Ofcom told MPs in September 2026 that it has issued Online Safety Act fines totalling more than £7 million against 11 service providers, and its enforcement so far has mainly targeted smaller operators. One of those penalties, announced on 19 March 2026, included £50,000 against the forum 4chan for failing to carry out a suitable illegal content risk assessment. For UK websites that let visitors post content, from community forums to customer review sections, the question is whether these duties apply to them.
This article summarises the rules for general information. It is not legal advice, and borderline cases should be checked with Ofcom's guidance or a solicitor.
Key takeaways
- Most brochure sites, shops with reviews of their own products and blogs with comments on their own posts are likely exempt as limited functionality services.
- A forum, marketplace, user uploads or member-to-member messaging probably makes your site a regulated user-to-user service, whatever its size.
- Services in scope should already have an illegal content risk assessment, which was due by 16 March 2025.
- Ofcom fined 4chan £50,000 for failing to assess illegal content risk, showing that a missing assessment is a breach in its own right.
What happened
The Online Safety Act 2023 became law on 26 October 2023, and its duties have been switched on in stages. According to the GOV.UK explainer, the key dates for user-to-user services were:
| Date | Milestone |
|---|---|
| 16 March 2025 | Deadline for illegal content risk assessments |
| 17 March 2025 | Ofcom able to enforce the illegal content duties |
| 16 April 2025 | Deadline for children's access assessments |
| 24 July 2025 | Deadline for children's risk assessments (where a service is likely to be accessed by children) |
Those deadlines have passed, so any service in scope should already have its assessments done. Fines can reach £18 million or 10% of qualifying worldwide revenue, whichever is greater.
Enforcement is now active. On 19 March 2026 Ofcom fined 4chan's operator £520,000 in total: £450,000 for failing to use effective age checks on pornographic content, £50,000 for failing to assess the risk of illegal material, and £20,000 for not explaining in its terms of service how it protects users. In May 2026 Ofcom fined an online suicide forum £950,000 and applied to a court to restrict UK access to it, the first use of that power. At a parliamentary hearing reported by The Register on 17 September 2026, Ofcom said most fines had not yet been paid, and that it had around 40 formal investigations covering more than 100 services.
Who the Act covers
The Act regulates "user-to-user" services, meaning online services where content generated, uploaded or shared by one user can be encountered by another, plus search services. The GOV.UK explainer lists social media, video-sharing, forums, dating and messaging services. Size is not an exemption: a small hobby forum with UK users can be in scope.
The important carve-out for ordinary business websites is in Schedule 1, paragraph 4, which exempts "limited functionality services". A service is exempt if users can only:
- post comments or reviews on provider content (content you, the business, publish);
- share those comments or reviews on another site;
- react with likes, dislikes, emojis, yes/no votes or star ratings;
- identify content linked to those activities.
In practice this means:
| Feature on your site | Likely position |
|---|---|
| Reviews of products you sell yourself | Usually exempt under paragraph 4 |
| Comments under your own blog posts | Usually exempt, if users comment on your content only |
| Star ratings and likes on your content | Usually exempt |
| A community forum where customers start threads | Likely in scope |
| Reviews of third-party sellers on a marketplace | Likely in scope |
| User profiles, image uploads or member-to-member messaging | Likely in scope |
| A staff-only intranet or internal tool | Exempt as an internal business service (paragraph 7) |
Where your users can reply to each other's comments, or post content that is not about your content, the position becomes less clear. Schedule 1 says user-generated content does not count as provider content.
What this means for UK businesses
Most UK small business websites, such as brochure sites, online shops with product reviews and blogs with comments on their own posts, are likely to fall within the limited functionality exemption. They do not need an Online Safety Act risk assessment for those features.
The picture changes when you add a forum, a customer community, a marketplace or any feature that lets users publish to each other. Then you are probably running a regulated user-to-user service and should have completed an illegal content risk assessment by 16 March 2025. If children are likely to use it, the children's access and risk assessments apply too. The GOV.UK explainer says smaller services with limited functionality are not expected to take the same steps as the largest platforms, but a written, reasonable risk assessment and a way to remove illegal content are the baseline. 4chan's £50,000 risk assessment penalty shows Ofcom treats a missing or inadequate assessment as a breach in its own right.
What to do now
- Map every place users can post. Include comments, reviews, Q&A widgets, forums, image uploads and member messaging, and plugins you may have forgotten about.
- Test each feature against Schedule 1. If users can only comment on or rate your own content, record why you believe the exemption applies.
- If you are in scope, complete or review your risk assessments. Document the illegal content risk assessment and, where relevant, the children's access and risk assessments. Ofcom publishes guidance and tools for smaller services.
- Set up reporting and takedown. Give users a clear way to report content and make sure someone reviews reports promptly.
- Update your terms of service. Explain how you deal with illegal content; 4chan was fined partly for not doing this.
- Remove features you do not need. An unused forum or open comment section adds legal and security risk. Our WordPress security checklist covers locking down plugins, and you can run a free website audit with MakeItFlow to check security headers, TLS and exposed files on the site that hosts your community.
MakeItFlow does not assess Online Safety Act compliance. If you do run a forum, reviews or a comment section, though, it can check the security basics of the site that hosts it, such as the TLS certificate, security headers and exposed configuration files, with a free website audit.
Frequently asked questions
Do product reviews on my online shop bring me under the Online Safety Act?
If customers can only review products you sell yourself, the limited functionality exemption in Schedule 1 is likely to apply. Reviews of third-party sellers on a marketplace are a different matter and are likely in scope.
Is my small forum too small for Ofcom to care about?
No. The Act applies regardless of size, and Ofcom's enforcement so far has mainly targeted smaller operators. The duties are proportionate, though, so a small, low-risk forum is expected to take simpler measures than a large platform.
What if I missed the 2025 deadlines?
Complete the relevant assessments as soon as possible and keep a record of when and how you did them. If you are unsure whether you are in scope, check Ofcom's guidance or take legal advice.
Sources
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
