Ofcom’s new powers under the Online Safety Act

From Monday 17 March 2025, Ofcom received new powers to tackle illegal content on technology platforms. As the regulator, Ofcom is able to enforce the Online Safety Act’s illegal content codes, requiring social media companies to find and remove harmful content, such as child sexual abuse material.

Background

Originally passed in October 2023, the Online Safety Act 2023 is designed to make the internet safer, especially for children. One of the fundamental elements of the legislation is the new duties that it places upon social media firms and the powers it gives Ofcom, as the regulator, to enforce them.

Illegal content codes

The illegal content codes relate to material such as hate crimes, terrorism, content encouraging or assisting suicide and child sexual exploitation and abuse. New duties imposed on social media firms require them not only to detect but also remove the content using advanced tools such as moderation and reporting mechanisms and automated hash-matching.

Ofcom’s enforcement powers

Ofcom will be able to enforce the rules laid out in the Online Safety Act in a number of different ways. Platforms will need to begin providing evidence to the watchdog of how they are meeting the set requirements. Ofcom will then evaluate and monitor these companies before deciding to take action for non-compliance.

The Online Safety Act gives Ofcom a number of enforcement powers, which include:

• Issuing notices of contravention (both provisional notices and confirmation decisions)
• Issuing penalty notices
• Business disruption measures.

The penalty notices that Ofcom can issue can be up to £18m or 10% of the company’s global revenue, whichever is higher. 

Criminal liability for non-compliance

Companies and employees of firms captured by the Online Safety Act need to be aware that criminal action can be taken against senior managers within the company who fail to ensure information requests from Ofcom are fulfilled. Both companies and managers will be able to be held criminally liable for non-compliance, and in the most serious of cases, Ofcom will, with agreement from the courts, be able to require internet providers and advertisers to stop working with platforms. 

New criminal offences

The Online Safety Act also created a number of new criminal offences within Part 10 of the Act, which came into force on 31 January 2024. These offences include false communications, threatening communications and sending or showing flashing images electronically.

The Online Safety Act: Still to come

There are still a number of measures within the Online Safety Act that are yet to be implemented. Some of the highlights include:

• By 16 April 2025, all providers must have completed a children’s (under 18s) access assessment
• By July 2025, child safety duties to be in force. Services likely to be accessed by children must have completed a ‘suitable and sufficient’ children’s risk assessment and implement the safety measures required