Notifications
Clear all
Topic starter
20/08/2026 6:07 pm
TL;DR: The UK Online Safety Act puts stricter risk, content, and accountability duties on platforms, with Ofcom empowered to issue guidance, enforce compliance, and pursue fines of up to £18 million or 10% of global turnover, according to ActiveFence. For trust and safety and identity teams, the issue is no longer moderation alone but evidenceable governance across reporting, age assurance, and policy enforcement.
NHIMG editorial — based on content published by ActiveFence: The UK’s Online Safety Act and what trust and safety teams can expect
By the numbers:
- Platforms face fines of up to £18 million or 10% of global annual turnover for non-compliance.
- Ofcom expects to produce over 40 regulatory documents, including codes of practice and guidance.
Questions worth separating out
Q: How should platforms implement age assurance without over-blocking legitimate users?
A: Start with a risk-based policy that matches verification strength to the content or service being gated.
Q: Why do trust and safety controls need identity governance behind them?
A: Because enforcement depends on knowing who can do what, which users are eligible for restricted content, and which actions were taken under which policy.
Q: What breaks when moderation is automated without auditability?
A: Teams cannot prove why a decision was made, whether it was consistent, or how it should be appealed.
Practitioner guidance
- Map platform duties to control owners Assign owners for illegal content risk assessment, children's access assessment, moderation evidence, and complaint handling so each duty has a named control accountable for review and remediation.
- Treat age assurance as governed access control Define when age verification, age estimation, or account blocking is required, then log the policy basis, review exceptions, and test for privacy leakage and false acceptance.
- Instrument moderation workflows for evidence retention Capture the signal, policy, reviewer, and outcome for every takedown, restriction, or appeal so Ofcom-style audits can reconstruct the decision path without relying on memory.
What's in the full article
ActiveFence's full blog covers the operational detail this post intentionally leaves for the source:
- Ofcom duty breakdowns and the practical implications of each obligation for platform operators.
- Detailed examples of prohibited and harmful content categories under the UK regime.
- Implementation guidance for risk assessments, notice-and-takedown, and complaints handling workflows.
- Explanation of how user empowerment tools and age controls interact with legal compliance requirements.
👉 Read ActiveFence's analysis of the UK Online Safety Act for trust and safety teams →
UK online safety law: what trust and safety teams need now?
Explore further
20/08/2026 6:42 pm
Content safety is now an identity and governance problem, not only a moderation problem. The Act forces services to distinguish children, adults, verified users, and potentially risky accounts before they can apply the right controls. That means identity assurance, access policy, and evidence retention become part of trust and safety design, not separate compliance add-ons. Practitioners should align platform safety decisions with identity governance and auditability from the start.
A question worth separating out:
Q: Who is accountable when a platform fails to enforce online safety duties?
A: Accountability usually sits with the service operator, but the practical burden falls on product, legal, trust and safety, security, and identity teams that control the underlying workflows. If the organisation cannot show ownership, evidence, and review, the regulator will treat the duty as unmet regardless of internal handoffs.
👉 Read our full editorial: UK online safety law raises the bar for platform governance
