UK’s Online Safety: Ofcom Fines OnlyFans Provider £1.05 Million
The UK’s Online Safety Act 2023 (OSA) introduces a new legal framework to make the internet safer, especially for children. It places firm duties on online service providers to prevent and remove harmful or illegal content. A recent case involving OnlyFans demonstrates that Ofcom takes the enforcement of the OSA and other online safety regulations seriously. Fenix International Limited, the company behind OnlyFans, was fined £1.05 million for providing inaccurate information about its age verification processes.
What is the Online Safety Act?
The OSA creates new legal obligations for organisations that provide online services. These obligations require platforms to:
- take reasonable steps to protect users;
- prevent the use of their services for illegal purposes; and
- remove illegal content when identified.
The OSA marks a shift from voluntary action to enforceable duties, with Ofcom empowered as the regulator to oversee and enforce compliance. Organisations within scope must now follow strict timelines, complete required risk assessments, and implement appropriate measures based on the nature of their services. Some deadlines have already passed, and others are approaching, so affected businesses must act without delay.
Who does the Online Safety Act apply to?
The OSA applies to organisations offering certain online services accessible in the UK, even if based overseas. Your organisation is likely in scope if your service:
- Has a significant number of UK users;
- Specifically targets the UK as a market; or
- Is accessible by UK users and poses a material risk of significant harm.
If your service meets any of the above conditions, the OSA will apply if it falls into one or more of the following categories:
- User-to-user services: platforms where users can generate content, interact with others, and engage with online communities. This includes, for example, social media platforms, marketplaces, online dating services, content-sharing platforms, discussion forums, and even certain websites that offer features such as comment sections or user reviews.
- Search services: services that index or search other websites, including general-purpose search engines and more specialised comparison sites.
- Pornography providers: websites and platforms that host pornographic material.
Why was OnlyFans fined?
Fenix International Limited, the operator of OnlyFans, was fined £1.05 million by Ofcom for submitting inaccurate information regarding its age assurance practices. Specifically, Ofcom had requested details on how the platform verifies users’ ages and evaluates the effectiveness of its third-party facial estimation technology.
Fenix confirmed to Ofcom in 2022 and 2023 that OnlyFans was using facial age estimation software configured to block users under the age of 23 from accessing the platform. However, in early January 2024, the Fenix company discovered that the system had actually been set to a lower threshold (blocking only those under 20), since November 2021. Fenix reported this error to Ofcom on 22 January 2024.
As a result, Ofcom launched an investigation to assess whether Fenix had breached its legal obligations by providing incomplete or inaccurate information. The regulator concluded that it had, and imposed a £1.05 million fine. This amount included a 30% reduction from the original penalty, reflecting the resource savings achieved through Fenix’s early acceptance of Ofcom’s findings and its decision to settle the case.
The request for information was made under existing video-sharing platforms (VSPs) regulations, rules that were already in place before the OSA came into force. That means Ofcom was already exercising its enforcement powers before the OSA came into effect. Now that the OSA is in force, organisations can expect even more frequent investigations, stricter oversight, and tougher penalties. The OnlyFans case is one example and serves as a warning to other companies: Ofcom has the tools and the mandate to act.
In particular, platforms that may be accessed by children (i.e., users under 18) should take note. One of the OSA’s central duties is for services to assess the effectiveness of their age assurance systems. If there’s a reasonable chance that children could access the platform, companies will be required to comply with detailed assessments and implement relevant measures. This isn’t optional, it’s a legal requirement, and failing to comply could lead to regulatory action.
What are the risks of non-compliance?
Ofcom has a range of enforcement powers, including:
- Financial penalties of up to £18 million or 10 percent of global annual revenue, whichever is greater.
- Business disruption orders, which allow Ofcom to direct third parties, such as payment processors or app stores, to cease providing services to non-compliant platforms.
- Statutory information requests, where Ofcom can compel organisations to provide documents, undergo audits, and answer regulatory inquiries. These requests must be met accurately and promptly.
What should your organisation be doing now?
If you think the OSA might apply to your business, don’t wait. Here’s what to focus on:
- Check if you’re in scope, and if you’re not sure, get legal advice.
- If it does apply to your services, begin conducting the required risk assessments immediately and implement appropriate controls. Some deadlines have already passed, and any outstanding actions should be prioritised.
- Keep your risk assessments up to date to reflect changes in your services, user demographics, or updated Ofcom guidance.
- Assess your internal capacity to handle compliance. If you lack the necessary expertise or resources, consider bringing in external support.
Need help navigating the Online Safety Act?
Compliance with the Online Safety Act is complex and can be time-intensive. If you need practical support or legal guidance tailored to your organisation’s risk profile, book a free consultation with us.
Image by storyset on Freepik
