Radar roundup 2025

It's barely possible to keep up with developments in AI. Here, we look at some of the key legal and policy events in the UK and EU over the course of 2025. Many of these are explored in more detail in our AIQ publication, and data protection-related developments are covered in the Data and cyber security section of this update. You may also be interested in our predictions for AI in 2026.

UK

Policy, plans and investment

Matt Clifford's AI Opportunities Action Plan and the government's response to it were published on 13 January 2025. The Action Plan made 50 recommendations, all of which the government is taking forward. Read more.

Towards the end of the year, the government said a consultation on an AI Bill would not be published before 2026, and rumours that an AI Bill could be dropped altogether were given substance by Technology Secretary, Liz Kendall, in early December, when she said: "I'm thinking of it more in terms of specific areas where we may need to act, rather than a sort of big, all encompassing Bill". In the absence of a government-proposed AI Bill, there were two private members' Bills on AI which progressed up to a point. The Private Members' Bill on Public Authority Algorithmic and Automated Decision-Making Systems moved through the Lords and then to the House of Commons for consideration and the Artificial Intelligence (Regulation) Bill, had its second reading in the Lords. It provides for a central AI authority to oversee the UK's regulatory approach to AI, aims to mitigate risks to individuals from the use of AI in the public sector, and provides for an independent dispute resolution mechanism. It is unusual for Private Members' Bills to become law.

The government committed to supporting regulators to continue with their AI-related work, including through the Regulatory Innovation Office (RIO), and the AI and Digital Hub. The government also confirmed its plans to place the AI Safety Institute on a statutory footing and established the Central AI Risk Function within DSIT. DSIT launched a UK survey on the AI sector which closed on 31 March 2025. Responses will be used to inform government policy on AI.

On 21 October 2025, the UK government announced a new blueprint for AI regulation and launched a call for views on an AI Growth Lab which will use supervised regulatory sandboxes to test AI in real-world conditions in healthcare, professional services, transport and advanced manufacturing. The government also launched a public call for views on an AI Growth Lab. Responses are requested by close on 2 January 2026.

The regulators continued to cooperate on a sector-focused approach while policy consultations proliferated:

• On 25 March 2025, the ICO and the CMA published a paper on Harnessing Innovation and Growth Opportunities from AI Foundation Models. 
• On 6 June 2025, Ofcom published its strategic approach to AI setting out how it supports safe innovation and the use of AI across the sectors it regulates and in its own work, including collaboration on regulatory alignment, especially through the Digital Regulatory Cooperation Forum (DRCF). 
• On 25 July 2025, the House of Commons Joint Committee on Human Rights launched an inquiry into Human Rights and the Regulation of AI. The inquiry will look at what regulation might be needed to safeguard human rights when AI technologies are being developed and used and at any implications this might have for future legislation. Responses were requested by 5 September 2025. 
• On 1 July 2025, the then Secretary of State, Peter Kyle, announced that RIO and the DRCF will work together to cut red tape and support fintech innovation by putting relevant digital regulation guidance, especially that relevant to bringing AI products to market, into a single digital library. 
• On 31 July 2025, the Law Commission published a discussion paper on AI and the Law. The paper aims to raise awareness of legal issues regarding AI and help identify areas of law most in need of reform. 
• On 10 October 2025, the DRCF published a report on the key learnings from its one year AI & Digital Hub pilot. Insights from the pilot will be used to inform the next phase of the DRCF's work. It also launched its Thematic Innovation Hub to provide regulatory advice on priority topics and published a call for views on the regulatory challenges in developing and deploying Agentic AI to feed into its first topic. 
• On 13 November 2025, the government published a policy paper on Delivering AI Growth Zones (AIGZs). A new AI Growth Zone Delivery Unit will oversee implementation of policies to address the main challenges which are focused on accelerating grid connections, bringing down energy prices, reducing planning barriers, and fostering investment. Four AIGZs have been announced this year.

Copyright

One of the most pressing issues with the rise of AI is copyright in training materials and output. The long awaited decision in Getty Images v Stability AI failed to deliver conclusive answers in many key areas as we discuss here, but the Data (Use and Access) Act (DUA Act) was almost derailed by reactions to the government's consultation on copyright. Concerns that the government favours allowing data scraping and use of copyright materials to train AI unless the rightsholder opts out (similar to the EU Copyright Directive TDM exception) in its ongoing consultation on copyright and AI, led the House of Lords to push for rightsholder protections in the DUA Bill. Ultimately, the Lords gave way but not before forcing a number of relatively minor amendments into the DUA Act on 19 June 2025.

The Secretary of State is now required to publish an assessment of the economic impact of the four options proposed in the consultation on AI and copyright within nine months of the DUA Act's date of Royal Assent. The Secretary of State must also publish a report on the use of copyright works in the development of AI systems and consider the four consultation options. In addition, a progress report is required within six months of the DUA Act getting Royal Assent (ie by 19 December 2025). On 16 July 2025, the government announced it was setting up an expert working group on AI and copyright. The group includes representatives from leading tech firms including Amazon, Sony Entertainment, Meta, Open AI and the Publishers Association. 

Meanwhile, the Copyright Licensing Agency (CLA) announced on 18 March 2025, that it was adding new permissions to its commercial and public sector licences enabling UK professionals to use copyright-protected content to prompt generative AI tools from 1 May 2025. This will allow the lawful copying of published content to prompt relevant Generative AI tools to generate outputs. 

For more on AI and copyright issues in the UK and EU, see here, and you can find our AI copyright litigation tracker here.

EU

Legislation and policy

On 2 February 2025, the EU AI Act AI literacy requirement under Article 4 came into force. The EC Digital Omnibus proposal introduced on 19 November 2025, suggests that AI literacy obligations will move from provider and deployer responsibility to the Commission and Member States at some point. Article 5 also came into effect on 2 February. This prohibits certain types of AI including AI systems used for social scoring, emotional analysis in the workplace, and subliminal manipulation. See our article for more. Finally, on 2 August 2025, the rules on GPAI models became applicable. 

Even as the AI Act's implementation was progressing, the European Commission was planning changes. On 19 November 2025, the European Commission published a Digital Omnibus proposal which plans changes to the AI Act. Most notably, the application of Chapter III AI Act on high-risk AI is linked to completion of standards and guidance. The rules will only apply once the Commission adopts a Decision confirming completion and after that, a six month transition period for Annex III systems, and 12 months for Annex I. However, if no such Decision is adopted, a back stop kicks in and the rules will apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I). The Omnibus proposal is in its initial stages and is likely to prove controversial. Whether or not it can be introduced in time to change AI Act compliance deadlines remains to be seen. Read more about the Omnibus proposal here.

The European Commission formally withdrew the proposal for an AI Liability Directive on 31 July 2025 along with the proposed Standard Essential Patents Regulation, following a six month consultation. 

Plans for global prominence (if not dominance) in AI continued. On 9 April 2025, the European Commission published its AI Continent Action Plan which outlines actions to help achieve the EU's goal of becoming a global leader in AI. Read more. On 8 October 2025, the European Commission published two strategies to accelerate AI uptake in industry and science along with funding commitments. 

Copyright and data protection

As in the UK, copyright and AI continued to be a focus in the EU, most recently with an important decision in GEMA v Open AI in the Munich court (see here), which largely upheld GEMA's copyright claims against OpenAI. See here for more on AI copyright litigation in the EU and UK. 

Data privacy is another long-running issue but the Digital Omnibus again contains some potentially useful provisions if they make it through to enactment:

• Legitimate interest for AI (new Article 88c): a new Article 88c explicitly states that processing personal data for the "development and operation of an AI system... may be pursued within the meaning of Article 6(1)(f) [legitimate interest]" unless Union or other national laws explicitly require consent. This is subject to the usual requirements to carry out a balancing exercise against the rights of individuals, and to apply safeguards, including data minimisation, transparency, and an "unconditional right to object'''. 

• Bias detection: providers and deployers of all AI systems and models (not just high-risk) will be allowed to process special category personal data for the purpose of ensuring bias detection and correction, subject to appropriate safeguards.

Among other developments:

• Privacy advocacy group NOYB filed a complaint with the Norwegian data protection authority against OpenAI, alleging OpenAI's ChatGPT is in breach of the GDPR accuracy principle and citing ChatGPT's hallucination in which a man was wrongly said to have murdered his daughters and been convicted. OpenAI says it has since updated ChatGPT so that it uses the internet to search for information about individuals.
• The European Commission opened a competition investigation into Google's use of online content for AI models in early December.

Consultations, guidelines and reports

Throughout 2025, the EC published a range of consultations and guidelines to assist with AI Act implementation and compliance including:

• On 4 February 2025, the EC published Guidelines on prohibited AI practices under Article 5 AI Act. The guidelines also cover the relationship between Article 5 prohibitions and high-risk AI systems (Article 6 and Annex III). 
• On 6 February 2025, the European Commission published draft guidelines on what meets the AI Act definition of an AI system. 
• Data Protection Authorities published guidance on AI Act literacy requirements which also began to apply on 2 February 2025, with the Hamburg and Dutch DPAs being among the first. 
• The EC launched a survey on 2 April 2025, to gather information on how organisations are complying with the EU AI Act AI literacy requirements which came into effect in February this year. 
• On 9 April, as part of the AI Continent Action Plan, the EC ran consultations (which closed on 4 June 2025) on: feedback for preparatory work for the Cloud and AI Development Act; and a consultation on the Apply AI Strategy to identify stakeholder priorities, challenges to the uptake of AI and the relevance of proposed consultations and policy approaches. 
• On 10 April 2025, the EC launched two consultations on a future European Strategy for Artificial Intelligence in Science, a call for evidence and a targeted questionnaire for researchers and the broader research and innovation community. Alongside the consultations, the EC published an update to the European Research Area Forum's Living Guidelines on the responsible use of generative AI in research. Both initiatives are complemented by the EC's Competitiveness Compass. 
• On 13 May 2025, the EC published Q&As for organisations on how to comply with the EU AI Act requirement to ensure AI literacy. This covers definitions and who is in scope, how to comply with Article 4 AI Act, enforcement and the approach of the AI Office to AI literacy, as well as links to useful resources. 
• On 6 June 2025, the EC AI Office launched a targeted consultation on the implementation of the AI Act's rules for high-risk AI systems. 
• The European Commission put forward a proposal for a Council Decision on 3 June 2025, which would authorise conclusion of the Council of Europe (unrelated to the EU institutions) Convention on Artificial Intelligence and Human Rights, Democracy and Rule of Law. The Convention will be implemented in the EU through the AI Act. 
• On 11 June 2025, the European Commission published an FAQ on the interaction between the EU AI Act and medical devices regulations for final approval. 
• On 10 July 2025, the European Commission published the final version of the GPAI Code of Practice which was confirmed on 1 August. This provides guidance on the rules for GPAI models and GPAI models with systemic risk in Articles 53 and 55 respectively of the EU AI Act which have applied since 2 August 2025.  Open AI, Google, Anthropic AI, Microsoft, Mistral and Amazon have signed up. xAI has signed up to the Security and Safety Chapter.  Meta has said it will not sign up. For more detail, see here. 
• On 18 July, the EC published guidelines to help providers of GPAI models comply with their AI Act obligations. 
• On 24 July 2025, the EC published a template which aims to provide a common minimal baseline for the information to be made publicly available in the Summary of Training Content for GPAI models under the AI Act. The template sits alongside the GPAI Model Code of Practice and GPAI Model Guidelines. 
• On 4 September 2025, the European Commission launched a consultation on developing guidelines and a Code of Practice on transparent AI systems. The Commission has published a consultation and call for expression of interest for stakeholders to provide input for the guidelines and a Code of Practice on transparent generative AI, and to express an interest in participating in developing the Code. Q&As accompany those publications. 
• On 26 September 2025, the European Commission published draft guidance on serious incident reporting under the EU AI Act, together with a draft reporting template. Read more. 
• The Commission announced its Single Information Platform and AI Service Desk in October 2025. The platform provides a hub for AI Act information and includes an AI Act explorer and an online compliance assessment tool. The AI Service Desk can be used to submit questions about the AI Act to the AI Office. 
• On 30 October 2025, the European Parliament published an externally-authored study on the interplay between the AI Act and the EU digital legislative framework. 
• On 5 November 2025, the European Commission launched work on a voluntary Code of Practice to mark and label AI-generated content under the AI Act. The Code will support providers and deployers in meeting transparency duties for deepfakes and other synthetic audio, images, video and text through machine-readable markers and clear disclosures.
• On 2 December 2025, the European Commission opened a consultation on a draft Implementing Regulation for AI regulatory sandboxes.  EU Member States are required to adopt at least one regulatory sandbox scheme by 2 August 2026 under the AI Act.  The consultation closes on 30 December 2025.
• On 3 December 2025, the European Parliament's Policy Department for Justice, Civil Liberties and Institutional Affairs, published a report looking at how copyright policy should respond to AI. It identifies statutory licensing as the optimal solution for balancing the rights of copyright holders and the interests of consumers, AI developers and creators, and the economy.  

This year saw significant momentum across the UK and EU in online safety and platform regulation. In the UK, the Online Safety Act (OSA) moved to intensive implementation, with Ofcom focusing on guidance, consultations and early enforcement activity. Across the EU, the Digital Services Act (DSA) matured rapidly through layered guidance, platform designations and formal enforcement steps by the European Commission. See more on online safety here and here, and read our predictions for 2026 here.

UK Online Safety Act

The OSA regime began to bite during 2025:

• Part 5 services which publish their own pornographic content including some Generative AI tools were required to introduce age checks and Highly Effective Age Assurance by 17 January 2025.
• In-scope services were required to have completed their illegal content risk assessments by 16 March 2025 and, as of 17 March 2025, services had to comply with illegal harms safety duties which became enforceable (see more). 
• Part 3 services were required to carry out a children's access assessment to determine whether or not their service or part of it is likely to be accessed by children by 16 April 2025.
• On 25 July 2025, services which allow pornography became subject to requirements to use highly effective age gating to prevent children from accessing porn.  Similarly, sites allowing Primary Priority became obliged to use highly effective age checks.   
• Services likely to be accessed by children were required to conduct a children's risk assessment 25 by July 2025,and then implement protective measures as required.

In March, Ofcom set out its plans for the next three years and its plan for work for the coming year.  Looking in particular at its online safety remit, Ofcom announced it would put in place regulatory requirements that fall on categorised services, publishing the register of categorised services this summer – however, this was delayed as a result of the Wikimedia Judicial Review (see below). 

Ofcom's Final Statement of Strategic Priorities for Online Safety was designated on 2 July 2025, having been laid in draft before Parliament on 8 May 2025.  The SSP sets out the government's focus areas for online safety.  Ofcom is required to have regard to them as it implements the Online Safety Act. 

On 12 November 2025, Ofcom published its updated milestones for the next two years.  Perhaps of most significance is the delay in publishing the list of categorised services.  On 11 August 2025, the High Court dismissed Wikimedia's challenge to the Secretary of State's OSA Categorisation Regulations which set out threshold conditions for designation as categorised services under the OSA.  Wikimedia argued that the criteria for Category 1 services were too broad and would lead to its Wikipedia services being categorised which might, in turn, make it impossible for it to operate.  While the application for judicial review was turned down, Ofcom said it prompted a reconsideration of its plans for the categorisation register and the associated consultation on additional duties for categorised services.  It will now carry out a representations process in early 2026 and publish the register and a consultation on additional duties in July 2026, a considerable delay from the original target of end of 2025 for the first phase, and one which was not well received by the Secretary of State.

Legislation and new offences

Various pieces of secondary legislation were brought in to implement aspects of the OSA including:

• The Online Safety Act 2023 (Category 1, Category 2A and Category 2B) Threshold Conditions Regulations 2025 (Regulations), were made on 26 February 2025 and came into force on 27 February 2025. They set out the thresholds for when user-to-user and search services become "categorised services" subject to additional requirements under the OSA.  See more.
• The Regulations on procedures for reporting CSEA content, made on 19 March 2025 were set to come into force on 3 November 2025 but were later revoked owing to delays.  They set out the procedures which regulated user-to-user service providers must adhere to when reporting CSEA content to the National Crime Agency as required under s66 Online Safety Act 2023. 
• The OSA Commencement No.5 Regulations were set to bring a number of sections of the OSA into force on 3 November 2025, in so far as they relate to user-to-user services only (not to search services).  However, the Regulations were later revoked as elements of the regime were delayed.
• On 22 July 2025, the government made the Online Safety Super-Complaints (Eligibility and Procedural Matters) Regulations 2025. They come into force on 31 December 2025. They set out eligibility criteria to qualify as an entity eligible to bring a super-complaint under the OSA. Ofcom will consult on guidance in relation to super-complaints in February 2026. 
• On 25 July 2025, the new video-sharing platform regime under s210 of the OSA came into force and Part 4B of the Communications Act 2003 was repealed in accordance with the Online Safety Act 2023 (Commencement No 6) Regulations 2025.  From that date, services which previously fell under Part 4B CA are wholly regulated under the OSA, signifying the end of the transition regime.   
• The Online Safety Act 2023 (Fees and Notification) Regulations 2025 came into force on 14 September 2025. They cover (among other things) fees payable under the OSA. 

Over the course of the year, a number of new priority offences were announced under the OSA and will be introduced under secondary legislation, with additional online safety offences also included in the Crime and Policing Bill.  These include:

• offences relating to deepfake intimate images of adults
• offences relating to AI-generated child sexual abuse materials including grooming
• offences relating to the taking or recording of intimate images without consent
• a new priority offence relating to content encouraging or assisting serious self-harm
• a new priority offence relating to cyberflashing
• a new priority offence relating to the depiction of strangulation or suffocation in pornography.

OSA codes of practice, guidance and consultations

To help services comply with the OSA, and to inform secondary legislation, Ofcom had another busy year producing codes of practice, guidance, consultations and reports.  Here are some of the highlights:

• On 21 January 2025, Ofcom published its first Online safety industry bulletin. This announced some resources to help online services comply with the OSA including an Online safety regulations toolkit, aimed particularly at smaller organisations, and an online guide on how to comply with illegal content rules providing a step-by-step interactive guide. 
• On 16 January 2025, Ofcom published its Age Assurance and Children's Access Statement under the OSA. It also published: Guidance on highly effective age assurance and other Part 5 duties – this is guidance for pornography providers to help comply with s81 OSA duties; Guidance on highly effective age assurance – this is for user-to-user and search services to help them implement highly effective age assurance (HEAA) to comply with their OSA obligations; and Children's Access Assessments Guidance – for U2U and search services to help them comply with the requirement to assess whether children can access their services.  Ofcom also published quick guides which summarised relevant obligations and are helpful starting points: Quick guide to children's access assessments; and Quick guide to highly effective age assurance 
• Ofcom published its first annual report on technology notices to deal with terrorism and CSEA content under s128 OSA on 24 January 2025. 
• On 22 February 2025, Ofcom published: A safer life online for women and girls: practical guidance for tech companies in draft for consultation. Ofcom provided a summary document setting out the Guidance at a Glance in table format, and published a statement outlining its final decisions alongside the final version of the guidance on 25 November 2025.
• On 26 February 2025, Ofcom introduced guidance for service providers and other stakeholders about its information gathering powers under the OSA.  
• On 24 April 2025, Ofcom published its final Children's Safety Codes of Practice together with other documents including its statement and guidance on risk assessments.  See here for more.
• It also consulted on expanding the application of some measures in the Illegal Content Codes (eg blocking and muting user accounts and disabling comments) to cover additional services.  The consultation closed on 22 July 2025. 
• In compliance with s152 OSA, Ofcom set up an advisory committee on misinformation and disinformation on 29 April 2025. 
• On 30 June 2025, Ofcom launched a consultation on additional ways tech firms should protect people in the UK to ensure online safety.  The consultation on the new proposals was open until 20 October 2025.
• On 26 June 2025, Ofcom published its policy statement on the implementation of the online safety fees and penalty regime following a consultation. 
• On 11 July 2025, Ofcom published a second discussion paper on Deepfake Defences which looks more closely at the merits of 'attribution measures' including watermarking, provenance metadata schemes, AI labels and context annotations. 
• On 18 July 2025, Ofcom published a consultation on guidance for providers to help them calculate their qualifying worldwide revenue (QWR).  Responses were requested by 5pm on 10 September 2025. 
• On 21 July 2025, Ofcom published its Statement on Online Safety Transparency Reporting and Transparency Reporting Guidance.  Categorised services will be required to publish their first reports by summer 2027.
• On 8 July 2025, Ofcom published a report on independent researcher access to online safety matters from providers of regulated online services under the OSA.  The report looks at how and to what extent such access should be given and at current constraints on information sharing. 
• On 8 September 2025, Ofcom published draft guidance for super-complaints  for consultation. The guidance fleshes out the Online Safety Super-Complaints (Eligibility and Procedural Matters) Regulations 2025. 
• On 15 September 2025, Ofcom opened a consultation on draft recommendations to assist services in helping people to navigate the evolving digital landscape.  Under s11(1) Online Safety Act, Ofcom has a statutory duty to promote media literacy.  It is required to publish a statement on media literacy, and a statement of recommendations. Responses were requested by 8 December 2025, and a final statement is expected in spring 2026.
• On 16 September, Ofcom published a consultation on changes to its Online Safety Information Powers Guidance as a result of the implementation of s124 Data (Use and Access) Act which requires Ofcom to issue Data Preservation Notices in response to coroner requests relating to preservation of data after the death of a child.  It also consulted on proposed updates with respect to Data Preservation Notices and minor updates to the guidance on Coroner Information Notices.  Responses were required by 5pm on 28 October 2025. 
• On 17 October 2025, the Science, Innovation and Technology Committee published the government and Ofcom's responses to its report investigating social media algorithms and misinformation.  The government does not agree that it should pass legislation to deal with AI-generated or exacerbated misinformation, saying this was dealt with in the OSA. 
• On 3 November 2025, Ofcom published a call for evidence to inform statutory reports on age assurance and app stores. The call closed at 5pm on 1 December 2025. 
• On 21 November 2025, Ofcom published its Statement on Charging Principles under the Online Safety Act. This includes annexes containing final versions of its Qualifying Worldwide Revenue and Notification guidance.  Ofcom also published a one-page summary of duties around online safety fees.  The initial charging year starts on 1 April 2026 and in-scope service providers can now register on the Online Safety Fees portal.  The four-month charging notification window opened on 11 December 2025 when the secondary legislation passed. 
• Ofcom published its statement and guidance: a safer life online for women and girls on 25 November 2025. This sets out nine areas for tech firms to improve online safety for women and girls, with a focus on safety by design and user support.  The guidance supplements Ofcom's final Codes and risk assessment guidance on how to tackle illegal content and content harmful to children and sets out how providers can take action against harmful content that disproportionately affects women and girls.
• On 4 December 2025, Ofcom published a summary report on the technology sector's response to the UK's online safety rules. The report also sets out Ofcom's priority areas of focus for 2026.
• On 4 December 2025, Ofcom published a report analysing risk assessment records from the first year of the OSA. Ofcom requested and received 104 risk assessment records.  Its analysis revealed notable issues and it has now published a technical document aimed at helping service providers produce higher quality risk assessments by showcasing good practice and identifying areas for improvement.  

Ofcom OSA enforcement

Ofcom got off to a flying start with enforcing the OSA. The initial focus has been on failure to respond to information requests, and use of age assurance, particularly by Part 5 services.  Children's online safety is very much at the forefront of Ofcom's activities, with an active investigation into an online suicide forum, and Melanie Dawes said in October, that large platforms popular with children will be an enforcement focus for Ofcom going forward (see more here and here).  Ofcom's enforcement activities during 2025 include: 

• On 16 January 2025, Ofcom opened a new age assurance enforcement programme, focusing initially on Part 5 services that display or publish their own pornographic content. 
• On 23 January 2025, Ofcom announced it had fined MintStars Ltd £7000 for failing to comply with requirements on VSPs to protect under-18s from adult content under Schedule 15A Communications Act 2003. 
• On 17 March 2025, Ofcom announced it has opened an enforcement programme to assess measures being taken by providers of file-sharing and file-storage services that present particular risks of harm to UK users from image-based CSAM to ensure users do not encounter, and offenders are not able to disseminate, such content on their services. 
• On 26 March 2025, Ofcom issued a final decision on its investigation into whether Fenix, provider of OnlyFans, failed to provide complete and accurate responses to statutory information requests under the Communications Act 2003 which related to its age estimation processes.  Ofcom ultimately fined Fenix £1.05m.  This represents a 30% reduction due to Fenix's accepting Ofcom's findings and settling the case.
• On 9 April 2025, Ofcom announced it would be investigating an online suicide forum as its first investigation under the OSA.
• On 9 May 2025, Ofcom announced investigations into porn services Itai Tech Ltd and Score Internet Group LLC under its age assurance enforcement programme.
• On 26 June 2025, Ofcom announced that the UK's major porn providers had agreed to bring in highly effective age checks by the deadline of 25 July 2025, following initial investigations by Ofcom. 
• On 9 July 2025, Ofcom launched an enforcement programme to monitor industry compliance with children's risk assessment duties under the OSA.  Ofcom issued formal information requests to a number of services.  They were required to respond by 7 August 2025. 
• On 24 July 2025, Ofcom announced a new age assurance enforcement programme building on work undertaken by its 'small but risky' taskforce.  This specifically targeted sites dedicated to the dissemination of Primary Priority Content. 
• On 31 July 2025, Ofcom announced investigations into the compliance of four companies operating 34 porn sites between them, with the new OSA age-check requirements: 8569 LLC, AVS Group Ltd, Kick Online Entertainment SA, and Trendio Ltd. Ofcom closed an investigation into Kick Entertainment without making any conclusions. AVS Group Ltd was subsequently fined £1.5m in December for failings relating to highly effective age assurance and responses to requests for information.
• On 28 August 2025, Ofcom announced it had opened an investigation into whether Duplanto Ltd has failed or is failing to comply with its duties to prevent children from encountering pornographic content on its service through the use of highly effective age assurance. 
• In September, Ofcom published confirmation of its decision to fine 4Chan £20,000 plus daily penalties for failure to comply with information requests. On 4 December, Ofcom announced it was widening the scope of its investigation to include consideration of s12 compliance. 4Chan is challenging the UK's jurisdiction in the US courts as we discuss here.
• On 11 September 2025, Ofcom announced that it is investigating five companies which run at least 22 porn sites, for compliance with the new age-check requirements under the OSA.  A total of 47 other sites and apps are also being investigated. 
• On 13 October 2025, Ofcom issued an OSA enforcement update covering five programmes, 21 investigations and updates on 11 cases. 
• On 20 November 2025, Ofcom issued its second fine under the OSA (£50,000 against a nudification site for failing to use age checks to protect children from online pornography), and announced  two provisional sanctions and investigations into a further 20 online porn sites.

Other UK developments

• On 21 March 2025, the Communications and Digital Committee launched an inquiry into media literacy in the UK including a call for evidence.  It will consider the roles and responsibilities of various actors and aim to set out priorities for action.  Contributions were invited by 5pm on 11 April 2025. 
• On 25 September 2025, the Committee of Advertising Practice published updated guidance on targeting age-restricted ads in online media. The guidance aims to help marketers, agencies and media owners keep alcohol, gambling, cosmetic interventions and HFSS ads away from under-18s in line with the CAP Code.
• On 4 December 2025, the Committees of Advertising Practice published guidance on Advertising of less healthy food and drink products ahead of the new rules applying on 5 January 2026.

Digital Services Act (DSA)

Guidelines and reports

The DSA regime is more embedded than the newer OSA regime but, nonetheless, we saw continued activity to support implementation and compliance.

• In January, major digital platforms including TikTok, Facebook and Instagram signed up to the updated code of Conduct on Countering Illegal Hate Speech Online+.  The Code has been integrated into DSA compliance. 
• On 13 February 2025, the European Commission and European Board for Digital Services, endorsed the integration of the voluntary Code of Conduct on Disinformation into the framework of the Digital Services Act.  This took effect from 1 July 2025. The Code is a benchmark for determining compliance with the DSA on disinformation requirements and adherence to it will be considered an appropriate risk mitigation measure.
• On 2 July 2025, the EC adopted a delegated act under the DSA that covers how qualified researchers who have been vetted by national regulators can access data from VLOSEs and VLOPs to research systemic risks and mitigation measures. The Commission will now launch the DSA data access portal which will allow researchers to find information and submit applications for access to data. 
• On 14 July 2025, the European Commission published guidelines on the protection of minors under the Digital Services Act.  They apply to all online platforms accessible to minors with the exception of small and micro enterprises.  See more.
• On 12 September, the EDPB adopted guidelines on the interplay of the GDPR and the DSA for consultation.  See more.
• On 10 October 2025, the European Commission announced steps to promote a safe online environment for minors and enforce child safety provisions under the DSA.  It also issued information requests to a number of companies around safeguards for minors, and protections from financial scams.
• On 17 November 2025, the EC published its evaluation of the DSA's interaction with other EU laws and its designation threshold for VLOPs and VLOSEs.  The report concluded that the thresholds remain fit-for-purpose and broadly found interaction with other laws, noting, however, the issues covered in the EC Omnibus simplification proposals.

In addition, and separate from the DSA:

• The majority of the EU Political Advertising Regulation came into application on 10 October 2025. The Commission published guidelines to support implementation of the Regulation on 8 October 2025.
• On 26 November 2025, the EU Council agreed its negotiating position on the draft CSAM Regulation, paving the way for trilogues to begin.

Enforcement

Key enforcement developments related to the DSA included:

• On 27 May 2025, the EC opened formal proceedings against Pornhub, Stripchat, XNXX and XVideos relating to their age verification practices and failures to protect minors from pornographic content.  Stripchat ceased to be a VLOP from 27 May 2025. The European Board for Digital Services also launched a coordinated action to protect minors from pornographic content on smaller platforms which fall under the supervision of Member state Digital Services Coordinators 
• On 28 July 2025, the European Commission announced it had found Temu provisionally in breach of Article 34 DSA, having failed to properly assess and mitigate risks related to illegal products available on its platform.  The Commission also provisionally found use of addictive design and transparency failings.  Temu can now respond to the provisional findings before the Commission makes its final decision.  The Commission together with the Consumer Protection Network, is separately investigating potential consumer protection failings by Temu. 
• On 3 September 2025, Zalando lost its appeal against its designation as a VLOP under the DSA. Zalando made a number of arguments based on lack of clarity of the approach to calculating average monthly users, and around its role as an intermediary.  All were unsuccessful. 
• On 23 September 2025, the European Commission sent requests for information under the DSA to various big tech companies asking them how they identify and mitigate risks relating to financial scams risks under the DSA.  In October, it sent requests for information regarding safeguarding steps to protect minors.
• On 24 October 2025, the European Commission preliminarily found Meta and others in breach of the DSA for failing to grant researchers adequate access to public data. The Commission also preliminarily found Meta, for Instagram and Facebook, in breach of the obligation to provide users with simple mechanisms to notify illegal content and to enable effective challenges to content moderation decisions.
• On 5 December 2025, the European Commission fined X EUR 120m under the DSA. This is the first financial penalty under the DSA. The decision cites deceptive design of the blue checkmark, a non-compliant advertising repository, and failure to provide researchers with access to public data. 

The main focus in tech and digital policy in the UK and EU during 2025 was to drive growth, with recent legislation playing an increasingly significant role, in particular, the UK's Digital Markets Competition and Consumers Act (DMCCA) and the EU's Digital Markets Act (DMA). 

UK

Tech and digital (and related) legislation

Notable tech and digital legislative developments not dealt with elsewhere in this update include:

• The Retained EU (Law) (Revocation and Reform) Act 2023 (Consequential Amendment) Regulations 2025 were made on 22 January 2025 and came into force on 27 February 2025. They make a range of terminology amendments to secondary legislation to take account of ss2-5 of the REUL Act.  They do not make any policy changes.  
• On 13 February 2025, following a consultation initiated under the previous government, the current government announced it would not replace the Commercial Agents (Council Directive) Regulations 1993. While responses to the consultation were described as polarised, the government concluded that the CARs work well and are well understood by all parties. Read more.
• On 24 March 2025, the government published updated Transparency in Supply Chains (TISC) guidance to help organisations ensure there is no modern slavery in its business or supply chains in accordance with the requirements of s54 Modern Slavery Act. The guidance sets out how businesses should comply with the letter and spirit of s54, and how they should complete required s54 statements. Read more.
• The Price Marking (Amendment) (Order) 2025 was made on 14 May 2025. It amends a 2024 Order which itself amended the Price Indication Directive.  The 2025 Order delays the entry into force of the 2024 Order from 1 October 2025 to 6 April 2026. The 2025 Order came into force on 30 September 2025. 
• On 19 May 2025, HM Treasury published its response to its consultation paper on regulating buy-now-pay-later (BNPL) products. The Financial Services and Markets Act 2000 (Regulated Activities etc) (Amendment) Order 2025 was made on 14 July 2025. It provides for certain BNPL agreements to become regulated credit agreements (regulated deferred credit agreements), contains transitional provisions, and provides for the FCA to establish a temporary permission regime to enable firms to carry on the new BNPL regulated activities for a limited time as if they were authorised under FSMA. The FCA will consult on the regime shortly. The Order came into force on 15 July 2025 with respect to the temporary permission regime. Products are likely to be regulated from around mid-2026. On 5 November 2025, the Financial Services and Markets Act 2000 (Regulated Activities etc) (Amendment) (No2) Order 2025 was laid before Parliament. Its effect is to exempt domestic premises suppliers from credit broking regulation when they offer newly regulated BNPL products to their customers, bringing them in line with the treatment of other merchants offering these products once the regime comes into effect in July 2026. The Order came into force on 3 December 2025. Read more
• On 19 November 2025, the Property (Digital Assets etc) Bill passed its third reading in the House of Commons. It now moves to Royal Assent. The Bill clarifies that digital and electronic things can attract property rights even where they do not fall neatly into the traditional two categories of property (things in possession and things in action). 

Consultations, policy and plans

There were a lot of policy papers and plans for developing digital technologies over the course of the year, including:

• On 21 January 2025, the UK government published a Blueprint for modern digital government with DSIT as the digital centre of government overseeing a planned overhaul of digital services in government and a common-sense approach to sharing information across government departments and local councils. This is aimed particularly at tackling fraud, fuelling growth and cutting waste. 
• HM Treasury published a "New approach to ensure regulators and regulation support growth" on 17 March 2025. This claims that the UK's regulatory landscape is not functioning as effectively as it should. The government proposes addressing identified challenges by overhauling the regulatory system as it applies to all regulators. Read more.
• On 28 April 2025, the government published a Science and Technology Framework policy paper setting out its plans to place science and technology at the heart of its industrial strategy. It identifies a number of critical technologies the government will focus on supporting including advanced connectivity technologies, AI, engineering biology, quantum technologies and semiconductors. The Framework also outlines the role of the Regulatory Innovation Office (RIO) in supporting its aims and helping businesses enter the market, including in AI, engineering biology, space, drones and autonomous vehicles. 
• The Digital Regulatory Cooperation Forum (DRCF), published its 2025-2026 workplan on 30 April 2025. Key areas of focus include foundation model and agentic AI, digital identities, smart data, online advertising, the cloud, cyber security, the DMCCA, online choice architecture, fraud, online safety and data protection, and financial services and data protection. The DRCF will also focus on building regulatory capacity, information sharing and engagement.
• On 15 May 2025, the UK government adopted the final version of its revised Strategic Steer to the CMA. As might be expected, the focus is heavily on growth and at all points where the CMA has discretion, it is expected to prioritise pro-growth and pro-investment interventions with a focus on markets and harms impacting the UK, as well as looking to support growth and competitiveness worldwide in key sectors. 
• On 23 June 2025, the government published its Modern Industrial Strategy 2025. This is a ten year plan focused on eight industry sectors (IS 8) identified as having potential for growth and investment in the UK. They are advanced manufacturing, creative industries, life sciences, clean energy, defence, digital and technologies, professional and business services, and financial services. For each of the IS 8, there is a sector plan. Setting up an AI and copyright framework is a key feature of the digital and technologies sector plan along with implementing the AI Opportunities Action Plan and establishing AI growth zones (see AI section for more). 
• The government also announced that a new Treasury unit will oversee decisions and regulations made by UK financial regulators including the FCA and Prudential Regulatory Authority. 
• On 17 July 2025, the government published its UK Compute Roadmap. This sets out a plan to deliver a national platform for scientific leadership, long-term growth and strategic resilience.
• On 28 July 2025, the UK government issued a call for evidence on whether to introduce measures equivalent to those in the incoming EU Machinery Regulation. The Regulation updates the current Machinery Directive which the UK implemented prior to Brexit, with a focus on digital technologies, AI and robotics, and cyber security. Submissions were requested by 20 October 2025. 
• On 5 August 2025, DSIT issued a call for views on the UK trust services market. This aims to build a picture of the UK trust services market; seeks views on the UK's regulatory framework for trust services; asks for views on the benefits organisations see in trust services; and asks for views on the pros and cons of creating clearer connections between the UK digital identity and attributes trust framework and the UK eIDAS Regulation. Responses were requested by 20 September 2025. 
• On 4 September 2025, the Law Commission launched its 14^th Programme of Law Reform, adding ten new projects to its existing list of 17. Technology-relevant projects cover deeds, product liability and emerging technologies. Potential future projects under consideration include data sharing and information law. The Law Commission expects to begin work on these projects this year. It will publish proposals for reform and consultations in due course. 
• The US-Tech Prosperity Deal Memorandum of Understanding, signed on 18 September 2025 between the US and the UK, aims to enhance bilateral cooperation in strategic science and technology disciplines, specifically focusing on AI, civil nuclear energy, fusion, and quantum technologies. 
• On 30 September 2025, the CMA published its recommendation to the Secretary of State on replacement of the EU Technology Transfer Block Exemption Regulation (assimilated EU law) which expired on 30 April 2025. 
• On 21 October 2025, the government published a report updating progress on the Regulation Action Plan. It announced a new "Regulator Dashboard", a Regulators' Council and independent expert performance reviews alongside an AI Growth Lab (see AI section for more).

Quantum

On 28 April 2025, the UK government established a Quantum Regulators' Forum to bring together key regulators to coordinate oversight of emerging quantum technologies. The forum is made up of nine regulators including those on the DRCF plus the IPO, MHRA, the Office for Product Safety and Standards, the Civil Aviation Authority and Ofgem. It is intended to address regulatory gaps and cross-sector challenges to the development and adoption of quantum technologies.   

On 13 May, the government published a UK Quantum Skills Taskforce report. The taskforce considered the current and future skills needs of the sector and summarised its conclusions in the report. The report makes recommendations to support and inform future quantum programmes and policy development including attracting international talent and carrying out a landscape review of publicly funded PhD-level quantum skills activities. 

IP rights exhaustion regime

The UK government announced that it intends to maintain the current 'UK+' exhaustion of rights regime: Certainty for businesses and choice for consumers as UK maintains IP rights regime. It means the UK is left with an asymmetric exhaustion regime, with goods legitimately put on the market in the EEA being able to flow freely into the UK but not vice versa (if there are IP rights in the way). This is the same regime the UK has been adopting since the end of the Brexit transition period so there is no change. The wider exhaustion regime remains the same – IP owners in the UK and EU can rely on their IP rights to prevent goods coming into the jurisdiction from outside of the EEA.  

Automated vehicles

On 10 June 2025, the government published a call for evidence on its Automated vehicles: statement of safety principles – under the Automated Vehicles Act 2024 (AVA), the Secretary of State is required to prepare a Statement of Safety Principles. It also published a consultation on Automated vehicles: protecting marketing terms – the AVA protects certain terms from being used to market vehicles that have not been authorised as AVs. The consultation seeks views on which terms should be protected. The deadline for responses was 1 September 2025. 

21 July 2025, the government published a consultation on next steps for the automated passenger services permitting scheme alongside draft legislation. Pilots for taxis, PHVs and bus-like services will begin in spring 2026. The consultation closed on 28 September 2025. 

New cryptoasset regime

On 29 April 2025, the UK government published the Financial Services and Markets Act 2000 (Regulated Activities and Miscellaneous Provisions) (Cryptoassets) Order 2025 (Order) and an accompanying policy note. The Order sets out the framework for a new cryptoasset regulatory regime which will include crypto exchanges, dealers and agents. See here for more. On 28 May 2025, the FCA published consultation papers on stablecoins and crypto custody following on from the publication of draft crypto legislation. See here here for more. And see a range of more detailed articles on regulating crypto.

CAT rules against Apple in collective action

In the first successful collective action of its kind in the UK, the Competition Appeals Tribunal found that Apple had abused its dominant position by charging app developers unfair commission on app sales and in-app payments which resulted in developers charging higher prices to Apple device users when they made in-app payments. The collective action was brought by Dr Rachael Kent representing a class of around 36m Apple device users.   The ruling paves the way for compensation claims by UK users of Apple devices who purchased paid-for apps, subscriptions or made in-app purchases at any point since 1 October 2015. Apple says it strongly disagrees with the ruling. 

Supreme Court rulings on motor finance

On 1 August 2025, the Supreme Court handed down a unanimous judgment in three motor finance appeals: Hopcraft v Close Brothers Limited, Johnson v FirstRand Bank Limited (t/a MotoNovo Finance) and Wrench v FirstRand Bank Limited (t/a MotoNovo Finance). It allowed the appeals brought by lenders but upheld the unfair relationship claim brought by Mr Johnson. The main issue in the cases was whether motor dealers owed fiduciary duties, when arranging finance, to consumers to disclose commissions they earned from the financing providers, or whether the commissions constituted bribes or secret profits. The Supreme Court found the dealers did not owe fiduciary duties, however, it did uphold one claim under the Consumer Credit Act. Read more.

CMA decisions of SMS under the DMCCA

On 10 October 2025, the CMA confirmed its first strategic market status (SMS) designation under the Digital Markets Competition and Consumers Act (DMCCA), concluding that Google meets the legal tests for SMS in general search and search advertising services under the UK’s digital markets regime. On 22 October 2025, the CMA confirmed that Apple and Google have SMS in mobile platforms. See more.

Following market investigations, the CMA announced on 31 July 2025, that it would commence SMS investigations into AWS and Microsoft under its DMCCA powers. The market investigations led the CMA to conclude provisionally that there are features of the UK cloud services market which have adverse effects on competition, in particular, market concentration and barriers to entry. A decision on SMS is likely in early 2026.

The designations do not entail a finding of wrongdoing and do not introduce immediate requirements. The CMA published Roadmaps (Apple and Google) setting out proposed interventions and conduct requirements relating to their mobile operating systems in July 2025 for consultation. They focused on interoperability and app distribution. Finalised interventions on all SMS designations to date are yet to be published.

On 25 September 2025, the Competition and Markets Authority published its rules for the digital markets competition regime (SMS Levy) following a consultation. The section on the DMCCA, gives the CMA powers to charge a levy to firms designated with SMS. These rules establish the framework for the levy which applies from the chargeable year starting 1 April 2025. The levy is divided equally between SMS Firms, proportionate to their designation period. Litigation costs are specifically excluded from qualifying costs. 

EU policy and consultations

In May, the European Commission launched calls for evidence on its International Digital Strategy and the EU's Quantum Strategy as well as on its planned Cloud and AI Development Act. On 6 June 2025, the EC published a call for evidence on the proposal for a Digital Networks Act, and in October a call for evidence for an Impact Assessment regarding adoption of an EU Quantum Act.

On 21 October 2025, the European Commission published its 2026 Work Programme. There is a focus on simplifying EU law. Highlights in the tech space (with expected dates for proposals) include: a Circular Economy Act – Q3 2026; a Digital Fairness Act – Q4 2026 ; a Cloud and AI Development Act – Q1 2026 , and a Quantum Act – Q2 2026. Progression of ongoing proposals is also planned, including of the Green Claims and Late Payments Directive, and the Omnibus I and IV proposals. 

On 19 November 2025, the EC published its Digital Omnibus proposals which will reform the EU AI Act, and its Data Acquis, in particular the GDPR, the ePrivacy Directive and the Data Act. Read more and see also the sections on AI and Data and cyber security.

EU legislation

Digital Markets Act (DMA)

The DMA is in full swing and has already come up for review. On 25 April 2025, the European Commission published its second annual report on the DMA.  On 3 July 2025, the EC launched a consultation on the first review of the Digital Markets Act and on 26 August 2025, a call for evidence in relation to its review of the DMA. As part of this, it also published a questionnaire focusing on AI and competition and whether the DMA is effective in supporting a contestable and fair AI sector in the EU. 

 In 2025, there was notable enforcement action under the DMA, often with pushback from gatekeepers. This included:

• Details of Meta's appeal against a fine of nearly EUR 800,000 were published in the Official Journal on 17 March 2025. The fine was issued by the EU's Competition Commission for abuse of dominance relating to the connection of Facebook's online classified ads service with its social network. Meta was also found to have imposed unfair trading terms on competitor online classified ad service providers. Meta made a variety of claims alleging the Commission erred in its findings. 
• On 19 March 2025, the EC adopted two decisions under the DMA specifying measures Apple is required to take to comply with its interoperability requirements. The first relates to iOS connectivity features for mainly connected devices, to ensure they can pair and share data with Apple devices equally whether or not they are Apple devices. The second requires Apple to improve the transparency and effectiveness of processing and responding to interoperability requests. Apple appealed the interoperability decision but the Commission rejected the request to waive large parts the order. 
• On 23 April 2025, the European Commission announced it was fining Meta EUR 200 million for breaching the DMA obligation to give consumers a choice of services which use less of their personal data. The fine related to the binary 'consent or pay' model for Facebook and Instagram offered in the EU between November 2023 and November 2024. Read more.
• The Commission also announced in April that it was fining Apple EUR 500 million for breaching the DMA anti-steering obligation although the Commission closed its investigation into Apple's compliance with user choice obligations owing to early engagement by Apple. Apple appealed the decision in July but made a series of changes to its app store. 
• On 13 November 2025, the European Commission opened proceedings into whether Google applies fair, reasonable and non-discriminatory access conditions for publishers on Search in compliance with DMA requirements. 
• Also of note is that under EU competition law (not the DMA), the European Commission announced in September that it had fined Goole €2.95bn for breach of EU competition rules by distorting competition in the adtech industry.
• See also the Data and cyber security section for the EDPB guidelines on the interaction of the DMA and the GDPR.

Other tech and digital EU legislative developments

• The EC published a Communication on an EU Competitiveness Compass with a fact sheet on 29 January 2025. On 11 February, it published its 2025 Work Programme and a Communication on A simpler and faster Europe, which sets out a five year plan for simplifying the way the EU works and reducing red tape and bureaucracy. Read more.
• On 27 February 2025, the Commission adopted proposals for two Omnibus Directives aimed at simplifying sustainability reporting and due diligence obligations. Amendments are proposed to the Audit Directive, Accounting Directive, Corporate Sustainability Reporting Directive and the Corporate Sustainability Due Diligence Directive (although not directly to the EU Taxonomy Regulation) to achieve these aims. In April, several ESG initiatives were postponed pending agreement of the Omnibus I and II proposals. By the end of the year, the EU Council and European Parliament had both agreed their negotiating positions and trilogues had begun.
• On 25 June 2025, the European Commission published its proposal for an EU Space Act . Read more about the Space Act proposal here and about legal and industry developments more generally here.
• In January, the ODR platform was discontinued. In July, provisional political agreement was reached on the text of the Directive amending the EU ADR Directive which the EU Council approved on 24 November 2025. The ADR Directive is being amended to update it for digital markets, simplify procedures and facilitate cross-border use of ADR. Read more.

• The European Commission initiated a consultation regarding proposed revisions to the Technology Transfer Block Exemption Regulation (TTBER) and its accompanying Guidelines. The consultation period ran until 23 October 2025. The Commission will incorporate stakeholder feedback when finalising the revised regulations before the current TTBER expires on 30 April 2026. 
• On 18 November 2025, the European Commission launched three market investigations under the DMA into cloud computing services. A separate investigation will examine whether the DMA can effectively address practices that may limit competitiveness and fairness in the EU cloud sector.  The Commission aims to conclude the investigations within 12 months and publish a report within 18 months.
• On 27 November 2025, the Council of the EU and the European Parliament announced provisional political agreement on a new Payment Services Regulation and a third Payment Services Directive (PSD3) which will amend PSD2. The package prioritises anti-fraud measures, transparency and consumer protection while facilitating innovation.
• On 4 December 2025, the European Commission opened a formal antitrust investigation into Meta’s policy restricting AI providers’ access to WhatsApp Business Solution in the EEA.

This year saw a diverse range of regulatory and enforcement developments in consumer protection law in the UK and EU.  Most notably, the bulk of the UK consumer protection reforms under the Digital Markets Competition and Consumers Act came into application. The EU's plans for a Digital Fairness Act were, however, postponed, although it released its 2030 Consumer Agenda towards the end of the year.

UK

Digital Markets Competition and Consumers Act (DMCCA)

Significant elements of the consumer aspects of the DMCCA came into force in 2025.  On 4 March, the Digital Markets Competition and Consumers Act 2024 (Commencement No.2) Regulations 2025 (Regulations) were made.  They brought in large parts of the consumer protection regime changes under the DMCCA, mostly from 6 April 2025, as follows: Part 3 on consumer law enforcement, the majority of Part 4, Chapter 1 – replacement of the Consumer Protection from Unfair Trading (CPUT) Regulations, Part 5, Chapter 3 – the duty of expedition on the CMA and sectoral regulators, and schedules and consequential amendments relating to the above sections. From 1 January 2026, (to the extent they are not in force immediately before that date), Part 4, Chapter 3 and related schedule 24, which deal with protection of consumer saving schemes (eg Christmas saving clubs) will come into effect.  Implementation of the subscription contracts regime has, however, been delayed until autumn 2026 to give the government time to consider the responses to its consultation. 

The Digital Markets, Competition and Consumers Act 2024 (CMA Consumer Enforcement Rules) Regulations 2025, came into force on 6 April 2025. The Regulations set out rules which apply when the CMA carries out an investigation into an infringement of consumer protection laws listed in Schedule 16 of the DMCCA.  On 14 March 2025, the CMA published the final version of its CMA200 guidance which sets out how the CMA will use its direct consumer enforcement powers under the DMCCA. 

On 27 March 2025, the CMA published its Annual Plan 2025-26.  On 30 April 2025, the CMA published guidance on 'Delivering the 4Ps under the Digital Markets Competition Regime'.  This sets out how the CMA will promote business trust and confidence, encourage investment and innovation, and deliver positive outcomes for UK businesses and consumers using the 4Ps (pace, predictability, proportionality and process).  On 20 November 2025, the CMA published Strategy 2026-2029.  This sets out the CMA's five strategic objectives for the next three years: promoting competition, championing consumers, helping government with pro-competition and growth interventions and initiatives, and fostering an attractive UK regulatory landscape to stimulate confidence and investment. Annual plans will set out how the strategy is to be implemented. 

As the DMCCA regime came in, the CMA published a range of new and updated guidance including:

• On 7 April 2025, the CMA published: the CMA's Approach to Consumer Protection: to provide clarity and predictability around implementation of the new regime, including areas of focus and what stakeholders can expect from the CMA in terms of enforcement, It also published Final guidance on unfair commercial practices, Final guidance on direct consumer enforcement and Final guidance on CMA's consumer protection role and approach to compliance/enforcement.  
• On 20 June 2025, the CMA published dynamic pricing tips for businesses.
• On 28 August 2025, the CMA published updated principles for social media platforms relating to endorsements and fake reviews.  The guidance has been updated to take account of the DMCCA and CMA guidance on fake reviews.  It also published Direct consumer enforcement - a much more digestible summary of CMA200 guidance on enforcement, and guidance on Information requests which summarises Chapter 7 of the CMA58 guidance on enforcement. 
• On 7 October 2025, the CMA published guidance on how to report potential breaches of competition or consumer law and what to expect from the CMA.
• On 18 November 2025, the CMA published guidance on price transparency (CMA209) This guidance complements CMA207 which covers unfair commercial practices under the DMCCA and replaces the material pricing information in CMA207. Read more. It also published guidance on getting consent for additional charges when selling online.

In addition, on 15 May 2025, the ASA published a quick guide to changes to misleading advertising rules as a result of the revised unfair commercial practices regime coming into effect under the DMCCA. The CAP and BCAP Codes were updated on 8 April 2025 when CAP and BCAP published the outcome of their consultation on changes to the advertising codes to tie in with the changes to the unfair commercial practices regime under the DMCCA.  Other ASA resources are being updated where required. 

For more detail on aspects of the DMCCA, see here.

Other UK legislation and policy

• On 19 February 2025, the government announced plans to introduce new rules restricting the sale of knives online.  Sanctions for selling weapons (including prohibited offensive weapons like zombie knives) to under-18s will be increased from six months to a maximum of two years in prison and will apply to individuals processing sales and company CEOs.   A new offence of possessing an offensive weapon with intent for violence will also be introduced in the Crime and Policing Bill, carrying a maximum sentence of four years.  Responses to the government's proposals (which were published in April) were broadly positive. As a result of the consultation, the government widened the scope of the proposed legislation to cover online search services as well as platforms and marketplaces. 

• On 31 July 2025, the Law Commission announced a review of the law on defective products, particularly in light of changes to the EU product liability regime.  The review will look at how the current regime operates and whether it is need of reform.
• The Waste Electrical and Electronic Equipment (Amendment etc) Regulations 2025 (Regulations) were made on 22 July 2025.  They amend the principal 2013 Regulations and place the obligation to finance costs of dealing with WEEE supplied by overseas sellers to private UK households through online marketplaces on those marketplaces (rather than on the sellers).  The Regulations also create a new category of electrical and electronic equipment for devices intended to be used for vaping and other consumption of tobacco and nicotine products.  This reclassifies them from 'toys and other leisure equipment' and ensures producers of the devices are responsible for their collection costs and disposal at end of life. 
• The Product Regulation and Metrology Act 2025 received Royal Assent on 21 July 2025.   It aims to tackle the sale of unsafe products on online marketplaces, particularly products coming from outside the UK.  Most envisaged provisions will be brought in under secondary legislation.
• On 22 September 2025, the government issued guidance on amendments to the Price Marking Order 2004 which took effect on 6 April 2026. The PMO applies in Great Britain to business to consumer sales of goods, including online, and sets out additional transparency requirements covering display of the selling price among other things.
• New rules restricting advertising of less healthy food and drink were delayed from 1 October 2025 to 5 January 2026.  On 10 September 2025, the Advertising (Less Healthy Food and Drink) (Brand Advertising Exemption) Regulations 2025, were laid before Parliament.  They exempt brand advertising from the restrictions on advertising less healthy food and drink which come into force on 5 January 2026 with respect to products advertised online and on TV before 9pm. The Regulations came into force on 31 October 2025. Notwithstanding the delay, advertisers were asked to voluntarily commit to abide by the incoming restrictions from the earlier date of 1 October 2025. This had a knock-on effect on the CAP/BCAP consultation which was re-launched in September.

Consultations

• On 23 January 2025, the House of Commons Business and Trade Committee, launched a call for evidence into variable or dynamic pricing.  Responses were requested by 30 January 2025.  This was alongside the CMA's work on dynamic pricing. 

• In October 2025, the Department of Health and Social Care published a call for evidence on introducing retail licensing for tobacco, vapes and nicotine products to support the Tobacco and Vapes Bill. The proposal would require shop and online licences for retail sales, strengthen enforcement and allow unlimited fines or fixed penalties of £2,500 in England and Wales, and fines up to £5,000 in Northern Ireland. A consultation on these and other issues will follow. The Tobacco and Vapes Bill itself completed its third reading in the Commons and moved to the Lords. 

Enforcement

While it was too early to see DMCCA-related consumer protection fines, this did not prevent enforcement of consumer protection law.  Notably the event and secondary ticketing market and fake online reviews were a particular focus for the government and the CMA.

Fake online reviews

Fake reviews have been prohibited under the DMCCA since 6 April 2025.  On 24 January 2025, the CMA announced it had secured undertakings from Google to help tackle the issue of fake online reviews.  On 6 June 2026, the CMA announced Amazon has provided undertakings to help tackle fake reviews on its site. The undertakings are similar to those provided by Google in December 2024. 

On 25 July 2025, the CMA published an update on enforcement of the new DMCCA rules on fake and misleading online reviews following the expiry of the grace period in July.  A sweep of 100 websites revealed that more than half were non-compliant with the new rules.  They either had no policy in place, or the policy was unclear or hard to find.  The CMA is sending letters to non-compliant businesses which will be required to respond explaining what they will do to comply.

Online pricing practices

On 18 November 2025, the CMA launched investigations into eight businesses in relation to their use of fees, misleading time-limited offers, and/or the practice of automatically opting consumers in for optional charges.  It sent a further 100 letters to businesses following a compliance sweep, asking 11 sectors including live event ticketing, online vouchers, fashion and food and drink delivery companies, to review their practices around additional fees and online sales tactics.

Ticketing and dynamic pricing

On 10 January 2025, the government launched a consultation on plans to tackle ticket touts and make ticket resales fairer and more transparent . The consultation closed on 4 April 2025. On 25 September 2025, the CMA announced undertakings secured from Ticketmaster following its investigation into the Oasis ticket sale (read more). Finally, in November, the government announced that it would ban the re-selling of event tickets at more than face value (with limited exemptions for charities) by any platform reselling tickets to UK consumers.

On 20 June 2025, the CMA published an update on its dynamic pricing project including tips for businesses using dynamic pricing.  The CMA's concerns around dynamic pricing are centred on situations where consumers are unaware it is being used or of how it impacts pricing, where it pressures consumers into making quick decisions, where it is used to gain or maintain market power or create barriers to new market entrants, or where it impacts vulnerable consumers. 

EU

Legislation and policy

On 19 May 2025, the European Commission published a consultation on a Communication on the new Consumer Agenda 2025-30 and an action plan on consumers in the single market.  The call for evidence and consultation were open until 11 August 2025.  On 20 October 2025, the EC published a final summary report following the call for evidence on its Consumer Agenda 2025-30 and action plan on consumers in the Single Market, with the final version of the 2030 Consumer Agenda published on 19 November 2025.  This centers on four pillars:

• completing the Single Market for consumers
• digital fairness and consumer protection online (particularly to protect children and the vulnerable)
• promoting sustainable consumption
• effective enforcement and redress.

See our predictions on EU consumer protection and digital fairness here.

Digital Fairness Act

A  key pillar of the Consumer Agenda is a proposed Digital Fairness Act.  On 17 July 2025, the European Commission published a consultation and call for evidence on digital fairness.  The intention is to gather views ahead of publication of a proposal for a Digital Fairness Act in Q4 of 2026.  The consultation looks, in particular, at dark patterns, addictive design, unfair personalisation practices, harmful influencer practices, unfair marketing and digital contracts.  It asks whether the EC should take steps including issuing guidance, enforcing existing rules or introducing new rules, as well as at potential simplification of the rules and enforcement.  Towards the end of 2025, the EC confirmed that a Digital Fairness Act proposal will not be presented until Q4 2026.

Deforestation-free products

On 15 April 2025, the EC published a consultation on its proposals for a delegated Regulation to clarify the scope of the EU Deforestation-free Products Regulation (EUDR).  It also published updated guidance and FAQs on how to demonstrate products are deforestation-free.  The delegated Regulation will amend Annex I to clarify what products are not covered by the EUDR and to clarify circumstances in which packing materials are out of scope. On 22 May 2025, the EC published an Implementing Regulation setting out a list of high- and low-risk countries for the purposes of the Deforestation-free Products Regulation. 

On 12 August 2025, guidance on the Deforestation-free Products Regulation was published in the Official Journal.  The guidance is non-binding but clarifies key definitions, due diligence requirements, product scope and definitions relating to agricultural use. 

On 20 October 2025, the European Commission proposed targeted measures to streamline implementation of the EU Deforestation-free Products Regulation. The proposal focuses on ensuring IT system readiness, reducing reporting for downstream operators and traders, and simplifying obligations for micro and small primary operators from low-risk countries while maintaining traceability. 

Other

• The EU Packaging and Packaging Waste Regulation was published in the Official Journal on 22 January 2025 and entered into force on 11 February 2025.  It has largely applied since 12 August 2025.  It aims to reduce packaging waste by setting binding re-use targets, restricting the use of certain types of single-use packaging and introducing requirements across the packaging lifecycle.  On 26 September 2025, the EU published a Directive amending the Waste Framework Directive (amending Directive (2008/98/EC).  This introduces binding national food waste reduction targets by 31 December 2030 and a new extended producer responsibility (EPR) scheme for textiles.  

• The EC published a Communication on a comprehensive EU toolbox for safe and sustainable e-commerce on 5 February 2025.  This sets out the Commission's approach to addressing challenges posed by e-commerce imports across their lifecycle.  The Commission will assess and report on the highlighted areas and consider whether to propose new measures within one year. 
• On 16 April 2025, the EC adopted a working plan 2025-2030 for the Ecodesign Regulation and the Energy Labelling Regulation.  Among other things, it sets out priority products for ecodesign and energy labelling requirements (iron, steel, aluminium, textiles, furniture, tyres and mattresses), and includes two horizontal measures to impose requirements on repairability for products including consumer electronics, and small household appliances. 
• On 12 June 2025, the EC published a consultation on a draft Implementing Regulation which sets out the details and format for the disclosure of information on discarded unsold consumer products under the Ecodesign Regulation.  The consultation closed on 10 July 2025. 
• The EU Accessibility Act (as implemented in EU Member States) began to take effect on 28 June 2025. Read more.
• On 25 September 2025, the European Commission presented a new EU-wide consumer notice and a product label implementing the Directive on empowering consumers for the green transition (EmpCo). Member States must transpose the EmpCo Directive by 27 March 2026, with application from 27 September 2026.
• On 6 October 2025, the European Commission launched a consultation on the evaluation of the 2018 Geo-blocking Regulation. The evaluation of the Regulation was launched in February 2025, and the consultation closes on 29 December 2025, with an evaluation expected in Q2 2026. 
• On 12 November 2025, the European Commission published a consultation on the revision of the New Legislative Framework (NLF). This comprises a Decision and Regulation and aims to harmonise EU product legislation, including principles for market access, CE marking and conformity assessments.  The consultation closes on 4 February 2026 with legislative proposals expected to be adopted in Q3 2026.
• On 21 November 2025, the European Commission published guidelines for businesses on the General Product Safety Regulation (GPSR) and guidelines for using the Safety Business Gateway under the GPSR. 

For more on ESG and product developments in 2025, see here.

This year saw continued regulatory scrutiny across gambling and consumer protection regimes. The UK focused on online gambling practices and advertising standards, while the EU advanced enforcement cooperation through CPC and ICPEN. You can find many of these topics as well as industry developments discussed in our games and online gambling update, Play, but we look at some of the UK and EU key legal developments during 2025 below.

UK legislation and guidance

On 4 February 2025, the Gambling Commission announced new rules designed to empower consumers and boost operator transparency.  The new rules follow a consultation and are consistent with the 2023 Gambling White Paper. Changes include: 

• since 31 October 2025, all gambling businesses have been required to prompt customers to set a financial limit before they make their first deposit and make it easy to review and alter this limit at any point 
• gambling businesses must remind customers to review their account and transaction limits every six months 
• operators holding unprotected funds in the event of insolvency, must, from 31 October 2025, actively remind users that their funds are unprotected 
• the requirement on operators to make annual financial contributions to a list of research, prevention and treatment organisations was removed from 6 April 2025. 

The Gambling Levy Regulations were made on 25 February 2025 and come into force on 6 April 2025.  Among other things they introduce a statutory gambling levy payable from 1 October 2025.  The Gambling Act 2005 (Operating Licence Conditions) (Amendment) Regulations 2025 were also made on 25 February 2025.  They introduce a £5 online slot limit stake on over-25s from 9 April 2025 and a £2 limit for under-25s from 21 May 2025. 

On 26 March 2025, the Gambling Commission announced new rules on gambling promotions to make them safer and simpler, including: a ban on mixed product promotions and a limit on bonus wagering requirements. The new rules will come into force on 19 December 2025. 

Since 1 September 2025, the CAP Code has applied to non-paid-for online marketing communications targeted at UK consumers by advertisers subject to licensing conditions from a UK public authority or body.  This means they must comply with the CAP Code even where the advertiser does not have a UK-registered address.  Previously, the Code applied only to this kind of marketing where the advertiser did have a UK-registered address. 

On 14 October 2025, CAP and BCAP published updated guidance on protecting under-18s in gambling and lotteries advertising. The guidance has been changed to reflect rulings, stakeholder input and research following the 2022 shift from a "particular appeal" test to a "strong appeal" test when assessing whether gambling adverts might unduly attract the attention of under-18s. 

On 14 October 2025, Ofcom published guidance explaining how the Online Safety Act applies to online video game services, including user-to-user features such as chat, matchmaking, lobbies, team assignment and livestreaming, where services have links to the UK. Provider-created content remains out of scope except for online pornography.  This is very high level and essentially points games businesses to relevant parts of the register of risks and guide for services. 

On 26 June 2025, DCMS published research on prize draws and competitions (PDCs) looking at whether the government needs to legislate in this area.  The research concludes that there is a case to suggest the government should intervene in this market to reduce gambling harm, increase the integrity and transparency of PDCs, and help protect donations to charities.  Potential actions include bringing PDCs within the scope of gambling legislation, enforcing consumer protection law more effectively in the sector, or setting up a voluntary code of conduct.   

On 25 September 2025, the DCMS published a rapid evidence review on skins gambling, examining betting with in-game virtual items and associated risks.  The report is concerned that these activities are largely unregulated and that there is no age verification at point of risk so children and young people may be particularly vulnerable regardless of laws and regulations in specific jurisdictions.  Recommended next steps include stronger age verification, stricter enforcement of age restrictions, and development of international standards to monitor and control skins gambling, alongside research on long-term harms and effective interventions.

On 20 November 2025, the government published a voluntary code good of practice for prize draw operators which focuses on player protection, transparency and accountability.  Signatories have agreed to implement the code by 20 May 2026.  The government will monitor its effectiveness and will consider other options including legislation if it is not effective.

On 26 November 2025, the government published a policy paper outlining changes to gambling duties as announced in the budget.  Changes include:

• remote gaming duty will increase from 21% to 40% from 1 April 2026 
• all remote bets (aside from on UK horseracing) will be charged at 25% from 1 April 2027.

EU

2025 highlights include:

• the EU's Consumer Protection Cooperation Network (CPC) published new guidelines for the online gaming sector on 21 March 2025. The guidelines aim to promote transparency and fairness in the online gaming industry's use of virtual currencies and set out a non-exhaustive list of key principles to cover the minimum consumer law requirements for the purchase and use of virtual currencies
• a Belgian Court has referred questions to the CJEU about platform liability for making games containing unlawful loot boxes available – loot boxes are illegal in Belgium.  The questions relate to the definition of "gambling activities" in the eCommerce Directive. See more about the Belgian court decision here
• on 30 June 2025, the International Consumer Protection and Enforcement Network (ICPEN) published the results of a global online sweep of mobile and online games. The sweep examined 439 mobile and online games in 22 jurisdictions and found frequent use of manipulative design techniques, especially sneaking, nagging and obstruction practices. The sweep highlighted the prevalence of manipulative design techniques including urgency style tactics used without justification to provoke purchases.   It also found that the presence of loot boxes, in-game purchases and in-game ads were as common in games rated 3 and up as in any other age classification group and only 30% of games with loot boxes disclosed their presence on the platform pages from which the game was playable.