In short
On 28 August 2026 Ofcom, the UK online safety regulator, published an update on the work of the teams that engage with platforms before a formal investigation is needed. The result: seven sites posing a significant risk of harm to children blocked access from the UK, and two more introduced age assurance.
What happened
Ofcom runs a taskforce dedicated to "small but risky" services: modest sites whose main content is harmful material. Under that pressure, two sites dedicated to graphic violence and serious injury content deployed age assurance to keep UK children out. Seven others preferred to shut the door on the UK entirely: five hosted graphic violence, two hosted suicide content.
Blocking UK IP addresses — geoblocking — is a route Ofcom accepts: if the service is no longer reachable, the risk to UK users falls away. But it is also the cheapest route, and it changes nothing for users in every other country.
The first eighteen months in numbers
- More than 100 platforms examined since the Act came into force
- Over £6 million in fines against 10 providers
- 9 services which, in this update alone, blocked the UK or introduced age checks
- Earlier Ofcom research had already found children first encounter this content while still at primary school, and describe it as an inevitable part of being online
The open letter to platforms
On the same day Ofcom wrote to platforms to remind them of something some were evidently taking for granted: existing duties are not suspended by the UK Government's announced ban on social media for under-16s. The new measures are expected from spring 2027; until then, and after, Online Safety Act duties stand. In October the regulator will publish a rapid assessment of what "highly effective age assurance" means at the sixteen threshold.
Why this matters outside the UK too
The British model — safety duties for anyone reachable from the country, with geoblocking as the only alternative — is becoming a reference point. If a European company runs a user-generated content service reachable from the UK, the question is not whether the GDPR is enough: these are two different regimes, and the second applies by user territory, not by company seat.
Honestly: nine services are not a revolution, and the seven that left still exist for everyone else. But the interesting part of the update is not the count, it is the method. Ofcom argues that persuasion before formal investigation delivers results faster than proceedings that take years. That is a claim European data protection authorities, sitting on multi-year backlogs, would do well to read.
Official source:Ofcom - UK children protected from more high-risk sites as a result of Ofcom action (28 agosto 2026)Official source:Ofcom - Our approach to online safety supervision and compliance (28 agosto 2026)Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
