Ofcom Sets Out Enforcement Approach as UK Online Safety Regime Takes Hold

Key Takeaways

• Ofcom Oversees More Than 100,000 Companies: The regulator is applying the Online Safety Act across a vast range of online services, with the first duties under the regime having taken effect in March 2025.
• Enforcement Does Not Always Begin With an Investigation: Ofcom can use guidance, warning letters, direct engagement, information requests, audits and other supervisory tools to secure changes before resorting to formal proceedings.
• Formal Enforcement Is Already Extensive: Investigations have involved more than 100 apps and other online services over the past 18 months, while Ofcom says it has imposed more than £6 million in online safety fines to date.
• Platform Commitments Remain Under Scrutiny: Ofcom is monitoring commitments from companies including X, Snap, Meta and Roblox, while separate formal investigations have been opened into issues involving X, TikTok and other services.
• Ofcom’s Approach Is Heading for Review: Chair Sir Ian Cheshire plans a wide-ranging review of the regulator’s online safety work, including its approach to compliance and the transparency surrounding its supervisory activity.

Deep Dive

Ofcom has set out how it plans to enforce the UK’s Online Safety Act across more than 100,000 companies, detailing an approach that can begin with guidance and direct regulatory pressure but escalate to investigations, fines and, in certain cases, measures that disrupt a company’s business.

The regulator said Friday that the first online safety duties, which took effect in March 2025, have already prompted some companies to conduct more robust risk assessments and introduce age-assurance measures for the first time. Others have been less cooperative. Ofcom said some of the services presenting the greatest risks have also put up the strongest resistance, while many larger and better-resourced companies are still falling short of what the regulator expects.

Ofcom’s approach does not treat a formal investigation as the inevitable answer to every suspected breach. The regulator said its overriding objective is to secure changes that make UK users safer as quickly as possible. An investigation can end in a fine or another penalty, but it can also consume considerable time and resources. Sometimes a warning, an information request or a direct conversation with a company can move faster.

How Ofcom chooses between those tools depends on the problem in front of it. The regulator said it considers the severity and scale of potential harm, whether apparent noncompliance appears deliberate and the strength of the available evidence. It can also respond to emerging problems outside its existing priorities, as it did earlier this year when the Grok AI chatbot account on X was used to create and share undressed images of people.

Ofcom conducts research and draws on intelligence from civil society, media organizations and law enforcement to assess whether platforms’ safety measures are actually working. It can issue legally binding requests for information, conduct audits and interviews, and obtain a Skilled Person Report, which brings in an independent expert to assess how a regulated service is dealing with a particular compliance issue.

Snap has already encountered that scrutiny. Ofcom said it reviewed the company’s illegal-content risk assessment for Snapchat and concluded that it did not accurately represent risks on the service. The regulator determined that it had grounds to take enforcement action but gave Snap a final opportunity to address the concerns instead of immediately opening a formal investigation.

The episode illustrates an important feature of the regime taking shape. Ofcom does not have to choose immediately between doing nothing and imposing a penalty. There is a considerable amount of regulatory territory between the two.

The regulator said it generally begins direct engagement by explaining the relevant rules and its expectations, sometimes through warning letters and sometimes through meetings. It recently used that approach with X, securing commitments from the company to introduce additional protections against illegal hate and terrorist content for UK users. Ofcom is now monitoring whether those commitments are carried out.

In April, Ofcom publicly called on services widely used by children to take further action to protect younger users and warned that enforcement would likely follow if sufficient improvements were not made. Snap, Meta and Roblox subsequently committed to new anti-grooming measures, which the regulator said it is monitoring for timely and effective deployment. Ofcom has separately opened an investigation into whether TikTok is meeting its duties to protect children from harmful content.

There is a limit to what this quieter form of supervision can accomplish. Ofcom acknowledged that direct engagement works only when companies are prepared to engage and then follow through. Sometimes a conversation resolves the regulator’s concerns. Sometimes it merely establishes that another conversation will not.

That is where formal enforcement begins.

Ofcom said investigations involving more than 100 apps and other online services have taken place over the past 18 months, which it cited in describing itself as one of the most active regulators internationally on enforcement. Investigations allow it to gather and assess evidence, determine whether a breach has occurred and decide what consequences should follow. Those consequences can include financial penalties and, in specific circumstances, business-disruption measures.

The regulator has opened an investigation into X following concerns over sexualized imagery generated by its AI chatbot. It has also pursued pornography services that failed to introduce required age checks. Ofcom said it contacted several such sites first, then opened investigations where companies failed to engage or make the necessary changes. Across its online safety work, the regulator has imposed fines totaling more than £6 million so far.

The scale of the regime makes those choices consequential. A regulator responsible for more than 100,000 companies cannot turn every concern into a lengthy investigation. It has to distinguish between the company that needs clearer instructions, the company that needs pressure and the company that has already been given enough of both.

A risk assessment may be rewritten after Ofcom raises concerns. A platform may introduce a safeguard after a meeting. A company may make commitments under the shadow of an investigation that never has to be opened. Ofcom said such engagement can be effective precisely because it allows problems to be addressed quickly, although the results are often less immediately visible to the public.

There are legal constraints as well. UK law limits Ofcom’s ability to disclose confidential information supplied by regulated companies, which the regulator said helps encourage candid disclosures. Within those restrictions, Ofcom said it intends to publish updates on safety-related changes, provide regular information about ongoing investigations and report annually on its work enforcing the Online Safety Act.

Ofcom’s new chair, Sir Ian Cheshire, has announced a wide-ranging review of the regulator’s online safety work. The review will draw on what Ofcom has learned since the regime began, examine how its compliance approach can deliver greater impact for UK users, particularly children, and consider how the regulator can provide greater transparency about the work it is doing.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.