcement team. These notify them of their requirements under Section 12 of the Act to prevent and protect children from encountering content which is harmful to them on their service, including through the use of highly effective age assurance. We continue to assess whether additional action is required and will take into account their response in considering our options.
Highly effective age assurance implemented:
Two high profile services identified by the Compliance Taskforce, dedicated to hosting graphic violence and serious injury content, have implemented highly effective age assurance to prevent access by UK children following engagement.
Next steps:
The work under this enforcement programme has been coordinated across Ofcom’s Supervision and Enforcement teams. It has so far demonstrated that seeking voluntary engagement from services is often the most rapid way to protect users. Particularly in cases involving smaller services that may not have a wide reach but that represent a significant risk of harm by hosting or promoting content that is particularly harmful to children.
We have made good progress with the majority of services we have engaged with so far. Going forward, we will continue to prioritise active engagement with services that pose the highest risk of harm to children.
Where service providers do not engage or fail to comply with their duties under the Act, including those in Section 12, we will not hesitate to move to formal enforcement action.
We will provide further updates on the work of the Compliance Taskforce in due course.
Research suggests that there are a number of small but risky services accessible to UK children whose principal purpose is to host harmful content such as eating disorder content, self-harm content, suicide content or serious violent content. The Act defines all of these kinds of content as ‘Primary Priority Content’ or ‘Priority Content’ that is harmful to children.
Part 3 of the Act introduces specific duties for providers of regulated user-to-user services that are likely to be accessed by children. These duties require providers to use proportionate systems and processes which are designed to effectively reduce the risk of harm to children from content available on their platforms, and to prevent children from encountering certain types of harmful content altogether. These obligations - referred to as the Protection of Children Duties - come into force on 25 July 2025.
In particular, section 12 of the Act requires providers to use highly effective age verification or highly effective age estimation (or both) to prevent children of any age from encountering ‘Primary Priority Content’ that the provider identifies on the service. This includes content that encourages, promotes or provides instructions for suicide, self-harm or eating disorders and pornography, unless such content is prohibited on the service.
Ofcom’s Protection of Children Code of Practice for user-to-user services recommends that providers adopt highly effective age assurance to prevent children from accessing any part of a service whose principal purpose is to host content that is harmful to children. This includes both ‘Primary Priority Content’ and other forms of ‘Priority Content’, such as serious violence, dangerous challenges or abusive content.
Ofcom has today opened an enforcement programme to assess the measures being taken by services whose main activity is to host ‘Primary Priority Content’ or ‘Priority Content’ that is harmful to children to meet their duties on age assurance.
Action we are taking:
Over recent months, our taskforce dedicated to driving compliance among small but risky services has identified a number of services whose principal purpose is to host or disseminate content harmful to children.
We will be engaging with these services to inform them of their obligations under the Act, and to assess the age assurance processes they are implementing to achieve compliance with their duties under Part 3.
We expect this programme to run for at least four months, during which time we may decide to open separate formal investigations if we have concerns that a service provider may not be meeting its duties under the Act.
CW/01311/07/25