As the Online Safety Act (OSA) regime ramps up, there have been a number of significant developments in the last few weeks, not least an application for judicial review of the Categorisation Regulations.

Ofcom launches OSA compliance investigations

Ofcom has acted swiftly across different areas of the online safety regime, arguably more quickly than it suggested it might. On 27 March 2025, Ofcom fined the provider of Only Fans, Fenix International Limited, £1.05 million for failure to respond to a formal request for information about its age assurance measures.

On 9 April 2025, Ofcom launched an investigation into whether the provider of an online suicide forum had breached the OSA by failing to put appropriate safety measures in place, complete and record a suitable and sufficient illegal harms risk assessment and respond to a statutory information request.

On 9 May 2025, Ofcom announced investigations into porn services Itai Tech Ltd and Score Internet Group LLC under its age assurance enforcement programme. Under the Online Safety Act, online services must ensure children cannot access pornographic services on their sites. This means they have to have highly effective age checks in place to protect children. Ofcom wrote to a number of services asking for details of their compliance plans. Some services failed to respond and have not taken steps to introduce the required age assurance. As a result, Ofcom is launching its investigations. As Ofcom notes, services which allow user-generated pornographic services (Part 3 services) are covered by different sections of the OSA and are required to introduce highly effective age checks from July 2025. 

On 15 May 2025, Ofcom launched two investigations into whether Kick Online Entertainment S.A. (responsible for providing a pornography website) has failed to complete and keep a record of a suitable and sufficient illegal content risk assessment and to respond to a statutory information request.

Ofcom sets up mis- and dis-information advisory committee 

In compliance with s152 OSA, Ofcom set up an advisory committee on misinformation and disinformation on 29 April 2025. The committee is required to provide advice to Ofcom about how providers of regulated services should deal with mis- and dis-information on them. It will discuss how online platforms can implement systems to tackle such content but will not play a role in individual decisions around particular content. 

Government response to draft statement of strategic priorities for online safety 

Under ss172-3 of the OSA, the government has the power to publish a statement of strategic priorities (SSP) under the Act. Ofcom is required to have regard to the SSP when carrying out its OSA duties. The government published a draft SSP for consultation in November 2024. On 8 May 2025, it published the responses to the consultation which asked whether there was anything respondents would like to see changed in the SSP or whether there was a need for clarity at any point. 

The government received 21 responses from the 38 organisations invited to respond. Most were generally supportive of the government's priorities with some requests for additional clarity, including on how Ofcom will fulfil its duties.

The SSP focuses on safety by design, transparency and accountability, agile regulation, inclusivity and resilience, and technology and innovation. Where the government considers it appropriate, further detail and explanation have been added as a result of the consultation but the overall priorities have not changed.

The Secretary of State has laid the amended SSP before Parliament for 40 days. Ofcom will then be required to set out its proposals for putting the SSP into practice within a further 40-day period and will have to report on progress annually. 

Wikimedia applies for judicial review of OSA Categorisation Regulations 

Also on 8 May 2025, the Wikimedia Foundation, the non-profit behind Wikipedia, announced it was applying for judicial review of the Online Safety Act's Categorisation Regulations. These Regulations set out the criteria used to determine whether a regulated service falls into Category 1, 2A or 2B of the OSA and is consequently subject to additional safety duties. Ofcom is expected to publish an initial register of categorised services in June or July. 

Wikimedia is concerned that Wikipedia will be classed as a Category 1 service either this year or from 2026. It argues that the Categorisation Regulations are drafted too broadly and therefore risk overregulating low-risk services like Wikipedia and navigation or mapping apps, while missing services which the OSA is targeting. Wikimedia is not challenging the OSA itself and agrees with its aims but says the OSA developed into a "Frankenstein" law over the course of its development and, unlike the Digital Services Act, is insufficiently flexible, and also fails to provide exemptions for nonprofit organisations and educational projects.

Wikimedia argues that making it subject to Category 1 duties would negatively impact Wikipedia in a number of ways, particularly in relation to user verification and filtering. It says it has a self-policing system which ensures neutral and reliable information and argues that if it is required to verify the identity of Wikipedia volunteer users, even though it would not have to verify all of them, it would also need to allow other potentially malicious users to block all unverified users from fixing or removing any content they post. This might threaten the integrity of Wikipedia unless and until all volunteers worldwide are verified. 

Specifically, Wikipedia argues there are flaws in the way categorisation is assessed: 

• Definition of "content recommender system" – Wikimedia argues that as written, the definition could cover tools that are used to combat harmful content. It suggests that clarification is needed to ensure that features that help keep services free of regulated content like Wikipedia New Pages Feed, should not trigger Category 1 status
• Content forwarding or sharing – the suggestion is that this is insufficiently defined 
• Number of users – Wikimedia argues that the Regulations do not differentiate between users who visit a site irregularly and briefly and those who use a site repeatedly and for long periods of time. Simply counting visitors per month does not account for differences in how services are used in practice. 

Wikimedia acknowledges that ministers have powers to tailor the categorisation thresholds and that both the government and Ofcom have discretion to introduce exemptions in certain areas. It particularly argues that charitable status should be a relevant factor when it comes to Category 1 assessment. It seeks a swift hearing as Ofcom has already asked it to provide information to enable it to make a Category 1 assessment of Wikipedia. 

What does this mean for you?

If you are likely to be a Category 1 service, you will want to follow the Wikimedia application closely. However, while criticisms of the OSA continue to come from a variety of directions, Ofcom is wasting no time in investigating non-compliance. Its ability to enforce effectively will be one of the most important elements in assessing whether or not the OSA has been a success.