Digital regulation | UK Regulatory Outlook July 2026

Online safety and age assurance 

UK government announces further measures to protect children online 

In June 2026, having received more than 100,000 responses to its national consultation, "Growing up in the online world", the Department for Science, Innovation and Technology (DSIT) announced a package of measures that it said would better protect children online, including a ban on social media for under-16s. See more information in this Insight. 

On 15 July, DSIT announced further measures to protect children online, specifically 16-17-year olds. Measures included: 

• Default overnight curfews from midnight to 06:00 for 16- and 17-year-olds on social media. 
• Default disabling of auto-play and infinite scrolling features for 16- and 17-year-olds. 
• Regular breaks for all under-18s using AI chatbots.  
• Collaboration with regulators (such as the Department of Health and Social Care and the Medicines and Healthcare products Regulatory Agency) and across government to address services that provide dangerous, misleading or unverified mental health advice. Ministers would consider all options, including, where necessary, banning certain services that present a threat to children where other regulatory and safety mechanisms have proved insufficient. 

Although the restrictions would be automatically switched on for 16- to 17-year olds on social media apps, users would be able to turn them off via their settings.  

The idea behind the restrictions was to prevent a cliff-edge in online protections for teenagers once they reach 16 years old and to strike a balance between providing safeguards for these users while allowing them some autonomy to make their own decisions. 

Sir Keir Starmer's government had planned to lay the first set of regulations on social media restrictions before Parliament by the end of this year, with measures to come into force in spring 2027. It is, however, unclear whether the government, now led by Andy Burnham since 20 July, will take any of these measures forward, whether in their original or amended form. DSIT itself has been dissolved. Its functions are being replaced by the Department for Business, Innovation, Science and Trade, the Department for Digital, Culture, Media and Sport and the Cabinet Office.  

It has been reported that Mr Burnham is "committed to keeping children safe online" and that a social media ban for under-16s would be a "critical first step", which suggests he would be minded to implement the proposal. However, he has not yet commented on the additional restrictions for 16- and 17-year olds or on the potential AI restrictions, so his views on these aspects of the proposals are uncertain. In addition, the main driver of the reforms, Liz Kendall, is no longer secretary of state. These factors may all play a part in what is to come. 

EU expert panel recommends harmonised age restrictions on children's access to social media and digital services 

The EU's expert panel on child safety has delivered its recommendations on protecting children online, which include potential age restrictions for social media, to the President of the European Commission.  

The report proposes addressing the issue in different ways for different age groups, but at a harmonised EU-wide level. It therefore recommends that children under two years old should avoid extensive screen exposure altogether, while children aged 3-13 should not have access to digital devices, social media and other digital services, unless supervised, and then they should only be able to access age-appropriate sites. Children aged 13-18 should only have access to age-appropriate social media sites that are safe by design, in that the provider has actively introduced default safety features, such as limits on infinite scrolling.  

The report addresses "social media+" services, that is, all internet services (not just social media services), that may be available to minors and that contain age-inappropriate or risky features (for example, infinite scrolling, autoplay, recommendation algorithms and persistent notifications) and content. This echoes the UK's approach, which proposed going "further than a blanket ban on social media" by applying restrictions to a "wider range of online services" (see this Insight).  

A major theme of the EU report is that responsibility for ensuring that online spaces are safe for minors to access and use should lie primarily with social media and other digital service providers. Until providers can demonstrate safe and age-appropriate features on their services, specific age restrictions should apply. The report also notes the number of different pieces of legislation that apply to child safety online and recommends greater cooperation among supervisory authorities to strengthen enforcement. The report does not prevent member states from introducing additional protective measures on top of the recommended EU-wide access restrictions. 

Following publication of the report, President von der Leyen stated that once the Commission has reviewed the recommendations, it will publish a proposal after the summer. 

UK Online Safety Act updates  

Ofcom publishes register of categorised services and consults on additional duties 

After extensive delay, Ofcom has published its register of categorised services under the Online Safety Act 2023 (OSA), together with a list of emerging Category 1 services.  

Categorised services are subject to additional duties under the OSA, depending on which of the three categories they fall into. Alongside the register, Ofcom also published a consultation on a draft code of practice and guidance documents on the additional duties that will apply specifically to Category 1 services, which are the largest and most-used UK services. These services have additional duties to provide user empowerment and identity verification tools, protect news publisher and journalistic content as well as content of democratic importance, comply with additional terms of service requirements, prevent fraudulent advertising, and comply with enhanced reporting and transparency requirements.  

Some of these additional requirements also apply to Category 2A and 2B services. For example, both of these categories also have enhanced transparency reporting duties and Category 2A services also have duties to prevent fraudulent advertising on their services. To assist, Ofcom has also published for consultation draft codes of practice setting out what Category 1 and Category 2A services need to do to tackle fraudulent advertising in line with their duties under the OSA.  

Both consultations close on 2 October 2026.  

Ofcom updates illegal harms framework to address self-harm and cyberflashing priority offences  

Ofcom has published a statement, following consultation, setting out changes to the Illegal Harms regulatory documents and guidance to reflect the creation of two new priority offences under the OSA: (i) making, encouraging or assisting serious self-harm; and (ii) cyberflashing. These were made priority offences under the Online Safety Act 2023 (Priority Offences) (Amendment) Regulations 2025, in force from 8 January 2026. See this Regulatory Outlook for background.  

Ofcom plans regular research into harmful content served to children online  

Ofcom has announced plans to conduct regular research on social media and video-sharing services to assess whether harmful content is being served to child users, commencing in summer 2026. The regulator intends to set up fictional accounts representing children aged 13 to 17 and observe the content that is recommended or presented to them. 

Ofcom will also undertake research on AI chatbot services to understand better how such services are designed, how users interact and engage with them, the chatbots' responses, and whether and how harmful content may be generated for different user profiles. Researchers plan to create fictional accounts for both 13- to 17-year-old and 18+ user profiles for this purpose. Ofcom expects this research to conclude by the end of this year. 

First commencement regulations under Crime and Policing Act 2026 made 

The Crime and Policing Act 2026 (CPA) received Royal Assent in April, introducing various online safety-related provisions, including amendments to the OSA (see this Insight for more information). The Crime and Policing Act 2026 (Commencement No.1 and Saving Provision) Regulations 2026 have since been made, bringing into force on 29 June 2026 various provisions of the CPA, including: 

• Creating or requesting the creation of a purported intimate image of an adult (including an AI-generated image), which now constitutes a priority offence under the OSA. 
• A new criminal offence of making, adapting, supplying or offering to supply "purported intimate image generators" (including nudification apps), which attracts personal as well as corporate liability. 
• A new duty on regulated user-to-user services to take down intimate image content within 48 hours of it being reported via an "intimate image content report" and a similar duty on regulated search services to ensure that users cannot encounter such content, both of which provisions will come into effect once Ofcom amends its illegal content codes of practice. 
• Power for the government to make regulations to establish an "intimate image register" and impose duties on regulated services in relation to it. 

Certain other provisions (age and consent verification for individuals appearing in pornographic content and extension of the "senior manager" test for corporate liability) also came into effect on 29 June by virtue of the CPA itself. 

Media updates 

UK Media Act listed events regime to come into effect on 1 January 2027 

The Communications Act 2003 (Commencement No. 6) and Media Act 2024 (Commencement No. 4 and Saving Provision) Regulations 2026 amend the Broadcasting Act 1996 to bring the new listed events regime under the Media Act 2024 into effect on 1 January 2027. Ofcom previously consulted on the definitions it was required to make in relation to various terms used in the new regime. It also consulted on an updated version of its code of practice on listed events and its proposal to remove the conditions relating to listed events included in broadcast licences (see this Regulatory Outlook for background). Ofcom says that final versions of these documents will be published before 1 January 2027.  

Ofcom has also introduced the Listed Events (Coverage) Regulations 2026, which set out when coverage of a listed event is to be treated as live coverage and therefore falling within the listed events regime. The regulations also come into effect on 1 January 2027.  

Government launches consultation on designation of radio selection services under UK Media Act 

Ofcom has published its final advice to the government on which voice-activated services (that is, smart speakers) should be designated under the Communications Act 2003 (as amended by the Media Act 2024) as "radio selection services" (RSS) (defined in the Media Act). The designations are based on Ofcom's proposed threshold of 700,000 users and include generative AI-enabled versions of the services concerned. Designated RSS will be subject to specific requirements to protect the availability and prominence of online streams of UK broadcast radio on voice-activated services when the new regime comes into effect.  

On 15 July, Sir Keir Starmer's government launched a consultation, saying that it was minded to agree with Ofcom's conclusion that 700,000 users was an appropriate threshold and with the list of services to be designated, and seeking views on the proposed decisions. However, it is currently unclear whether the new government will take the same approach. Subject to the new government making changes, the consultation closes on 9 September 2026. 

UK government consults on 'new strategic direction' for media policy  

On 10 July, Sir Keir Starmer's government published a green paper, entitled "Watch this space", setting out a "new strategic direction for the government's media policy". The paper, on which the government is consulting, outlines proposals to ensure that in an age of global internet streaming platforms and declining numbers of traditional linear broadcasting viewers, the media, and television in particular, can continue to play its "vitally important role" of providing a cohesive society and a healthy democracy.  

The proposals aim to ensure that high-quality UK content and trustworthy news remain "accessible and sustainable", public service media providers are supported, and trustworthy news is prominent and easy to find across the online environment. The green paper also sets out the next steps in the government's Future of TV Distribution Project.  

Subject to any intervention or a change in direction by the new Andy Burnham government, the consultation closes on 31 August 2026. 

Ofcom publishes recommendations on promoting media literacy 

Ofcom has published a statement setting out a series of non-binding recommendations on how broadcasting and streaming service providers, online platforms and generative AI services can promote media literacy. 

It outlines ten recommendations to achieve four broad aims to ensure that: (i) services are designed from the outset to offer informed choice and meaningful control; (ii) users are empowered and can actively manage and control their own experience when engaging with content and features; (iii) service providers contribute to media literacy more broadly, including through partnerships and outreach, to build trust; and (iv) improvement is continuous, driven by ongoing evaluations of what works, which includes requiring services to regularly assess the impact of their design choices and media literacy initiatives, and publish their findings. 

CJEU Grand Chamber clarifies the 'coordinated field' and hosting liability under the E-Commerce Directive 

The Court of Justice of the European Union (CJEU) Grand Chamber has issued a significant ruling on the scope and limits of the country-of-origin principle and the hosting-provider exemption under the E-Commerce Directive (2000/31/EC), with important implications for digital service operators across the EU.  

The court said that mere categorisation and indexation of content by means of algorithms do not, in themselves, deprive an operator of hosting-provider status. However, where algorithms are deployed in such a manner as to confer editorial control over content by determining, in the interest of the operator or its service, the conditions, manner and order of priority in which that content is or is not broadcast, then the loss of hosting-provider status may follow. 

See this Insight for more information.