In July, we reported on a range of OSA-related developments. The summer did nothing to slow down the pace and there's been more enforcement activity, secondary legislation and draft guidance.
Super-Complaints
On 22 July 2025, the government made the Online Safety Super-Complaints (Eligibility and Procedural Matters) Regulations 2025. The Regulations come into force on 31 December 2025. They set out eligibility criteria to qualify as an entity eligible to bring a super-complaint under the OSA. These are likely to include charities, consumer and campaign groups. Eligibility will be judged by Ofcom against four criteria:
- Whether the entity represents the interests of users of regulated services or members of the public
- The composition of the entity, its governance, accountability, and independence from regulated services
- Whether the entity is recognised as an expert voice in online safety matters and routinely contributes significantly to public discussions on online safety
- Whether the entity can be relied on to take Ofcom guidance into account.
On 8 September 2025, Ofcom published draft guidance for super-complaints under the OSA for consultation. The guidance (which Ofcom is required to publish), covers:
- What super-complaints are
- The role of super-complaints in Ofcom’s regulatory approach to online safety
- Which organisations are eligible to bring a super-complaint
- How organisations can demonstrate their eligibility
- The rules and procedures for making a super-complaint, and
- The steps Ofcom will typically take in relation to a super-complaint.
The guidance fleshes out the Regulations. The consultation closes on 3 November 2025 at 17:00.
Enforcement
On 31 July 2025, Ofcom announced investigations into the compliance of four companies operating 34 porn sites between them, with the new OSA age-check requirements: 8569 LLC, AVS Group Ltd, Kick Online Entertainment SA, and Trendio Ltd.
On 27 August, 4Chan and Kiwi Farms filed a suit in a Washington DC Federal Court, challenging the extra territorial scope of the Online Safety Act. Under the OSA, it is sufficient for a business to have links with the UK through its user base or by targeting the UK to come within scope. Online message board 4Chan is asking the DC court to rule that US businesses with no UK presence are not subject to UK legislation and that the OSA is in conflict with the First, Fourth and Fifth Amendments to the US Constitution and with US public policy and related legislation. Read more about this development here.
On 28 August 2025, Ofcom announced that it had opened an investigation into whether Duplanto Ltd has failed or is failing to comply with its duties to prevent children from encountering pornographic content on its service through the use of highly effective age assurance.
On 11 September 2025, Ofcom announced that it is investigating a further five companies which run at least 22 porn sites, for compliance with the new age-check requirements under the OSA.
That brings Ofcom up to a total of 69 sites and apps currently being investigated.
High Court dismisses Wikimedia judicial review application
On 11 August 2025, the High Court (Administrative) dismissed Wikimedia's challenge to the Secretary of State's OSA Categorisation Regulations which set out threshold conditions for designation as categorised services under the Online Safety Act. Wikimedia argued that the criteria for Category 1 services were too broad and would lead to its Wikipedia services being categorised which might, in turn, make it impossible for it to operate. The court noted that Ofcom had made the categorisation recommendations after careful consideration and research. In addition, the claimant had not established the claimed victimhood under the Human Rights Act. The court also noted that Wikipedia had not yet been designated as Category 1 and that the claimant had failed to establish such categorisation was likely. In the event it is categorised, and Wikipedia is unable to operate, the claimant may then make an application for judicial review of the categorisation decision.
Ofcom third consultation on Online Safety Fees and Penalties
The Online Safety Act 2023 (Fees and Notification) Regulations 2025 came into force on 14 September 2025. They cover (among other things) fees payable under the OSA. On 1 September 2025, Ofcom published a consultation on guidance on the process for notifying Ofcom of regulated services and details of qualifying worldwide revenue. The guidance covers the process for preparing and submitting fees-related notifications and the required substantiating evidence. This is the third consultation in relation to the OSA fees and penalties guidance. It closes on 1 October 2025.
New priority offence to be added to OSA
On 8 September 2025, the government announced it will introduce secondary legislation under the Online Safety Act to make content encouraging or assisting serious self-harm a priority offence in relation to all users. Currently this kind of content is treated as primary priority content harmful to children which in-scope organisations must prevent children from accessing. Once changes are in place, in-scope organisations will be required to treat such content as priority illegal content and apply appropriate safety duties, including taking steps to prevent users from encountering it. Secondary legislation has not yet been published.
Consultation on recommendations for services on promotion of media literacy
On 15 September 2025, Ofcom opened a consultation on draft recommendations to assist services in helping people to navigate the evolving digital landscape. Under s11(1) Online Safety Act, Ofcom has a statutory duty to promote media literacy. It is required to publish a statement on media literacy, and a statement of recommendations. Ofcom's recommendations are aimed at a broad range of entities that enable the creation, hosting and distribution of content and media that reach significant UK audiences through broadcast, on-demand and online platforms including social media and streaming services. They will apply beyond user-to-user and search services regulated under the OSA to electronic media more broadly. The recommendations are designed with proportionality in mind. They are not mandatory but represent what Ofcom considers to be good practice to help shape services' approach to promoting media literacy. Responses are requested by 8 December 2025.
Consultation on amendments to OSA Information Powers Guidance
On 16 September, Ofcom published a consultation on changes to its Online Safety Information Powers Guidance as a result of the implementation of s124 Data (Use and Access) Act which amends the OSA to require Ofcom to issue Data Preservation Notices in response to coroner requests relating to preservation of data after the death of a child. It is also consulting on proposed updates with respect to Data Preservation Notices and minor updates to the guidance on Coroner Information Notices. Responses are required by 17:00 on 28 October 2025.
