The UK’s Online Safety Act heats up: fines, battlelines and (even more) regulation

Our previous post recapped how the UK’s Online Safety Act (OSA) spent 2025 finding its feet: from early enforcement action against obvious non-compliers to the first judicial review under the OSA. In this post, we cover Ofcom’s work so far in 2026 and look ahead at what the rest of the year holds. The TL;DR? More enforcement, more legal challenges and significant changes to the online safety landscape.

The UK follows the Aussie example

The headline development of 2026 so far has been the government's 15 June announcement of its intention to introduce a ban on social media for children aged sixteen and under, following Australia’s lead. 

According to the announcement, the ban will target user-to-user services that, “enable social interaction, and which allow users to post material, alongside algorithms”. It has also been announced that “world-leading blocks on harmful functions such as livestreaming and stranger communication with children for under-16s” will be introduced alongside it, as well as targeted restrictions for those aged 16 and 17. If implemented, this will mean a huge overhaul for regulation of online safety in the UK, likely accompanied by a bolstered Ofcom enforcement capability (and a larger online safety budget for Ofcom to match).

Though much of the detail remains unclear, the announcement does provide some clues about who will be in scope. Snapchat, TikTok, YouTube, Instagram, Facebook and X have been all been named in the Government’s announcement. Broader additional restrictions will apply to other online services, including gaming services. Messaging services like WhatsApp and Signal, as well as educational services, e-commerce platforms and music streaming are expected to be exempt from the ban and other restrictions. On AI, the government also announced that “romantic companion’ chatbots designed to simulate sexual relationships will be subject to a minimum age of 18, with similar restrictions applying to AI chatbots more widely”. 

The Government has commissioned research into children’s use of VPNs and asked Ofcom to complete a “rapid assessment of effective age assurance” by October 2026, to inform Parliamentary debate. Ofcom has already signalled that there are fewer reliable age assurances available to ascertain if someone is under 16 than there is for under 18s. Currently, secondary legislation implementing the ban is expected before year-end, with the ban set to come into force in Spring 2027. Further secondary legislation implementing additional restrictions is then expected by mid-June 2027. The government has committed to delivering regular updates, with the next one expected by 16 July 2026. 

OSA enforcement: foot on the gas

Meanwhile, Ofcom has continued to enforce the existing legislation with its focus expanding from smaller, riskier services to large tech platforms too. 

• Enforcement shifts to household names: Ofcom’s shift to household names is well underway. In April 2026, Ofcom opened an investigation into Telegram following reports of child sexual abuse material (CSAM) on its platform. Earlier in the year, Ofcom announced its investigation into X over its Grok AI chatbot generating undressed images, which potentially amounted to intimate image abuse, pornography or CSAM. In May 2026, Ofcom publicly challenged several household names to deliver a safer online environment for UK children, covering age checking, grooming and CSAM protection, safer feeds and recommendations, and pre-launch product testing.

• Willingness to reach deeper into its enforcement toolbox. Its May 2026 statement noted that it is “exploring using new inspection powers under the OSA” to scrutinise responses to its requests for information, powers that would allow it to require skilled person reports and issue remote inspection notices to “observe content detection, moderation systems, algorithms and age-checks in real time”. Until now, Ofcom indicated these powers would be reserved for only the most serious cases. 

• Bigger names, bigger fines: In February 2026, Ofcom issued its largest fine to date; £1.4 million to porn company 8579 LLC for failing to implement highly effective age assurance measures and responding to an RFI. With household-name platforms now in Ofcom’s sight and significant worldwide revenues in scope, a steady increase in fine levels through the second half of 2026 seems likely. 

• Business disrupted: Ofcom’s business disruption powers allow it to seek court orders requiring payment providers, advertisers or ISPs to withdraw services from a non-compliant platform. Previously threatened against 4chan, these powers moved closer to deployment when Ofcom announced on 13 May 2026 that it is preparing a business disruption application for a court order against an unnamed suicide forum, already fined £950,000, if the breach continues. The compliance deadline has passed without a public update. Watch this space. 

The first battlelines are drawn

2026 is shaping up to be the OSA’s most contested year yet, with further judicial review challenges already underway and more expected as Ofcom’s regulatory framework continues to take shape. 

In our previous post, we updated on Wikimedia’s judicial review challenge of Categorisation Regulations. The second judicial review concerns Ofcom’s Online Safety Act 2023 (Qualifying Worldwide Revenue) Regulations 2025 (QWR Regulations). Under the OSA, Ofcom’s costs of regulating online safety are required to be recovered from providers of regulated services with the fees framework largely set by Ofcom. The challenge, brought by Meta,* concerns Ofcom’s decisions to: 

• adopt a different, more expansive, definition of QWR for penalty caps where several companies in a group are held joint and severally liable for a breach of the OSA; 

• define QWR by reference to providers’ worldwide revenues, rather than revenues from UK users (wherever they happen to be received); and 

• provide that QWR is calculated per provider rather than per regulated service. 

The challenge received permission to proceed, and the hearing is listed for October 2026. Before that, in September 2026, Ofcom would issue invoices and collect its (first) fees from eligible providers to recover the approximately £88 million it had spent on online safety in 2026/2027. 

If Meta’s challenge succeeds, the QWR Regulations (or parts of it) may be declared unlawful. If so, Ofcom may need to issue refunds while it considers how to re-make the QWR Regulations. As Ofcom continues to consult on and operationalise the remainder of the OSA, including finalising the register of categorised services and completing its work on the additional duties that will apply to them, further challenges throughout 2026 are possible.

While some will continue to be contested in the High Court through judicial review, others will take place in a different forum. The OSA provides that appeals against many of Ofcom’s decisions, including its enforcement decisions and categorisation decisions, must be contested in the Upper Tribunal. Though this is a different venue to the High Court, the same principles will apply: the Upper Tribunal will apply judicial review principles rather than a full merits review (see our earlier post for further analysis of what this means).

What’s in the crystal ball? (Even more) online safety regulation 

For a regime yet to reach its full effect, there is a remarkable number of changes in the pipeline for 2026. 

The Crime and Policing Act 2026, which received royal assent in April, gives government new powers to bring AI chatbots currently outside the OSA’s scope into scope. AI chatbots that only allow people to interact with the chatbot itself, and do not search multiple websites or databases when giving responses and cannot generate pornographic content, are not currently regulated under the OSA. This prevented Ofcom from investigating the standalone Grok service earlier in the year over the creation of illegal images. Further secondary legislation to make the change is expected by the year’s end. 

Ofcom is also due to deliver reports on content harmful to children and on children’s use of app stores, including advice on whether changes to primary priority content and priority content are necessary, and whether app stores should be brought into the OSA’s scope. This could mark a significant further expansion of Ofcom’s powers and bring a new front of app store regulation to the UK. 

The regulatory landscape is therefore clearly geared towards (even more) online safety regulation of a greater number of services. As the second proper year of the OSA takes hold, one thing is clear – Ofcom’s work has only just begun.

*Linklaters LLP acts for Meta Platforms, Inc on R (on the application of Meta Platforms, Inc) v Ofcom.