Digital regulation | UK Regulatory Outlook March 2026

Online safety and age assurance 

The UK government has published its much-anticipated consultation on children's wellbeing online. It seeks views on setting a minimum age for children to access social media (among other things). 

The government also consults on: 

• Children's use of AI chatbots, including which mitigation measures (such as minimum ages, restrictions on features and functionalities, or time limits) may be appropriate to apply to certain chatbots and, if so, how this subset of services should be defined.
• Whether the digital age of consent should be raised (currently set at 13 under the UK GDPR).
• Restricting certain functionalities and design features that encourage excessive use, such as infinite scrolling, autoplay, "likes" and comments, alerts and push notifications, and content recommendation algorithms.
• Whether there should be age restrictions on features such as live streaming, the ability to send nude images or videos, disappearing content, location sharing and connecting or talking to strangers.
• How age verification and age assurance technologies can support the effective implementation of any changes to the regulatory regime. 

The consultation closes on 26 May 2026.  

The government has already committed to taking action to improve the child safety online regulatory regime by, for example, ensuring that AI chatbots are brought into scope of the Online Safety Act 2023 (OSA), and to act swiftly on the consultation's findings. See this Regulatory Outlook for more information. 

UK Online Safety Act updates  

Ofcom and ICO call for stronger age assurance and child protection measures 

Ofcom has published four demands directed at the sites and apps most used by children, requiring them to enforce their minimum age rules and implement highly effective age checks. Ofcom has outlined four areas of focus: 

• Effective minimum-age policies: while acknowledging that enforcement of the minimum age for accessing these sites and apps (set at 13 years of age by the UK GDPR) is not explicitly required by the OSA, Ofcom is calling on platforms to ensure that they do this.
• Robust grooming protections: platforms must implement strict controls, including using highly effective age assurance to identify child users, to prevent contact between children and unknown adults.
• Safer feeds for children: Ofcom identifies algorithms as children's "main pathway to harm online" and is issuing legally binding information requests to large platforms to assist it in the assessment of their recommender systems. Ofcom acknowledges that this evaluation will take time, but makes clear that it will enforce if issues over the promotion of content to children are identified.
• Pre-deployment risk assessment: Ofcom reminds platforms that they are required by law to assess the risk of significant updates to their products, including new AI tools, before deployment, and to notify it accordingly. 

At the same time, the Information Commissioner's Office (ICO) has published an open letter to social media and video-sharing platforms, calling on them to "act now" to strengthen age assurance measures to ensure young children are not accessing services that are not designed for them. This follows the ICO's recent decision to fine social media platform, Reddit, for failing to implement age assurance measures and for processing children's personal information unlawfully without conducting an impact assessment. See the Data law section for more information. 

New regulations bringing child sexual exploitation and abuse reporting duty in effect 

Section 66 of the OSA requires UK providers of regulated services to report all detected and unreported child sexual exploitation and abuse (CSEA) content on their service to the National Crime Agency (NCA). Non-UK providers are also required to report such content to the NCA, but only where it is UK-linked CSEA content.  

The Online Safety Act 2023 (Commencement No. 7) Regulations 2026 bring these duties into force, as far as they relate to regulated user-to-user services, on 7 April 2026. The duties in respect of regulated search services are expected to be brought into force later in the year. 

The secretary of state has also now made the Online Safety (CSEA Content Reporting by Regulated User-to-User Service Providers) Regulations 2026, which set out the practical steps that regulated user-to-user services must follow to comply with the reporting duties, including registering with the NCA prior to reporting and details of the information to be included in the reports.  

These regulations also state that if the service provider has registered with the NCA and is required, or decides, to report to a foreign agency instead (such as the National Center for Missing & Exploited Children in the US), it must inform the NCA of that decision or requirement; it will then no longer be required to report to the NCA as well.  

Ofcom has published an information page to assist providers with compliance. 

Ofcom finalises online safety fees framework by publishing Statement of Charging Principles 

Ofcom has published the finalised version of its Statement of Charging Principles, the final regulatory document required to implement the online safety fees regime under the OSA. While the fees regime has been in effect since December 2025, the OSA requires a statement of charging principles to be in force before Ofcom can request fees from regulated service providers. 

The statement applies to the 2026-2027 charging year (beginning 1 April 2026 and ending 31 March 2027) and any subsequent charging year (each subsequent period of 12 months starting on 1 April). It sets out the principles that Ofcom will apply when determining the fees payable by providers of regulated services. Service providers subject to the regime (those with a "qualifying worldwide revenue" exceeding £250 million) must register on the online safety fees portal and notify Ofcom by 11 April 2026. 

See this Regulatory Outlook for more information on the fees regime. 

UK Media Act updates 

Government publishes regulations on Tier 1 video-on-demand services 

Recognising the increased use of video-on-demand (VoD) services by audiences and the regulatory imbalance between traditional broadcasting channels and VoD services, the Media Act 2024 introduced amendments to the UK's broadcasting regulatory framework to align the regulation of certain VoD services with broadcasting services. 

In particular, it provided powers for the secretary of state to designate certain VoD services as "Tier 1 services", bringing them under enhanced regulation by Ofcom. The government has now published the On-demand Programme Services (Tier 1 Services) Regulations 2026, which will bring these provisions into effect on 1 April 2026. 

Under the regulations, a VoD service based in the UK (referred to as an on-demand programme service (ODPS)), or a non-UK ODPS, will be a Tier 1 service if it has more than 500,000 users in the UK (excluding ODPS provided by the BBC, such as iPlayer, which is regulated separately by Ofcom under the BBC Framework Agreement).  

The regulations also define "user" and provide that a person is not a user if they access the ODPS (whether UK or non-UK) through a user-to-user service (as defined by the OSA), for example via a channel on a video-sharing platform. However, this exception does not apply to a person using an ODPS provided by a public service broadcaster (PSB) other than the BBC. 

The secretary of state will designate which services are to become Tier 1 services through further secondary legislation. Ofcom will also engage with services to determine those that qualify as Tier 1 services and will consult on draft VoD standards and accessibility codes. 

The government has also published a statement on the designation of Tier 1 (VoD) services, in which it explains that it considered using other metrics as possible designation thresholds, such as turnover, catalogue size, and content spend and type, but ultimately decided to base the threshold on the number of users. 

Government publishes statement on future regulation of TV EPGs 

The government consulted in September 2023 on the future regulation of currently unregulated TV electronic programme guides (EPGs) – the on-screen menus integrated into TVs, set-top boxes and apps. Currently, only channels appearing in regulated EPGs are subject to regulation, meaning that many newer EPGs and linear channels delivered over the internet (that is, using internet protocol (IP) technology) fall outside the regulatory framework. The government sought views on how this regulatory gap should be addressed. 

It has now published a statement on the consultation, together with a summary of responses received. The government has decided to address the regulatory gap in two stages. First, it will introduce secondary legislation under existing powers to regulate: i) EPGs that are delivered by an already regulated EPG provider but currently fall outside the regulatory framework; and ii) portal services available through a regulated EPG. Second, the government will engage with stakeholders to determine next steps for addressing the regulatory gap arising from the development of new IP television services. This may involve using an audience reach threshold to bring such services within scope, but the government intends to consider the broadcasting regulatory framework more broadly, including whether it remains fit for purpose in relation to IP-delivered services. 

Ofcom publishes statement on safeguarding local news and information on analogue commercial radio 

The Media Act has changed Ofcom's duties in relation to the regulation of local analogue commercial radio. In particular, it gives Ofcom a duty to include new conditions in local commercial radio licences, which would require stations to broadcast local news and information regularly, including "locally-gathered" news. Following consultation, Ofcom has now published a statement setting out the new requirements, alongside guidance to assist licensees with compliance. 

The new requirements include: 

• Local analogue commercial radio stations must broadcast local news at least hourly during daytime weekdays and at least three times during peak time weekends and bank holidays, with reduced requirements for stations with very low turnover (under £50,000).
• Local news must include some news locally gathered by journalists physically present in the relevant areas.
• Local analogue commercial radio stations must also broadcast local information regularly throughout daytime weekdays and at peak times on weekends and bank holidays and maintain a public file detailing their compliance with these requirements.
• Licensees not previously required to provide local news will have two years before the new requirements come into force; all other licensees will have one year. 

Ofcom recommends designation of radio selection services  

The Media Act introduced rules to secure the availability of online streams of broadcast radio services via voice-activated devices, defining these as radio selection services (RSS). Certain designated RSS must reliably play an online stream of a UK broadcast radio service in response to a user's voice command. Before deciding which RSS to designate, the secretary of state must first receive recommendations from Ofcom.  

Ofcom has published its statement, following consultation, recommending the designation of three RSS. The secretary of state will now decide which RSS to designate, after which Ofcom will consult on a draft code of practice for designated RSS providers and provide information for internet radio services wishing to benefit from the new regime.  

Ofcom publishes update on its implementation progress and plans 

Ofcom has published an update on its implementation of the Media Act. Alongside its review of activities to date, it has set out the actions it plans to take in 2026. Among other things, Ofcom intends to consult on:  

• a proposed VoD code following the government's designation of Tier 1 services;
• a new accessibility code for Tier 1 services in spring; and
• its proposed designation of PSB players in scope of the new prominence rules and publish its final code of practice and guidance for providers within scope of those rules later this year.