TRW & Co · Technology, Data & IP
Online Safety and Digital Regulation Lawyers in London
Online safety lawyers in London help platforms, apps and digital businesses meet the Online Safety Act 2023, Ofcom's codes, the CMA's digital markets and consumer powers and the privacy rules that sit alongside them. With Ofcom's illegal content and child safety duties now enforceable and fines already issued, 2026 is the year regulators expect documented, working compliance.
Key pointOfcom's first Online Safety Act penalty was for ignoring information requests, not for harmful content. A service's records and responsiveness are now as important as its moderation.
At a glance
Illegal content duties live
The illegal content safety duties became enforceable on 17 March 2025, after the deadline for completing illegal content risk assessments passed.
Child safety from July 2025
Services likely to be accessed by children must have assessed risks and applied protections, including highly effective age assurance, since 25 July 2025.
Penalties are substantial
Ofcom can fine up to £18 million or 10% of qualifying worldwide revenue, whichever is greater, and seek court-ordered business disruption measures.
CMA powers widened
Since 6 April 2025 the CMA can fine for consumer law breaches directly, and since October 2025 Google and Apple have held strategic market status designations.
Overseas services caught
The Act applies to services with links to the UK, such as significant UK user numbers, wherever the provider is incorporated or based.
Swipe or scroll →
What online safety lawyers in London advise on
Online safety lawyers in London advise platforms, apps, marketplaces, games studios, search tools and the businesses that host user content on the UK's fast-growing body of digital regulation. The centre of gravity is the Online Safety Act 2023, enforced by Ofcom, but the same products are also shaped by the digital markets and consumer regimes run by the Competition and Markets Authority, data protection law enforced by the Information Commissioner's Office, and product security rules for connected devices.
The common thread is that regulators now look at how a service is designed, not just at individual pieces of content. A platform is expected to assess risks, document its reasoning, build proportionate systems and be able to show a regulator what it did and why. Getting that record right is as much a legal exercise as an engineering one.
Digital regulation becomes a board-level question at predictable points: before a UK launch, when a service adds user-to-user features such as chat, comments or uploads, when children are likely to use the product, when Ofcom or the CMA sends an information request, and when an investor or acquirer asks for evidence of compliance in due diligence.
Who the Online Safety Act applies to
The Online Safety Act 2023 applies to three main groups: user-to-user services (anything that lets users share content or interact, from social media and forums to marketplaces, dating apps and multiplayer games), search services, and providers that publish pornographic content themselves. Size is not the test. A small forum can be in scope just as much as a global social network.
The Act reaches services based outside the UK where they have links with the UK, for example because they have a significant number of UK users, the UK is a target market, or the service poses a material risk of significant harm to people in the UK. Many overseas founders assume that a non-UK company structure takes them outside the regime. It usually does not.
Categorised services
On top of the baseline duties, the Act creates categories of service (Category 1, 2A and 2B) with additional transparency, user empowerment and accountability obligations. The threshold conditions were set by regulations laid in December 2024, and Ofcom maintains a register of categorised services. Ofcom's own timetable for publishing the register and the extra duties has moved more than once, so services near the thresholds should check the current position directly rather than rely on older commentary.
| Regime | Main legislation | Regulator | Typical targets |
|---|---|---|---|
| Online safety | Online Safety Act 2023 | Ofcom | User-to-user services, search services and pornography providers |
| Digital markets | Digital Markets, Competition and Consumers Act 2024, Part 1 | CMA (Digital Markets Unit) | Firms designated with strategic market status |
| Consumer protection | Digital Markets, Competition and Consumers Act 2024, Parts 3 and 4 | CMA, Trading Standards | Any trader dealing with UK consumers online |
| Data protection and cookies | UK GDPR, Data Protection Act 2018, PECR, Data (Use and Access) Act 2025 | ICO | Any business processing personal data, especially children's data |
| Connected product security | Product Security and Telecommunications Infrastructure Act 2022 | Office for Product Safety and Standards | Manufacturers, importers and distributors of consumer connectable products |
The core online safety duties in practice
The Act works through duties to assess risk and then take proportionate measures. Ofcom's codes of practice describe recommended measures. A service that follows the codes is treated as complying with the relevant duties; a service that takes a different route must be able to show that its alternative achieves the same outcome.
Illegal content
Every in-scope service had to complete an illegal content risk assessment, and the illegal content safety duties became enforceable on 17 March 2025. Services must take proportionate steps to prevent users encountering priority illegal content such as terrorism and child sexual abuse material, operate effective content moderation, and remove illegal content swiftly once aware of it. They also need accessible reporting and complaints routes.
Protecting children
Services likely to be accessed by children had to carry out a children's access assessment and then a children's risk assessment, with the child safety duties applying from 25 July 2025. Where a service allows the most harmful categories of content, such as pornography or material promoting suicide, self-harm or eating disorders, Ofcom expects highly effective age assurance. Self-declaration of age is not enough.
Pornography providers
Providers that publish their own pornographic content (Part 5 services) must use age verification or age estimation that is highly effective at preventing children from accessing it. Ofcom published guidance on this in January 2025 and has treated the area as an enforcement priority.
Records, terms and governance
Across all of this, the Act requires written records of risk assessments and compliance measures, clear terms of service and a named person accountable for compliance. Online safety lawyers in London spend much of their time helping clients build that paper trail so it stands up if Ofcom asks for it.
Ofcom's first penalty under the Act, announced in October 2025, was not about harmful content at all: it followed a provider's failure to respond to statutory information requests. Treat every Ofcom information notice as a formal legal demand with a deadline, and route it to someone with authority to answer it.
Ofcom's enforcement powers and the wider digital rulebook
Enforcement is where online safety lawyers in London are most often called in at short notice. Ofcom can fine a provider up to £18 million or 10% of its qualifying worldwide revenue, whichever is greater. It can also apply to the courts for business disruption measures that require payment providers, advertisers or internet access providers to withdraw services from a non-compliant platform. Senior managers can face criminal liability where a company fails to comply with information requests, and the Act created new criminal offences, in force since 31 January 2024, including cyberflashing, threatening communications and sending false communications intended to cause harm.
Digital markets and consumer law
The Digital Markets, Competition and Consumers Act 2024 gives the CMA two sets of powers that matter to digital businesses. First, it can designate firms with strategic market status and impose conduct requirements. In October 2025 the CMA designated Google in general search and Apple and Google in mobile platforms, and has since consulted on conduct requirements and commitments covering choice screens, fair ranking and app review. Businesses that depend on those platforms now have a formal route to raise concerns.
Second, since 6 April 2025 the CMA can decide for itself that a business has broken consumer law and impose fines of up to 10% of global turnover, without going to court first. Fake reviews and drip pricing are specifically targeted; our guides on DMCC consumer enforcement and strategic market status explain both regimes in more depth.
Data, cookies and children's privacy
Online safety and privacy overlap heavily. Age assurance involves processing personal data, the ICO's Age Appropriate Design Code applies to online services likely to be accessed by children, and the Data (Use and Access) Act 2025 is being brought into force in stages, including changes to cookie consent and to penalties under the Privacy and Electronic Communications Regulations. Our data protection solicitors work alongside the online safety team on these points.
Regulators no longer ask only whether harmful content was removed. They ask whether the service was designed, assessed and run so that the harm was less likely to happen in the first place.
Key decisions online safety lawyers in London help platforms make
Most compliance programmes turn on a handful of judgement calls. Each has legal, product and commercial consequences, which is why online safety lawyers in London work closely with trust and safety, engineering and product teams rather than writing policies in isolation.
Is the service in scope?
Map every feature that lets users share content or interact. A comment box, review function or in-game chat can bring an otherwise simple product within the Act, and some exemptions, such as limited-functionality services, are narrower than they look.
Is it likely to be accessed by children?
The children's access assessment asks whether it is possible for children to use the service and whether a significant number do or would. Pointing to terms of service that ban under-18s rarely answers the question without effective age checks.
Which age assurance method?
Options include photo-ID matching, facial age estimation, credit card checks and open banking. Each carries different privacy, accuracy, accessibility and cost trade-offs, and the choice must be documented against Ofcom's criteria.
Follow the codes or take another route?
Adopting Ofcom's recommended measures gives a safe harbour. Alternative measures can suit innovative products, but the service must record why they are equally effective and how they protect users' rights.
How to handle freedom of expression?
Services must have regard to users' freedom of expression and privacy when designing safety measures. Overly aggressive moderation creates complaints, reputational damage and, for some categories, separate legal duties.
Where to place accountability?
Naming a senior individual responsible for compliance, and giving them budget and reporting lines, is both an Ofcom expectation and a practical defence when things go wrong.
A practical compliance timeline
For a service launching in the UK or adding interactive features, we typically recommend the sequence below. The timetable compresses if Ofcom has already opened an enforcement programme in your sector.
- Scope and feature mapping. Catalogue features, user numbers, UK reach and revenue so you know which parts of the Act, and which other regimes, apply.
- Illegal content risk assessment. Assess each kind of priority illegal harm against Ofcom's risk profiles, record the evidence used and approve the assessment at the right level.
- Children's access and risk assessments. Decide honestly whether children are likely to use the service and, if so, assess the risk of each category of harmful content.
- Choose and implement measures. Map Ofcom's codes to your product, select age assurance where needed, set moderation and complaints processes, and update terms of service.
- Governance and records. Appoint an accountable individual, set review cycles, and keep records that would satisfy an Ofcom information notice.
- Cross-check other regimes. Test the design against UK GDPR, the Age Appropriate Design Code, consumer law and any EU obligations under the Digital Services Act.
- Monitor and refresh. Repeat risk assessments before significant product changes and when Ofcom updates its codes, guidance or categorisation decisions.
Documents and evidence regulators expect
When Ofcom, the CMA or the ICO looks at a service, the first request is usually for documents. A business that can produce a coherent set quickly is in a much stronger position than one reconstructing decisions after the event.
- Illegal content, children's access and children's risk assessments, with the data and reasoning behind each.
- A record of which code measures have been adopted and, for any alternative measures, why they are effective.
- Terms of service, community guidelines and the moderation policies that implement them.
- Age assurance design documents, accuracy testing and the related data protection impact assessment.
- Complaints and appeals logs, response times and outcomes.
- Board or senior management minutes showing oversight, and the role description of the accountable individual.
- Revenue and user-number data relevant to fees, categorisation and penalty calculations.
For acquisitions and investments, the same documents form the core of digital regulatory due diligence. Buyers increasingly ask for them early, and sellers who prepare them in advance avoid price chips and special indemnities.
Common risks and mistakes
Assuming an overseas structure keeps you out of scope
The Act reaches services with links to the UK, including those with a significant number of UK users or that target the UK. A company incorporated in Delaware, Dhaka or Dubai that serves UK users is likely to be caught. Ofcom has opened investigations into overseas providers and its information powers apply to them. Equally, ignoring the regime does not make it go away: non-response to information requests has already resulted in a fine. The better approach is a clear scoping analysis, a decision on whether to geo-restrict any features, and a proportionate compliance plan for what remains.
Treating risk assessments as a one-off form
Risk assessments must be suitable and sufficient, kept up to date, and repeated before significant changes to the service. A template exercise completed once in 2025 and never revisited is unlikely to satisfy Ofcom, particularly after a product redesign, a new recommendation algorithm or the launch of livestreaming. Build the assessment into the product development cycle so that legal and trust and safety teams review changes before launch rather than after complaints arrive. Keep version control so you can show how the assessment evolved.
Choosing age assurance without a privacy analysis
Highly effective age assurance necessarily involves personal data, sometimes biometric data. If the method is not designed with UK GDPR in mind, a business can satisfy Ofcom and still breach data protection law. A data protection impact assessment, careful supplier contracts, data minimisation and clear retention rules are essential. The ICO and Ofcom have published joint statements on the overlap, and both regulators expect the analysis to be documented. Consider accessibility too: some users cannot use certain methods.
Mishandling a regulator's information notice
Information notices under the Online Safety Act, the DMCC Act and data protection law are compulsory and carry their own penalties for failure to comply or for giving false or misleading information. The response needs a clear owner, a search plan, privilege review and a realistic view of deadlines. Where a deadline is unworkable, ask for an extension early and in writing. Responses become the evidential foundation for any later investigation, so accuracy matters more than speed alone.
Forgetting the EU and other markets
A UK-compliant service is not automatically EU-compliant. The EU Digital Services Act imposes its own transparency, notice-and-action and risk obligations, and requires a legal representative in the EU for providers without an establishment there. Running separate, uncoordinated programmes for each market wastes money and produces inconsistent user experiences. A single design with jurisdiction-specific modules is usually more efficient.
Cross-border angle: the EU, Bangladesh, the Gulf and Singapore
Online safety lawyers in London increasingly advise on products built in one country and sold in several. The EU's Digital Services Act and Digital Markets Act cover similar ground to the UK regime but differ in detail, and the EU AI Act adds obligations for some AI-enabled features. For UK businesses, the practical question is how to align risk assessments and transparency reporting so that one programme serves both markets.
For businesses connected with Bangladesh, TRW & Co's home jurisdiction, the position needs particular care. Bangladesh's cyber security and data laws have changed several times in recent years, and the Bangladesh Telecommunication Regulatory Commission has its own content and licensing powers. A Bangladeshi developer serving UK users must meet UK rules for its UK audience while complying with local law at home. Our Dhaka colleagues advise on the Bangladeshi side, and our UK–Bangladesh team coordinates the two.
Singapore and several Gulf states also regulate online content and platform conduct, with codes of practice and licensing requirements that can apply to foreign providers. Where a service is offered across these markets, we work with local counsel and our offices in Singapore and Dubai to identify conflicts early, for example where local law requires content to be taken down that UK users are entitled to see, or vice versa.
How TRW & Co helps
Our online safety lawyers in London combine regulatory, technology and disputes experience so that clients get advice that works in the product, not just on paper. We sit within the firm's technology practice and work closely with colleagues in artificial intelligence and competition law.
Scoping and gap analysis
We map your features against the Online Safety Act, DMCC Act, UK GDPR and PECR, and produce a prioritised plan that distinguishes legal requirements from good practice.
Risk assessments and codes
We review or help prepare illegal content and children's risk assessments, test them against Ofcom's guidance, and document any decision to depart from the codes.
Age assurance and design
We advise on choosing and contracting for age assurance, the related privacy analysis, and design choices that reduce risk for younger users.
Regulatory engagement and investigations
We handle information notices, enforcement inquiries and investigations from Ofcom, the CMA and the ICO, including privilege, document collection and written representations. Where advocacy in the higher courts is required, we instruct specialist counsel.
We also advise investors and acquirers on digital regulatory due diligence and help businesses that depend on designated platforms engage with the CMA's conduct requirements. For an initial conversation, contact our London office or browse all our practices.
Checklist for decision-makers
- Have we documented why our service is, or is not, in scope of the Online Safety Act, including any user-to-user features?
- Are our illegal content and children's assessments current, approved and reviewed before significant product changes?
- If children are likely to use the service, is our age assurance highly effective and supported by a data protection impact assessment?
- Do we know whether we are near the thresholds for a categorised service, and are we tracking Ofcom's register?
- Is there a named senior person accountable for online safety compliance, with a clear reporting line to the board?
- Do we have a playbook for responding to Ofcom, CMA and ICO information notices on time?
- Have we checked our consumer-facing practices, including reviews and pricing, against the DMCC Act?
- Are EU, Bangladeshi, Gulf and Singapore obligations aligned with the UK programme?
Experienced online safety lawyers in London can usually turn a scattered set of policies into a coherent, defensible programme within weeks. Our explainers on the Online Safety Act and age assurance are a good starting point for internal briefings.
Frequently asked questions
01Does the Online Safety Act apply to a small platform or start-up?
Yes, if the service lets users share content or interact with each other, or is a search service, and has links with the UK. There is no general small-business exemption. What changes with size is the measures Ofcom expects: the codes of practice scale recommendations according to a service's size and risk. Smaller services still need written risk assessments, effective moderation and reporting tools, and a person accountable for compliance. Some services, such as those whose only user content is comments on the provider's own content, may be exempt, but the exemptions are narrow and should be checked carefully.
02We are based outside the UK. Do we need to comply?
Probably, if you have a significant number of UK users, target the UK market, or your service poses a material risk of significant harm to people in the UK. Ofcom has opened investigations into providers based abroad and has fined an overseas provider for failing to respond to information requests. Options include full compliance, restricting certain features for UK users, or, in some cases, blocking UK access altogether. Each has commercial consequences, and geo-blocking must actually work to be effective. We help overseas clients choose a route and document it.
03What counts as highly effective age assurance?
Ofcom's guidance says age assurance must be technically accurate, robust, reliable and fair. Methods it has indicated can be highly effective include photo-ID matching, facial age estimation, open banking, credit card checks, mobile network operator checks and digital identity services. Self-declaration, general contractual age restrictions and simple payment methods that do not require the user to be an adult are not enough. The method you choose must also comply with data protection law, so pair it with a data protection impact assessment and appropriate supplier terms.
04What happens if Ofcom opens an investigation?
Ofcom will usually begin with information notices requiring documents and data by a deadline. It may then issue a provisional notice of contravention, giving the provider an opportunity to make representations, before reaching a final decision that can include a fine and requirements to take specific steps. Failure to respond to information notices is a separate breach. Early legal involvement helps with privilege, accurate responses and a strategy for remediation, which can influence both the outcome and any penalty. Decisions can be challenged on appeal or by judicial review in appropriate cases.
05How do the Online Safety Act and UK GDPR interact?
They overlap in age assurance, content moderation, profiling and the use of children's data. Online safety duties do not override data protection law, so a measure that satisfies Ofcom must still be lawful, fair and proportionate under UK GDPR. The ICO's Age Appropriate Design Code applies to many of the same services. Ofcom and the ICO coordinate and have issued joint statements. In practice, the safest approach is to run the online safety risk assessment and the data protection impact assessment together so that one design satisfies both regulators.
06What does strategic market status under the DMCC Act mean for my business?
Strategic market status is a designation the CMA can give to firms with substantial and entrenched market power in a digital activity. The CMA can then impose conduct requirements and pro-competition interventions. If your business depends on a designated platform, for example for search traffic or app distribution, the regime gives you a channel to raise concerns with the CMA and may change the terms you deal on. If you are a large digital firm, it is important to understand whether you could be investigated and what information the CMA can compel.
07Can directors or managers be personally liable?
Yes, in limited circumstances. Under the Online Safety Act, senior managers can face criminal liability where a company fails to comply with Ofcom information requests and they have not taken reasonable steps to prevent that failure. Officers can also be liable where certain offences are committed by the company with their consent, connivance or neglect. Separately, directors have general duties under company law to oversee risk. Naming an accountable individual and documenting board oversight is both a regulatory expectation and a sensible protection for those involved.
Sources and official materials
- Online Safety Act 2023 — Primary legislation on online safety duties
- Online Safety Act: explainer (GOV.UK) — Government summary of duties, penalties and timings
- Ofcom: Online safety — Codes of practice, guidance and enforcement updates
- Digital Markets, Competition and Consumers Act 2024 — Strategic market status and consumer enforcement
- Competition and Markets Authority (GOV.UK) — Digital markets and consumer enforcement
- Data (Use and Access) Act 2025 — Data protection, cookies and PECR reforms
- Information Commissioner's Office — UK GDPR, children's code and PECR
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.