Digital regulation | UK Regulatory Outlook November 2025

UK updates 

Online safety updates 

Ofcom publishes final guidance on a safer life online for women and girls  

Ofcom has published its final guidance on a safer life online for women and girls under the Online Safety Act 2023 (OSA) following a consultation. The regulator has confirmed its overall approach, taken in draft guidance (see this Regulatory Outlook for background), of highlighting existing codes and guidance on illegal content and the protection of children ("foundational steps") alongside ways providers can go further in demonstrating a commitment to the safety of women and girls ("good practice steps") as well as nine actions for service providers to take. It has also made some amendments and clarified the scope of content and activity captured by the guidance, which it set out in its statement.   

Ofcom guidance on OSA and online video games services  

Ofcom has published a guidance note on how the OSA applies to the online video games industry. 

The regulator explains that: 

• The OSA applies to "user-to-user" services that have links to the UK. In the context of online video game services, this could take various forms, including where users interact with one another by creating or manipulating player profiles, avatars, objects or the environments themselves, or by using voice and text chat (including, for example, team-based channels or open-world chats). The OSA could also apply to games that use matchmaking systems to connect users with each other, including strangers, through mechanisms such as populating lobbies and/or by assigning players to teams, and where services enable livestreaming. While the OSA covers user-generated content, it does not cover content published by the provider (except for online pornography). For online video game services, this could include, for example, offline gameplay, original or additional game content developed and published by a studio, or the enforcement of PEGI (Pan-European Game Information) age ratings.
• Where the OSA applies, providers of online video games must assess the risk of harm from illegal content and content harmful to children and put measures in place to mitigate those risks.
• Guidance and resources to help video game providers scope and carry out their duties under the OSA are available on Ofcom's website.  

EU updates 

Commission launches digital fitness check as part of its simplification agenda  

On 19 November 2025, the European Commission has published a call for evidence and a consultation on a digital fitness check as part of its plans to simplify the EU's digital rulebook. The fitness check follows the Commission's Digital Omnibus, published on the same day, as the second part of its digital simplification drive. See the AI and Data law sections for more information on the Digital Omnibus.  

The Commission seeks views on how EU digital rules interact and what their combined effects are in practice on people, businesses and public authorities. After this first consultation step, the fitness check will focus more in depth on the interplay between selected rules with simplification potential, especially in relation to SMEs. 

The call for evidence and consultation close on 11 March 2026.  

2025 Annual Progress Reports on simplification, implementation and enforcement 

Ahead of publication of the Digital Omnibus and as part of the Commission's work on simplifying, implementing and strengthening enforcement of the EU's digital rulebook, the tech commissioner, Henna Virkkunen, and the commissioner for justice, Michael McGrath, have each published an annual progress report (here and here), highlighting the main achievements across their particular portfolios during the first half of 2025.  

Key points from both progress reports include: 

• DSA: guidance on protecting minors and a privacy oriented age verification blueprint are now in place (see this Regulatory Outlook). The Code of Conduct on Disinformation has been integrated into the Digital Services Act (DSA) framework and infringement cases have been launched against Member States that have not yet designated their Digital Services Coordinators (DSCs).
• AI Act: general provisions and prohibitions came into effect on 2 February 2025, while obligations for general purpose AI (GPAI) models commenced on 2 August 2025. The Commission has also published a voluntary GPAI Code of Practice, as well as guidance on the definition of AI system, and on GPAI provider obligations. A template to summarise training data has also been released and the AI Act Service Desk was launched on 8 October 2025. Delays in Member States setting up their authorities have been flagged as a "serious concern". See AI section for more information on AI-related updates.
• Data Act: the Data Act came into effect on 12 September 2025. The Commission has published Frequently Asked Questions and is working on model B2B data sharing terms and standard contractual clauses for cloud computing contracts. Guidance on "reasonable compensation" under Article 42 will be coming soon. A Data Act Legal Helpdesk has been pledged and the European Data Innovation Board is coordinating implementation of the Act across Member States.
• GDPR: in May 2025, the Commission proposed exempting "small mid-cap companies" and other organisations with less than 750 employees from record-keeping obligations unless the processing is "likely to result in a high risk" to data subjects' rights and freedoms (see this Regulatory Outlook). Progress has also been made on the adoption of the new regulation on cross-border GDPR enforcement and, in July, an implementation dialogue on the application of the GDPR was held to discuss ways of simplifying it. See Data law section for more information on data-related updates.
• EMFA and AVMSD: the European Media Freedom Act (EMFA) came into effect on 8 August 2025 and the new European Board for Media Services has been established. The Commission is also currently evaluating the Audiovisual Media Services Directive (AVMSD).
• DFA: the Commission's proposal for a Digital Fairness Act (DFA), aimed at closing gaps in consumer protection in the digital environment and ensuring a level playing field for traders, while maintaining strong consumer standards, has not yet been published, but a consultation to gather views and evidence to inform the proposal was launched in July 2025 (and closed on 24 October). The DFA will also include targeted simplification and administrative burden reduction measures. See our DFA hub for more.
• In terms of next steps, the reports state that the Commission will continue its "stress-testing" of the digital rulebook "over the next years".  

Rules on data access for researchers under the DSA in effect  

On 29 October 2025, a delegated act under the DSA outlining rules for providing qualified researchers with access to data from very large online platforms and very large search engines entered into force. 

The delegated act defines procedures and technical conditions for providing vetted researchers with access to such data. The aim is to support new research into systemic risks linked to platforms, such as the spread of disinformation, impacts on minors and mental health, as well as electoral integrity. 

To get access to platforms' data, researchers will be vetted by DSCs, the national authorities responsible for the implementation of the DSA. 

Commission launches a call for evidence on AVMSD review  

The Commission has launched a call for evidence on the evaluation and review of the AVMSD. 

As part of the evaluation, the Commission plans to assess its effectiveness, efficiency, relevance, EU added value and (internal and external) coherence. It will look at its scope, prominence of media services of general interest, audiovisual commercial communications, protection of minors rules applicable to video-sharing platforms and promotion of European works. The Commission will also look into potential scope for simplifying the legal framework.  

Based on the outcome, the Commission plans to present a proposal for the review of the directive. 

The call for evidence closes on 21 December 2025.