Digital regulation | UK Regulatory Outlook May 2025

Online safety updates 

Protection of children codes of practice and guidance under OSA 

Ofcom has published its protection of children statement under the Online Safety Act 2023 (OSA), which includes draft protection of children codes of practice for search services and for user-to-user (U2U) services (which are now subject to final parliamentary sign-off), and final form children's risk assessment guidance and children's risk profiles, as well as guidance on highly effective age assurance (HEAA) and guidance on what is included in "content harmful to children". 

This part of the regime applies to services which are likely to be accessed by children, which will have been determined by completing a child access assessment (the deadline for which was 16 April 2025) – see our Insight for further information.  

All in-scope services have until 24 July 2025 to complete and record a children's risk assessment to assess the risk of children encountering content harmful to children on their service and the impact on them. This risk assessment is an additional requirement to completing an illegal content risk assessment (the deadline for which was 16 March 2025). 

From 25 July 2025, service providers will need to have implemented the measures set out in the protection of children codes of practice (or be using equivalent effective measures to protect children and mitigate the risks to children identified in their risk assessment).  

According to the codes of practice, not every U2U service has to apply HEAA to comply with their duties. For example, if a U2U service prohibits content harmful to children in its terms and conditions and has the ability to take down such content when it becomes aware of it, it will not need to employ HEAA. There are also carve-outs for the limited number of services for which applying any access or content controls is not currently technically feasible.  

The codes and guidance are complex and services only have until 25 July 2025 to comply. Services should be aware, however, that Ofcom says that it stands ready to enforce, certainly against those services that are deliberately not engaging with child protection measures or are causing egregious harm (see item below for example).  

Letter to pornography services ahead of 25 July deadline to implement mandatory age assurance requirements under OSA  

From 25 July 2025, services in scope of the OSA and that allow pornography must implement "highly effective age assurance" to stop under 18s encountering pornographic content. In light of this deadline, Ofcom has written to hundreds of such services, setting out in detail what they need to do to comply with their duties under the OSA and reminding them of the consequences of non-compliance (penalties of up to 10% of qualifying worldwide revenue or £18 million, whichever is greater). 

The duties under the OSA are already in force for services publishing their own pornography and Ofcom also has an active enforcement programme investigating non-compliance in place. 

Ofcom consults on putting additional requirements on smaller user-to-user services likely to be accessed by children under OSA 

Ofcom has published a consultation on amending its illegal content codes of practice under the OSA to expand the application of measures that allow children to block and mute user accounts (ICU J1 in the code of practice) and disable comments (ICU J2) to include providers of certain smaller user-to-user services that have certain risks and functionalities and are likely to be accessed by children. 

The consultation closes on 22 July 2025. 

Statement of Strategic Priorities for online safety laid before Parliament  

In November 2024, the government published its draft Statement of Strategic Priorities for online safety under the OSA, and launched a targeted stakeholder consultation that closed in January 2025. See this Regulatory Outlook for background. On 8 May 2025, the final statement was laid before Parliament. 

The government has also published its response to the consultation. Overall, most respondents were broadly supportive of the priorities set out in the draft. A few stakeholders said that they would like to see the statement go beyond the measures in the OSA. However, the government said that the statement should not be used as a vehicle to request Ofcom to consider changes beyond the OSA's framework. The OSA provides a clear scope for "online safety matters" in section 235, which requires that priorities within the statement are related to Ofcom's existing online safety functions. In response to the feedback, the government has made some minor amendments to the priorities to provide more clarity. 

Senior executives potentially to face personal liability for failure to remove illegal knife-related content 

The government has published its response to the consultation launched in November 2024 on "knives and offensive weapons: personal liability measures on senior executives of online platforms or marketplaces" (see this Regulatory Outlook), confirming that it will go ahead with introducing legislation to support the removal of illegal knife-related online content from platforms, marketplaces and search services. Failure to comply may ultimately lead to both the companies responsible, and their senior executives, facing penalties. 

The measures the government is proposing will be added to the Crime and Policing Bill currently going through Parliament. A new system will be set up, administered by a new policing unit with national capability, which will be able to: 

• Require companies to designate an appropriate senior UK-based executive. Failure to do so may result in a civil penalty notice against the company of up to £60,000.
• Issue content removal notices to companies and their designated senior executive, informing them of the illegal content and giving them 48 hours in which to remove it.
• Issue civil penalty notices of up to £60,000 for companies and up to £10,000 for the designated senior executive for failure to comply with a content removal notice, rather than face civil court proceedings. 

The proposed legislation will also give online companies and designated executives the right to: 

• Have content removal notices and the content in question reviewed by the police unit.
• Make representations before being issued with a civil penalty notice. 

The government will also propose the following defences, where the senior executive: 

• Has taken all reasonable steps to comply with a content removal notice.
• Was too new in post to be considered responsible for failing to comply.
• Had no knowledge of being named as the designated senior executive. 

The measures are separate to the OSA, but complement its provisions relating to illegal content on knives and offensive weapons, according to which companies are required to assess the risk of illegal knife-related content appearing on their services and put measures in place to manage those risks. 

Media Act updates 

Ofcom publishes final statement on principles and methods it will apply when preparing its report on the designation of TSS 

In December 2024, Ofcom consulted on a statement setting out the principles and methods it will apply when preparing its report to the secretary of state with recommendations on the designation of "television selection services", a new online availability and prominence regime for public service broadcasters' (PSBs) TV apps distributed on connected TV platforms. See this Regulatory Outlook for background. 

The responses to the proposed statement were largely supportive, so Ofcom has decided to proceed with no changes. 

Ofcom's statement on designation of radio selection services  

Ofcom has published its statement of principles and methods that it will apply when preparing a report with recommendations to the secretary of state regarding the designation of radio selection services. Ofcom has previously consulted on the statement – see this Regulatory Outlook. 

Ofcom consults on PSB quotas 

Ofcom is consulting on implementing changes to the PSB quota obligations under the Media Act 2024.  

The Media Act updates the regulatory framework for PSBs set out in the Communications Act 2003, which was originally designed for an age of linear TV, and allows PSBs to use their on-demand services to meet their productions quotas. PSBs each have quotas for original, regional and independent productions. 

Ofcom is also consulting on guidance on which programmes will count towards the original productions quota, and on amending its guidance on regional productions.  

The deadline for responses is 10 July 2025.  

EU 

European Commission publishes draft guidelines on protection of minors online under DSA 

The Commission has published its long-awaited draft guidelines on the protection of minors online under the Digital Services Act (DSA). The guidelines cover age verification, use of recommender systems, privacy by default, content moderation, child-friendly reporting systems, governance and user support. They therefore cover similar themes as Ofcom's child safety codes of practice (see item above). However, the EU guidelines are just guidelines, whereas Ofcom's codes of practice set out what providers need to do in order to comply with their legislative obligations under the OSA. 

The guidelines are open for consultation until 10 June 2025, and the Commission plans to adopt the final version "by the summer of 2025".  

The Commission is also working on an age verification app that platforms can use as an interim solution until the EU Digital Identity Wallet is adopted by Member States in 2026.  

Review of AVMSD: Council outlines its priorities for the audiovisual media sector  

The Council of the EU has published its conclusions on the assessment of the legal framework for audiovisual media services and video-sharing platform (VSP) services in relation to the Commission's upcoming review of the audiovisual media services directive (AVMSD). 

The AVMSD was last revised in 2018, and the audiovisual and media landscape has changed significantly since then. On 26 November 2024, the Commission informed the Council of its intention to review the AVMSD in 2026. The conclusions outline the Council's preliminary position on this review, offering the Commission guidance on the key areas to focus on.  

The Council invites the Commission to: 

• Scope: analyse the scope of the AVMSD, including assessing whether amendments are needed to make it clear that specific groups of content creators on VSPs, such as influencers, are covered.
• Minors: assess whether the current rules still ensure a high level of protection of minors from potentially harmful or unsuitable content on audiovisual services, and look into how the AVMSD and the DSA work together in protecting minors.
• VSPs: assess whether the current AVMSD rules for VSPs are sufficient to protect the public from harm and other societal risks on VSP audiovisual content and promote a level playing field, including in audiovisual commercial communications.
• Disinformation: engage regularly with Member States on the results of the dialogue between providers of very large online platforms under the DSA (in particular those within the definition of VSPs), media service providers and other key stakeholders, focusing on compliance with self-regulatory initiatives to protect users from harmful content, including efforts to combat disinformation.
• Events of cultural importance: assess if the AVMSD is still effective in ensuring broad access to events of major societal importance.