Digital regulation | UK Regulatory Outlook October 2025

UK

Online safety updates 

'Cyberflashing' to be made priority offence  

The tech secretary, Liz Kendall, announced plans on 29 September to make "cyberflashing" a "priority offence" under the Online Safety Act 2023 (OSA). 

Cyberflashing is the sending of unsolicited nude images on social media and other platforms. It is already a criminal offence under the OSA and can result in up to two years in prison if images are sent with intent to cause alarm, distress or for sexual gratification. Making it a priority offence under the OSA means that regulated providers will have to take proactive steps to prevent users from seeing these unsolicited nude images, rather than just taking reactive measures after the event. 

The government action is part of its initiative to reduce violence to women and girls. Ofcom is also under a duty to publish guidance for regulated providers focusing on illegal content that disproportionately affects women and girls, so once cyberflashing becomes a priority offence, expect this to be included in Ofcom's eventual guidance. 

Ofcom consults on data preservation notices  

Ofcom has consulted on updates to its Online Safety Information Powers Guidance, originally published in February 2025, with respect to data preservation notices. The regulator has also consulted on a small number of updates to its guidance on coroner information notices based on its early experience of processing requests from coroners. 

By issuing a coroner information notice (under section 101 of the OSA), Ofcom can exercise its information-gathering powers to support an investigation by coroner's (in England, Wales and Northern Ireland) or a procurator fiscal's (in Scotland) investigation into the death of a child. 

The Data (Use and Access) Act 2025 provides Ofcom with additional functions to support coroners' investigations. These were brought into effect by the Data (Use and Access) Act 2025 (Commencement No. 2) Regulations 2025. From 30 September 2025, if a coroner provides Ofcom with certain information about the death of a child, Ofcom has a duty to issue a data preservation notice to relevant regulated services. 

The consultation closed on 28 October 2025. 

Media Act updates 

Media Act 2024 (Commencement No.3) Regulations 2025 made 

The Media Act 2024 (Commencement No. 3) Regulations 2025 were made on 25 September. 

The regulations bring into force on 1 October and 1 January 2026 sections of parts 1 and 3 of the Media Act 2024 which include provisions: 

• relating to the secretary of state's power to make regulations concerning independent productions quotas;
• updating the commissioning duties of Channel 4;
• bringing into force provisions in part 1 that update the regulatory framework for public service broadcasters (the BBC, S4C, and Channels 3, 4 and 5), so far as they were not already brought into force by the Media Act 2024 (Commencement No. 1) Regulations 2024;
• updating the powers and public service remit of S4C (the Welsh public service broadcaster) in line with the specified framework; and
• bringing into force schedule 2 to the Media Act 2024 (in part), and the remaining parts of schedules 1 and 4, which give effect to the provisions in parts 1 and 3 to which they relate. 

Ofcom consults on draft report to the secretary of state on designation of radio selection services  

Ofcom has published a consultation on its draft report with recommendations to the secretary of state on the designation of radio selection services (RSS), which are required to provide an online stream of a UK broadcast radio service in response to a voice-activated command. The consultation identifies those RSS proposed for designation and explains the rationale for these proposals.  

Following this consultation, Ofcom expects to publish its final report early in the new year and subsequently consult on a code of practice describing how designated RSS must comply with the Media Act 2024.  

Responses to the consultation must be made by 11 December. 

Ofcom finalises changes to PSB quotas system  

Ofcom has published a statement confirming its approach, following a consultation on public service broadcasters (PSBs),  to implementing the changes set out in the Media Act to the regulatory framework governing productions quotas for PSBs.  

The statement explains the decisions Ofcom has made and sets out the revised quota levels for PSBs that will apply from 2026, once the necessary secondary legislation comes into force (see below). Ofcom has also published finalised updated guidance on productions quotas to assist PSBs in meeting their quota requirements.  

The Media Act modernises the productions quota obligations of PSBs (that is, the minimum amounts of original, regional and independent productions that must be commissioned or produced and subsequently made available by each PSB) so that they better reflect the shift from purely linear broadcasting to a mix of linear and on-demand services. PSBs will therefore be allowed to use their on-demand services, as well as their linear services, to meet their productions quotas. Each PSB has a quota for original, regional and independent productions respectively. Ofcom sets the quota levels for original and regional productions for each PSB, while the secretary of state sets the quotas for independent productions in secondary legislation. 

The main changes to the productions quota obligations include:  

• Converting quota proportions to hours and spend. Quotas are currently set as a proportion (percentage) of a linear channel's output. These will be replaced with fixed annual minimums for the number of hours of content that must be made available, which broadly maintain the current percentages but will apply to on-demand services as well as linear channels.
• Original productions. While PSBs will continue to be able to count repeats of programmes shown on their linear PSB channels towards their quota, content first provided on on-demand service will only count towards the original productions' quota once. Therefore, content made available online that has previously been transmitted on a linear service will not count. Ofcom has also published its final Original Production Guidance, which describes the types of programmes that can and cannot count towards the quota.
• Regional productions. The spend quota will be raised by 2% each year to account for likely increases in production costs over time. Ofcom will review the spend quota levels after three years. Ofcom has also published its final Regional Production Guidance, which explains Ofcom's approach to interpreting the statutory obligations and monitoring compliance.
• Independent productions. Under the Media Act, the secretary of state must set the minimum amount of programming that PSBs must commission from independent producers as a minimum number of hours, rather than as a proportion of the number of hours of "qualifying programmes" (as defined by the secretary of state). The government has now published the revised quota levels for independent productions in draft secondary legislation (see below).  

To bring all the above into effect, the government has laid before Parliament two draft statutory instruments: 

• The Broadcasting (Regional Programme-making and Original Productions) (Amendment) Regulations 2025; and
• The Broadcasting (Independent Productions) Regulations 2025. 

Both draft instruments are expected to come into force on 1 January 2026. 

EU updates 

European Commission's second blueprint for an EU age-verification solution under DSA 

In July 2025, the European Commission published its guidelines on the protection of minors under the Digital Services Act (DSA), which, among other things, recommend the use of age-verification technologies to restrict access to adult content. At the same time, the Commission released the first version of an age-verification blueprint. The Commission's age-verification blueprint sets out its approach to the development of "user-friendly and privacy-preserving age verification method", in particular, a device-based method of age verification to enable users to prove that they are over 18 without revealing any other personal information when accessing restricted adult online content. The blueprint consists of technical specifications (aligned with those of the EU Digital Identity Wallets) and an open-source implementation of these as a mobile app that can be customised to national contexts. See this Regulatory Outlook for background.  

In October 2025, the Commission released a second version of the blueprint, which introduces the use of passports and identification cards as an onboarding method, and a Digital Credentials API (application programming interface). The software is being tested by several member states, including Denmark, France and Greece, and by adult content platforms.  

European Commission consults on its evaluation of the Geo-blocking Regulation 

Following a report from the European Court of Auditors (ECA) on the issue of geo-blocking and how unjustified geo-blocking is still a problem across the EU, the Commission announced an evaluation of the Geo-blocking Regulation (2018/302/EU) in February 2025. It has now launched a public consultation on its evaluation. 

The consultation aims to gather information and evidence on the functioning of the regulation, its implementation, application and enforcement. It will look at territorial supply constraints and the cross-border availability of, and access to, copyright-protected content. 

In its reply to the ECA's report, the Commission committed to consider extending the regulation to services providing access to audiovisual content. It also said that it would update its guidance for member state authorities to improve awareness of the regulation's requirements and improve the enforcement cooperation system. 

The consultation closes on 29 December 2025.  

European Commission and EDPB consult on joint draft guidelines on interplay between DMA and GDPR 

See Data law section.