Ofcom finally named Facebook, TikTok, X and eight others as the platforms too big to leave unwatched. The rules that naming was meant to trigger will not exist until 2027.
Estimated reading time: 6 minutes
In short. Section 95 of the Online Safety Act 2023 has required Ofcom to publish a register identifying the platforms subject to the toughest duties, Category 1, since 10 January 2024. That register did not appear until 30 June 2026, naming Facebook, Instagram, Pinterest, Quora, Reddit, Roblox, Snapchat, TikTok, WhatsApp, X and YouTube, 902 days after the duty to publish it came into force. The extra protections Category 1 status exists to trigger, including the user-empowerment duty in section 15, have been on the statute book for the same 902 days but bound nobody, and Ofcom's own consultation on how to enforce them will not produce final policy statements until "mid-2027 at the latest." Meanwhile, the Act's baseline duties, which apply to everyone regardless of size, have already produced fines topping four million pounds against six much smaller operators. Two documented mistakes: four stars.
The Online Safety Act 2023 received Royal Assent on 26 October 2023 and remains in force, "up to date with all changes known to be in force on or before 14 September 2026" according to its own legislation.gov.uk record, with several provisions still prospective [1]. Picked from the registry's queued Tier 3 candidates as the strongest live entry this cycle: the highest-search-salience document tracked, with a specific and checkable mechanism, the Category 1 register, that this cycle writes up as a Tier 2 structured teardown rather than stretching it into a cornerstone treatment the site has already run three of this month.
The claims, tested
| The Act's claim | What we found | Verdict |
|---|---|---|
| OFCOM "must establish...a register" identifying Category 1, Category 2A and Category 2B services and "must publish the register" (section 95(2), (8)), in force since 10 January 2024 [2] | Ofcom's own register was "Published: 30 June 2026," 902 days after section 95 took effect and roughly a year after Ofcom's own contemporaneous account put the first categorisation decisions at "this summer," meaning summer 2025 [3] [4] | 902 days late against the Act's own commencement date |
| Category 1 providers have a duty, also in force since 10 January 2024, to include "features which adult users may use or apply if they wish to increase their control over content" (section 15(2)) [5] | With no service designated Category 1 until 30 June 2026, the duty bound nobody for those 902 days. Ofcom's consultation on the codes that operationalise it closes at the end of September 2026, and Ofcom states: "We will publish our final policy statements as soon as possible, by mid-2027 at the latest" [6] | Unenforceable for at least three and a half years after Royal Assent |
The mistakes, counted
A register that took two and a half years to write down eleven names (1). Section 95 sets up three lists, Category 1 regulated user-to-user services, Category 2A regulated search and combined services, and Category 2B regulated user-to-user services, and requires Ofcom to assess providers against threshold conditions set by government and "must publish the register" [2]. That section commenced on 10 January 2024. Ofcom's own record shows the register finally appearing on 30 June 2026: eleven Category 1 services (Facebook, Instagram, Pinterest, Quora, Reddit, Roblox, Snapchat, TikTok, WhatsApp, X and YouTube), four Category 2A services and twenty Category 2B services [3]. Part of the delay has a genuine cause rather than simple foot-dragging: the Wikimedia Foundation challenged the government's threshold regulations in the High Court, which dismissed the claim on 11 August 2025, after which the Foundation chose not to appeal, by which point Ofcom's own previously stated expectation of "this summer," meaning summer 2025, had already passed [4]. Wikipedia itself is not on the Category 1 list, placed instead on a watch list for possible future reassessment. None of that changes the arithmetic: a duty that has existed continuously since January 2024 took 902 days to discharge.
Duties on the books for three and a half years with nobody bound by them (2). Section 15 requires Category 1 providers to give adult users tools to control what they see, among other Category 1-specific obligations, and it commenced on the same day as section 95, 10 January 2024 [5]. A duty that only applies to a defined category cannot bind anyone until that category has members, so section 15 bound nobody until the register named its first eleven services on 30 June 2026. Even now, Ofcom's own consultation on the codes of practice that would tell a platform how to comply, covering user empowerment, identity verification, terms of service, complaints and protections for journalistic and democratically important content, does not close until the end of September 2026, and Ofcom's own commitment is to "publish our final policy statements as soon as possible, by mid-2027 at the latest," with only the terms-of-service guidance flagged for an earlier landing in "early 2027" [6]. By the time any Category 1 duty is actually enforceable, the Act will be heading into its fourth year.
That gap sits alongside a working enforcement record on the Act's baseline duties, the ones that apply to every regulated service regardless of size, which commenced earlier and have already produced real penalties. Ofcom's own tally, published alongside its 19 March 2026 decision, put enforcement at sixteen fines against six companies totalling nearly four million pounds [7]. That single decision fined 4chan Community Support LLC £450,000 for lacking age checks to keep children from pornography, £50,000 for an inadequate illegal content risk assessment and £20,000 for failing to explain its protections in its terms of service, on top of an earlier £20,000 fine, on 13 October 2025, for not answering two statutory information requests [7] [8]. Adult sites 8579 LLC and Kick Online Entertainment SA were fined £1.4 million and £830,000 respectively on 23 February 2026 for missing age checks [9]. An anonymous forum linked to more than 130 UK deaths was fined £950,000 on 13 May 2026, after that March tally, for failing to remove illegal suicide content it was aware of [10]. None of those six companies is one of the eleven names on the Category 1 register.
Credit where due
The baseline duties are not just words. Ofcom has reached companies with no UK presence and fined them sums large enough to change behaviour, and it did so on a workable timetable, not a stalled one: illegal content codes came into force in March 2025 and enforcement followed within months [7]. The Category 1 delay also has a fairer story attached to it than pure slippage: a legitimate legal challenge tested the threshold rules in court, and the outcome, keeping Wikipedia off a list built for the largest commercial platforms, looks like the system working as intended rather than a regulator moving slowly for its own sake [4].
Verdict
Four stars, from two documented mistakes that are really one mistake seen twice. The Act's mechanism for identifying and then constraining the biggest platforms has taken 902 days to name them and will take longer still to bind them, while its baseline duties, aimed at everyone equally, have already fined six much smaller operators close to four million pounds between them. A law can be strict where it bites and slow where it was supposed to bite hardest at the same time; this one currently is.
Sources
- Online Safety Act 2023, legislation.gov.uk
- Online Safety Act 2023, section 95, legislation.gov.uk
- Register of categorised services and list of emerging Category 1 services, Ofcom
- Wikimedia Foundation challenges UK Online Safety Act regulations, Wikimedia Foundation
- Online Safety Act 2023, section 15, legislation.gov.uk
- Ofcom's approach to implementing the Online Safety Act (roadmap to regulation), Ofcom
- 4chan fined £450,000 for not protecting children from online pornography, Ofcom
- Investigation into 4chan and its compliance with duties to protect its users from illegal content, Ofcom
- Ofcom fines porn company £1.35 million for not having age checks, Ofcom
- Ofcom fines online suicide forum £950,000, Ofcom