Digital Regulation | UK Regulatory Outlook April 2025

Online Safety Act updates 

Commencement regulations made regarding CSEA reporting 

The Online Safety Act 2023 (Commencement No. 5) Regulations 2025 will bring into force (from 3 November 2025) various provisions in the Online Safety Act 2023 (OSA) relating to Child Sexual Exploitation and Abuse (CSEA) content online, including:

• Duties on both UK and non-UK providers of regulated user-to-user services to report detected and unreported CSEA content present on the service to the National Crime Agency (NCA). The secretary of state is still to make regulations on the information that should be contained in these reports, their format and the time frames in which they should be sent to the NCA. 

• Section 69, which makes it an offence to knowingly or recklessly provide materially false information when reporting CSEA content to the NCA. 

• Provisions relating to Ofcom's enforcement powers as regards offences under the OSA for failing to comply with provision of information requirements, including in respect of the CSEA reporting requirement. 

Ofcom opens first investigation into an online service provider under OSA 

Ofcom has opened its first investigation into an online service provider under the OSA, targeting an online pro-suicide discussion forum. Due to the nature of the service, the regulator has not named the provider. Ofcom's investigation follows it having sent a statutory information notice to the service provider under the regulator's Risk Assessment Enforcement Programme (launched to monitor whether services are meeting their illegal content risk assessment duties) and subsequent correspondence.  

Ofcom is investigating whether the provider has failed/is failing to comply with its duties under the OSA to:

• Adequately and accurately respond to a statutory information request. 

• Complete and keep a record of a suitable and sufficient illegal content risk assessment. 

• Comply with safety and reporting requirements as regards illegal content, as well as requirements relating to complaints procedures. 

If Ofcom finds compliance failures, it can impose fines of up to the greater of £18 million or 10% of qualifying worldwide revenue and, in the most serious cases, seek a court order to require third parties to withdraw services from, or block access to, the service. 

Ofcom reports positive engagement from pornography sites on implementing highly effective age assurance

On 3 April 2025, Ofcom published an update on its enforcement programme in relation to the compliance of pornography sites with their obligations under Part 5 of the OSA to implement highly effective age assurance (HEAA) to prevent children from accessing pornographic content.

On 17 January 2025, Ofcom wrote to hundreds of such providers, asking them to provide details of their plans to meet these obligations and their anticipated timescales. So far, Ofcom reports positive engagement from the sector and says that several providers have implemented HEAA in response to the regulator's programme. However, some have not responded and some have been referred to Ofcom's enforcement team for further review. Ofcom will assess those services and consider if formal enforcement action is needed. In the meantime, it is currently working on a set of FAQs to support the sector in complying with their obligations.

EU Digital Fairness Act expected in Q3 of 2026

See Consumer section.