UK Online Safety Act 2026: What It Is, Enforcement Deadlines, and Who Is Affected

Key Takeaways

• Ofcom is actively enforcing the Act’s age check requirements right now, with fines already reaching 1.35 million pounds for a single platform in February 2026.
• The bar Ofcom uses isn’t one specific technology. It’s a standard, one Ofcom calls highly effective, requiring any method to be technically accurate, robust, reliable, and fair.
• 2026 brings a run of milestones, from ongoing adult content enforcement to a categorisation register and statutory reports due in July and October.
• Penalties for noncompliance can reach 18 million pounds or 10 percent of global turnover, whichever is greater, alongside business disruption measures and, in specific cases, personal liability for senior managers.
• The Act’s reach extends well beyond the UK’s borders. Any service likely to be accessed by UK users can fall within scope, regardless of where the company is based.

In February 2026, Ofcom (the Office of Communications – the UK’s regulator for the communications industries) fined the operator of an adult website 1.35 million pounds(!) This is the largest penalty yet under its enforcement program for age checks on pornography sites. The company’s failure wasn’t obscure or technical. It simply hadn’t put in place the age checks the law requires, and children could still reach adult content on its site. The fine is a blunt illustration of what this law asks of any platform in its sights: prove, don’t promise, that children can’t get in.

This single case demonstrates a much wider issue. Throughout 2026, Ofcom is rolling out a series of deadlines that will determine which platforms face which duties, and how seriously the regulator expects those checks to be taken. No industry is targeted nor is any exempt. Gaming platform Roblox, Xbox, and Steam have been nabbed to introduce meaningful age assurance to restrict adult to child contact in online games. 

Let’s examine what the Act actually requires, what counts as compliance, and what’s coming next.

Book a Demo

Give your business the boost of a fully automated, KYC process. No geographical limits and fast, frictionless onboarding verification processes enhance customer’s experience. 

Book a Demo

What Is the UK Online Safety Act?

The Online Safety Act 2023 is the law that governs how online platforms protect users, particularly children, from harmful content. It applies to search services and user-to-user services, meaning platforms where users can post, share, or interact, that are likely to be accessed by people in the UK, regardless of where the operating company is based.

Ofcom, the UK’s communications regulator, enforces the Act, and it has been rolling out obligations in phases since 2025. Illegal content duties, requiring providers to assess and mitigate risks such as terrorism content and child sexual abuse material, came into force in March 2025. Duties to protect children from other harmful content, including pornography, self-harm, and eating disorder material, followed later that year.

2026 is the year those duties move from paper to practice. Ofcom is actively enforcing the rules it finalized in 2025 while simultaneously publishing the statutory reports and milestones that will decide which platforms carry the heaviest compliance burden going forward. For a look at how another major regulator is approaching a similar challenge, our piece on the EU age verification mini-wallet covers the parallel European approach.

What ‘Highly Effective Age Assurance’ Actually Means

The term at the center of the act’s child protection duties is what Ofcom calls a ‘highly effective standard for checking a user’s age’. Ofcom doesn’t endorse a specific technology or vendor. Instead, it set four criteria that any method must meet:

• Technically accurate: the method correctly determines a user’s age under test conditions.
• Robust: it holds up against real world attempts to circumvent it, not just laboratory conditions.
• Reliable: the output is reproducible and comes from trustworthy evidence, not a one-time guess.
• Fair: the method doesn’t produce biased or discriminatory outcomes across different groups of users.

Ofcom has stopped short of setting a numeric accuracy threshold, but it has published a non exhaustive list of methods it considers capable of meeting the bar, including photo-ID matching, facial age estimation, mobile network operator checks, credit card verification, and digital identity services. A simple checkbox declaration or a self-reported birthdate doesn’t qualify. Facial age estimation on its own doesn’t automatically qualify either, since any method with a margin of error needs to set its challenge age well above the legal threshold to keep minors from slipping through.

In March 2026, Ofcom and the Information Commissioner’s Office published a joint statement clarifying that these checks must also comply with data protection law, provided the chosen method is necessary and proportionate to the risk involved. That combination, effective and privacy respecting, is the real test behind online safety act age verification today.

Book a Demo

Give your business the boost of a fully automated, KYC process. No geographical limits and fast, frictionless onboarding verification processes enhance customer’s experience. 

Book a Demo

The 2026 Enforcement Timeline, Key Dates

2026 is packed with milestones. Some reflect ongoing enforcement; others are new regulatory deliverables:

• February 2026: Ofcom issues some of its largest fines yet under its adult content enforcement program, including the 1.35 million pound penalty described above, showing enforcement is already well underway rather than pending.
• March 2026: Ofcom and the ICO publish a joint statement setting shared expectations for age checks across both online safety and data protection law.
• May to July 2026: Ofcom may request that providers submit their illegal content and children’s risk assessments, checking whether earlier feedback has been acted on.
• July 2026: Ofcom expects to publish its categorisation register, determining which platforms qualify as Category 1 or Category 2A services with additional duties, alongside its statutory report assessing how effective age checks have been across the industry so far.
• October 2026: Category 1 and 2A providers are expected to supply Ofcom with copies of their children’s risk assessment records reflecting the new categorisation, and Ofcom is due to publish its statutory report on the incidence and severity of content harmful to children.

Platforms treating any of these dates as distant deadlines are misreading the moment. Enforcement is running alongside rulemaking, not waiting for it.

Who Is Affected in 2026

The Act’s reach is broader than many platforms assume. It applies to:

• Any user-to-user service likely to be accessed by children that allows what the law calls primary priority content, including pornography, self-harm, suicide, or eating disorder material.
• Search services, regardless of where they are headquartered.
• Services that publish their own pornographic content, including certain generative AI tools.
• Social media, gaming, and messaging platforms, especially where children can access chat or user generated content.
• Very large platforms expected to fall into Category 1 or Category 2A once the register is published in July 2026, which will carry additional transparency and risk assessment duties.

None of this depends on where a company is based. A platform doesn’t need a UK office or UK incorporation to fall under the Act. If it’s likely to be accessed by people in the UK, it’s in scope. Our explainer on what age verification is serves as a useful primer for teams mapping their own services against these categories.

What Identity and Age Verification Providers Need to Do

For identity verification providers, 2026 is turning the Act’s abstract standard into concrete demand. Platforms that previously relied on a checkbox or a self-declared birthdate now need methods that can withstand scrutiny under all four of Ofcom’s criteria, which means real investment in document verification, biometric checks, and facial age estimation calibrated with an appropriately conservative challenge age.

Providers have a few clear priorities:

• Build for verification, not estimation alone. Ofcom’s criteria demand evidence of testing, not just a plausible sounding method, and pure estimation struggles to clear the bar on its own.
• Design for circumvention resistance. A method that works in a demo but fails against a determined teenager trying to fake their age doesn’t meet the robust criterion.
• Bake in data minimization from the start. The joint Ofcom and ICO statement makes clear that Ofcom age verification expectations require methods to be proportionate and compliant with UK data protection law, not just effective at determining age.
• Prepare for scale. As the categorisation register lands in July and enforcement continues across smaller adult sites, gaming platforms, and social media, demand for tested, documented age checks will keep growing across sectors well beyond pornography.

For platforms weighing where age verification fits into a broader compliance program, our overview of KYC regulations explains the wider context these obligations sit within.

Book a Demo

Give your business the boost of a fully automated, KYC process. No geographical limits and fast, frictionless onboarding verification processes enhance customer’s experience. 

Book a Demo

FAQ