The Online Safety Act UK – And how we’ve got it so wrong

WeAreQED
Posted: March 14, 2025
Updated: October 6, 2026

TL;DR: The Online Safety Act UK was written as if the internet stops at Dover, and it does not. Eighteen months into enforcement, Ofcom has issued more than £7 million in fines and, by its own admission, most of it has not been paid. Daily VPN use roughly doubled at its peak after age checks arrived.

The aims are right. Protecting children online matters. But the Act leans on a regulator chasing services in other countries, and it leaves the fight over encrypted messaging to Ofcom to settle later.

Below: what the Act does, where it stands in 2026, the flaws we think matter most, and what it means for a small business website.

Key takeaways

Ofcom’s data shows UK daily VPN use rose from around 650,000 before age checks began on 25 July 2025 to over 1.4 million in mid-August 2025, settling at around 900,000 by November.
Ofcom has issued more than £7 million in Online Safety Act fines across 11 providers, and its director of enforcement told the House of Lords in September 2026 that “realistically the majority have not been paid”.
4chan has refused to pay either of its fines, £20,000 in October 2025 and a further £520,000 in 2026, and its US lawyer has answered Ofcom’s payment demands with a picture of a hamster.
Section 121 lets Ofcom require a messaging service to use “accredited technology” to find child sexual abuse content, including content shared privately, which sits uneasily with end-to-end encryption.
Comments and reviews on your own content are exempt under Schedule 1 of the Act, so most small business brochure sites are not in scope.

The Online Safety Act UK is the biggest change to how the British internet is regulated in a generation, and I think we have got it badly wrong. I first wrote this in March 2025, the week Ofcom’s illegal harms codes came into force. This update, in October 2026, looks at what has actually happened since.

QED Web Design is a WordPress web design studio in South Brent, South Devon, and new internet law lands on our desk because our clients ask what it means for them. So this is opinion, but it is opinion with the working shown: every figure below is sourced, and where the evidence cuts against my argument, I say so.

What is the Online Safety Act meant to do?

The Online Safety Act 2023 places legal duties on online platforms and search services to protect users, especially children, from illegal and harmful content. It received Royal Assent in October 2023, and Ofcom is the regulator responsible for enforcing it.

The Act’s explanatory notes say it

“establishes a new regulatory framework to address illegal and harmful content online, with the aim of making the UK the safest place in the world to be online.”

Its key aims include:

Protecting children from harmful content online.
Holding tech companies accountable.
Tackling illegal content.
Requiring age checks where services host harmful material.
Increasing transparency from tech companies.

These are noble and just causes. Nobody sensible argues children should be served pornography or self-harm content. My argument is not with the aims. It is with whether a law built this way can deliver them, which the next sections test against the evidence.

Where does the Online Safety Act stand in 2026?

As of October 2026, the Online Safety Act’s main duties are in force and Ofcom is fining services that ignore them. The illegal harms codes took effect on 17 March 2025, and age checks for sites and apps hosting harmful content became mandatory on 25 July 2025.

Enforcement has started. Ofcom fined 4chan £20,000 in October 2025 for failing to answer a statutory information request, with a further £100 a day for up to 60 days if it kept ignoring the regulator. Fines against adult sites followed: £1 million against AVS Group in December 2025, then £1.35 million against 8579 LLC and £800,000 against Kick Online Entertainment in February 2026, as reported by the media law blog Inforrm.

Fines issued are not fines paid

Issuing a fine and collecting it are two very different things. Suzanne Cater, Ofcom’s director of enforcement, told the House of Lords Communications and Digital Committee in September 2026 that across more than £7 million in fines issued to 11 providers,

“realistically the majority have not been paid”,

as reported by The Register. Ofcom has declined to say which companies have paid. City AM reported in July 2026 that the only company Ofcom had confirmed as paying in full was Itai Tech, which also blocked UK users.

4chan is the poster child. It refused to pay its first fine, and when Ofcom added a further £520,000 in 2026, its US lawyer Preston Byrne responded publicly:

“Ofcom wrote. Again. Demanding that 4chan pay its fine. We replied with a hamster. Again.”

4chan’s position is that Ofcom would have to sue in a US court and overcome long-standing US doctrine against enforcing foreign regulatory penalties. We covered 4chan’s two-word response to Ofcom when this started, and nothing since has changed its mind.

A fine that cannot be collected is a press release. Ofcom’s real remaining lever against a foreign site is a court order requiring UK internet providers and payment firms to block or cut it off, and that brings you straight back to VPNs.

A correction to the first version of this post: I wrote that Ofcom had received no additional funding. That was wrong. The government’s guidance to Ofcom states that “the government is funding Ofcom’s initial costs” until an industry fees regime takes over from 2026/27, with set-up costs recouped from services from 2027/28.

The politics has moved too. Peter Kyle, Technology Secretary when this post was first written, was replaced by Liz Kendall in the September 2025 reshuffle. In July 2026 the Department for Science, Innovation and Technology itself was abolished in a wider reshuffle, as reported by Tech.eu. Ministers change. The Act’s design flaws stay put, as the next section explains.

What are the biggest flaws in the Online Safety Act?

The biggest flaws in the Online Safety Act are vague definitions, a regulator stretched across thousands of services, an unresolved clash with encryption, and very little reach over companies based abroad. Each is set out below.

Definitions that leave a lot to interpretation

Section 234 of the Act defines harm, in full, as “physical or psychological harm”. That is the whole definition. Earlier drafts also covered “legal but harmful” content for adults, but those duties were dropped before the Bill passed, replaced by user empowerment tools under section 15. The result is a law that is broad where it should be precise, and silent where many parents assume it acts.

A regulator chasing the whole internet

Ofcom has extensive powers under the Act, including the power to demand information under section 100. But it is one regulator facing a huge number of services, many outside the UK. The 4chan case shows the gap: an information request in April 2025, a fine in October, and a US-based site openly refusing to cooperate.

Free expression and over-removal

Section 17 places duties on the largest platforms to protect “content of democratic importance”. The worry is the incentive running the other way. When the penalty for leaving something up is a fine and the penalty for taking it down is nothing, platforms will err on the side of removal, and lawful speech gets caught in the net.

Each of these is a matter of design. The clearest test of the design, though, is what people actually did when the age checks arrived.

Do age checks work when anyone can use a VPN?

Partly. Ofcom’s own data shows age checks cut traffic to the biggest porn sites and, at the same time, sent daily VPN use in the UK sharply up. Both things are true, and anyone telling you only one of them is selling something.

“use some disruption”

to stop people watching material he deemed inappropriate – Yes, what he deems to be acceptable.

Peter Kyle, then Technology Secretary, said on BBC Radio 4 on 27 February 2025 that he would

A VPN, or virtual private network, routes your connection through a server in another country, so a website sees that country’s address instead of yours. And people already knew about them: a 2023 Forbes Advisor survey found “over three-quarters of Brits (76%) are familiar with VPNs”, with 20% of users citing bypassing censorship or restrictions as a reason.

Here is what happened after 25 July 2025, according to Ofcom’s figures as reported in December 2025. UK daily VPN users stood at around 650,000 before the checks, rose to over 1.4 million in mid-August, and were still around 900,000 in November. Ofcom itself noted that VPNs let users “access pornography services without going through age assurance.”

Ofcom also reported that Pornhub’s UK unique visitors fell 31% between July and August 2025. On its own, that number cannot tell you whether fewer people were watching, because it counts where visitors appear to be, not who they are. A UK user on a VPN or the Tor browser shows up as a visitor from somewhere else. And people clearly reached for them: app analytics firm Appfigures found UK downloads of the leading VPN apps jumped from roughly 14,000 a day to nearly 70,000 a day at the late-July peak.

Ofcom’s answer, in its October 2025 implementation update as reported by MediaCat, was that the big sites saw no matching rise in traffic from other regions, which is what mass VPN use would usually leave behind. Its explanation is that many users simply moved to non-compliant sites that never asked for ID. That is hardly a win either. Then, from 2 February 2026, Aylo, the company behind Pornhub, stopped new UK users accessing its free sites altogether, saying “Age assurance is failing in the UK”. Aylo has an obvious commercial interest in saying so, but whichever explanation you prefer, VPNs, Tor or a hop to a less scrupulous site, the viewing did not stop. It moved.

Common mistake: Reading “UK traffic fell” as “fewer people are watching”. Measured UK traffic to the biggest compliant sites did fall, but measurement cannot see past a VPN, and some of the traffic that vanished from compliant sites may simply have moved to ones that never ask for ID, which is exactly what Aylo argues. The honest criticism is narrower and harder to dismiss than “it does nothing”. A determined user, including a determined teenager, can route around the checks in a couple of minutes, and the people most motivated to do so are not the ones the law was written to protect.

Think of it as a lock on the front door of a house with no back wall. It stops casual visitors. It does not stop anyone who walks round the side. And as the next section shows, deciding which rooms get locked is its own problem.

Who decides what counts as harmful?

Under the Online Safety Act, platforms decide in the first instance, guided by Ofcom’s codes, and that means someone’s judgement is doing a great deal of work. Moderation at internet scale is genuinely hard, and Last Week Tonight with John Oliver explained why better than I could in its segment on content moderation, which is worth watching on the show’s official channels.

John Oliver on why content moderation at scale is so hard (Last Week Tonight, HBO)

Baroness Bertin’s 2025 review of pornography regulation shows how evidence and judgement get blurred. It reports that

“One study found that 13% of sexually active girls aged 14 to 17 had already been choked”,

then adds that

“Anecdotal evidence submitted to this Review also suggests that boys as young as ten are asking teachers how to choke girls during sex”.

The first is a study. The second, by the review’s own description, is anecdote. Both may point at something real, but policy that treats the two as equal weight is policy built on feel as much as fact.

That matters most where the stakes are highest: private messaging.

Does the Online Safety Act threaten end-to-end encryption?

It creates the power to, and leaves the decision to Ofcom. End-to-end encryption means only the sender and recipient can read a message; the service in the middle cannot. Section 121 of the Act lets Ofcom, “if OFCOM consider that it is necessary and proportionate”, require a service to use accredited technology to identify child sexual exploitation and abuse (CSEA) content, whether communicated publicly or privately, and swiftly take it down.

Separately, section 66 requires UK providers to operate “using systems and processes which secure (so far as possible) that the provider reports all detected and unreported CSEA content present on the service to the NCA”, the National Crime Agency. You cannot scan what you cannot read. A service that is genuinely end-to-end encrypted has two options if a section 121 notice ever lands: weaken the encryption, or leave the UK.

Nobody is defending child abuse material. But the services in the firing line are the ones millions of people use every day, including WhatsApp, Apple’s iMessage, Facebook Messenger, Instagram direct messages, Signal and Telegram. The Act contains no absolute protection for encryption. It defers the hardest question in the whole law to a regulator’s future judgement, which is closing the stable door before anyone has decided whether there is a horse.

Can a UK law police a borderless internet?

Only with other countries’ cooperation. Section 204 gives parts of the Act extra-territorial reach, but Ofcom has no power to switch off a server in another jurisdiction, and a fine is only as strong as your ability to collect it.

Say Ofcom wants an app removed. Google and Apple can pull it from their UK app stores, and they will comply. A user who still wants it downloads the installer file from a site hosted somewhere that does not care about UK law, and installs it directly. That is not technical wizardry. It takes minutes.

Platforms serving both the UK and the EU also have to satisfy two different regimes at once, the Online Safety Act and the EU’s Digital Services Act, with different definitions and timetables. The big players can afford two compliance teams. Smaller platforms cannot.

Have governments learnt nothing?

In February 2011, a marketplace called Silk Road appeared and showed everyone what the internet really is: borderless. It ran on the Tor network, which routes traffic through several servers to hide where it came from, and took payment only in Bitcoin. It lasted two and a half years until the FBI shut it down in October 2013. What brought it down was not legislation. It was a technical mistake that exposed where the server really was.

The services that came after learnt from that mistake. Age verification creates new risks of its own, as the Tea app data breach showed when users’ ID photos were exposed. You can write all the laws you want, but the internet finds workarounds. It always has, and the BBC’s own reporting on age verification shows how easily the numbers get spun, as we set out in BBC reporting on the success of age verification, debunked.

Does the Online Safety Act apply to your business website?

For most small business websites, no. Schedule 1 of the Act exempts “limited functionality services”, where the only thing users can do is post comments or reviews about your own content, share them, or react with likes, emojis or ratings.

So a brochure site with a blog that allows comments, or a shop with product reviews, is generally outside scope. The picture changes if users can post their own content for other users to see: a forum, a community board, a members’ area with messaging, or anything resembling a social network. Ofcom has a free online checker that walks you through whether the Act applies, and it is worth five minutes if your site does more than publish your own pages.

None of this is legal advice, and if your site sits near the line, get it checked properly. Accessibility law is the other piece of legislation that most often catches small business sites out, and our guide to website accessibility law for UK small businesses covers it without the scare tactics.

If you want a straight answer on what any of this means for your own site, contact QED Web Design. No nonsense, no hard sell.