Online Safety Laws Have Yet to Cut Children’s Exposure to Harmful Content, Ofcom Finds

Britain’s landmark online safety laws have yet to reduce the share of children encountering harmful content on social media, according to the first statutory review by the regulator Ofcom. In a finding the watchdog itself described as concerning, the review found no significant overall change in children’s exposure during the first nine months after the Online Safety Act’s children’s safety duties came into force in July 2025.

The review, published on 22 October 2026 under section 63 of the Online Safety Act 2023, is Ofcom’s first formal assessment of content harmful to children. It draws on a tracking survey of children aged eight to 17, an online insights panel, platform data and research with children in all four nations of the United Kingdom. Its central conclusion is blunt: according to Ofcom, “at a total level there was no significant change in the proportion of children encountering harmful content over the first nine months after the children’s safety duties came into force in July 2025.”

Most children in the UK told researchers they had encountered at least one piece of harmful content online within a four-week period. The review also found no new evidence that the severity of the harm children experience had changed since the duties began. Children continued to report that encountering such material damaged their wellbeing, and Ofcom said exposure “can have serious impacts on children’s mental and physical wellbeing.”

The figures behind that headline are stark. According to the PA news agency’s reporting of the review, 14 per cent of children aged 11 to 17 said they had been exposed to suicide or self-harm content in the previous four weeks, while 23 per cent said they had seen eating disorder content and 49 per cent said they had been exposed to hate content. In March and April 2026, according to a summary of the review, 49 per cent of 11- to 17-year-olds reported encountering hate content, 42 per cent reported body stigma content and 23 per cent reported depression content in the previous four weeks.

Children also described encountering graphic and extremely violent material on regulated services, including gore and footage of real-life violence. Some told researchers they had been affected after seeing footage of the death of the conservative activist Charlie Kirk, who was shot in September 2025. Around half of teenagers exposed to weapon-related content said it made them feel less safe in their school or neighbourhood, according to PA.

Feeds, not searches, drive the exposure

One of the review’s most important findings concerns how children come across this material. Across several categories, children most commonly said they encountered harmful content through personalised feeds — the “for you” recommendation systems that decide what appears next — rather than by searching for it. Comments, direct messages, group chats and online games also played a role, but the feed was repeatedly identified as the main route.

According to the Guardian’s reporting of the review, children most commonly reported encountering pornographic content through personalised feeds, and girls in particular reported feeling confused or upset after seeing such material. Suicide and eating disorder content was also driven mostly through personal feeds, with girls most likely to encounter both types of material.

The review also traced a pathway affecting boys and young men. According to the Guardian, Ofcom found that “young men and boys consuming motivational and self-improvement content can rapidly become exposed to more extreme content which includes the promotion of misogyny and racism.” Misspelled hashtags and coded language are often used to bypass content moderation systems that would otherwise block harmful misogynistic material, the review found.

Ofcom also examined newer routes into harm. Its testing found that generative AI search services could return harmful content, including depression and body stigma material, in a small proportion of queries — though the regulator cautioned that the testing used application programming interfaces and should not be treated as a direct measure of children’s real-world use of AI services.

Ofcom’s recommendation: upgrade two categories

Alongside the exposure findings, the review makes a single main recommendation. Ofcom advises that body stigma content — material that shames or stigmatises body types or physical features — and depression content — material that promotes depression, hopelessness and despair — should be moved from the category of “non-designated” harmful content into “priority content” under the Act.

The distinction matters. At present, services’ duties in relation to non-designated content depend on whether they identify the relevant harm in their own children’s risk assessments. Priority status would put body stigma and depression content on the same statutory footing as harms already listed in the Act, including bullying, hate content, serious violence and dangerous challenges. Ofcom said the evidence of harm from these two categories, particularly from repeated and cumulative exposure, was now sufficiently established to justify the change. It did not recommend any other changes to the categories at this stage.

The decision now rests with the Secretary of State for Culture, Media and Sport, Lisa Nandy, to whom Ofcom has sent the report. If the recommendations are accepted, Ofcom will update the relevant regulatory guidance, and it plans to publish a revised Children’s Register of Risks by January 2027.

Ofcom was careful to define what the review does and does not do. It does not assess whether individual providers are complying with their duties, nor does it evaluate the effectiveness of the measures in its Protection of Children Codes of Practice. It also does not cover harm caused directly by features and functionalities, including AI, harmful contact or illegal content. That caveat is important: the review measures what children experience, not whether any single company broke the rules.

The regulator also noted limits in its own evidence window. According to the Guardian, Ofcom said its data did not cover the period from this spring, when it stepped up pressure on Facebook, YouTube, Snap, Roblox and TikTok over child safety issues. It recorded some reductions in harmful content on platforms including the games Minecraft and Call of Duty and on YouTube, Pinterest and Facebook. In July 2026 it launched an investigation into TikTok over child safety concerns, including how the platform checks whether users are adults or children.

Enforcement so far: age checks and fines

The review lands against a backdrop of enforcement activity that has so far concentrated heavily on age assurance and pornography. Ofcom says significant progress has been made, including the introduction of widespread age checks, stronger protections against grooming and tougher safeguards against child sexual exploitation and abuse.

An Ofcom spokesman said: “Our report on content harmful to children clearly shows that tech firms need to go much further and faster to protect children online. This is an industry that’s been unregulated and unaccountable for more than 20 years. And so while significant progress is being made, we are under no illusion that there is much for the industry still to do. We’ve shown that tech firms that don’t comply with their duties can expect enforcement action.”

According to a compliance summary published on 22 October 2026, Ofcom had 41 investigations open under the Online Safety Act. As of 13 October, the largest fine imposed was £1.40 million, issued to 8579 LLC, which operates a user-generated pornography hosting website, after Ofcom ruled in February 2026 that the firm had failed to implement effective age checks and had failed to respond to an information request. In January 2026, Ofcom opened an investigation into X and its generative AI model Grok over the generation and sharing of sexualised images of real people without consent, and in September 2026 it issued a provisional notice against Web Prime Inc over age assurance for pornographic content.

Ofcom’s chief executive, Dame Melanie Dawes, told MPs this week: “We do not see a safety culture from these large social media companies.” The regulator is also facing legal challenges to its powers from companies including Meta, TikTok and X, and has warned that it risks being “absolutely clobbered legally by deep-pocketed individuals and firms,” according to the Guardian.

Reaction: “staggering” and “not fast enough”

Campaigners reacted to the review with anger. Ian Russell, the father of Molly Russell, who took her life aged 14 in 2017 after viewing suicide material on social media, told the Guardian the lack of progress was “staggering but sadly not surprising.” He blamed “timidity and lack of action” from the regulator and said: “It is time that Ofcom stood up for children and investigated the major flaws in TikTok and Instagram’s design features, not just small technicalities that have been their focus so far.”

The findings come a week after a coroner concluded that access to suicide-related material on TikTok may have played a significant part in the decision of Adriana Retyte, a 14-year-old pupil at Langley School in Norfolk, to take her own life in May, according to the Guardian.

The NSPCC said the findings showed children were being exposed to harmful content at an “alarming rate,” a picture it said was echoed in calls to Childline. Rani Govender, the charity’s head of child safety online, said: “Tech companies have had months to act, yet too many platforms are still built to keep children hooked with their algorithms continuing to push harmful content to their young users. We urgently need stronger action from tech companies to rein in features that drive harm to children and stop putting business interests over their safety obligations.” She added that “progress is not happening nearly fast enough.”

Linda Jardine, director of children and family services at Children First, described the report as a “stark picture of the overwhelming levels of danger that children face on screens.” She said young people supported by the charity to contribute to the review “regularly see content about pornography, suicide and self-harm” and that content relating to bullying, hate, abuse, violence, harmful substances and dangerous stunts and challenges is “everywhere.”

The under-16 ban on the horizon

The review arrives just before a major policy change. The government is preparing an Australia-style ban on social media for under-16s, due from next spring, covering platforms such as Instagram, YouTube, TikTok, Snapchat, Facebook and X, but not messaging services such as WhatsApp and Signal. Ofcom’s report itself does not address the ban; the regulator says it will shortly publish a rapid assessment of what highly effective age assurance looks like for determining whether someone is over 16.

A government spokesman said platforms needed to do more to protect children from harmful content. “That’s why we are taking bold action to strengthen protections for children from risks of harm online — banning social media from offering their services to under-16s and protecting kids from harmful functionalities like livestreaming and stranger communications on a wide range of services, including gaming services,” the spokesman said. “When it comes to children’s safety, we are not and never will be bystanders. Platforms have both a moral and legal duty to protect children and we expect them to work with us to set a new normal for future generations.”

Campaigners warned, however, that the ban must not become a substitute for enforcing the Act. Mitali Sud, a senior policy manager at Internet Matters, said: “Children will continue to face risks on services covered by the act but not the proposed ban, including gaming and messaging platforms. Sixteen- and 17-year-olds will still use social media. A social media ban cannot replace the need to make online services safer for children.”

In the UK and Ireland, Samaritans can be contacted on freephone 116 123.

Analysis: Why It Matters

Exposure is not the same as compliance — and that distinction is the whole argument

The most misunderstood sentence in this review is also its most important. Ofcom did not find that platforms broke the law, and it did not find that they complied with it either. By design, a section 63 review measures children’s lived experience of harmful content, not any company’s compliance file. That makes the headline harder for the industry to dismiss and harder for critics to weaponise in equal measure. A platform can pass an age-check audit, publish a risk assessment and still serve a feed that steadily narrows a child’s world towards body-shaming, despair or hate. Ofcom’s evidence suggests that is exactly what is happening: the machinery of compliance is moving, but the experience of childhood online is not. Any debate that treats this report as a verdict on individual companies misses its point. It is a verdict on the system the Act created — and on whether duties written in statute are reaching the screen.

The feed is the finding

Strip away the percentages and one mechanism explains almost everything in the review: recommendation. Children rarely go looking for the worst of what they see; the worst finds them, one autoplay, one “for you” card, one lightly disguised hashtag at a time. That is why the same report can record progress on age gates while recording no progress on exposure. Gates control who enters a service. Feeds control what happens once they are inside. Pornography, suicide content, eating disorder material, misogynistic extremism — all of them travel furthest through personalisation, because personalisation is engineered to learn what holds attention, and distress holds attention with terrible efficiency. Until regulation bites on recommender design itself — the ranking choices, the autoplay defaults, the coded-language evasions — the exposure numbers are unlikely to move, however many age checks are installed at the door.

Enforcement has aimed at the gate, not the algorithm

Look at where Ofcom’s enforcement energy has actually gone and a pattern emerges. The biggest fine, the provisional notices, the headline investigations: overwhelmingly, they concern age assurance for pornography and failures to answer the regulator’s questions. Those are real, winnable, measurable breaches, and they matter. But they are also the cases that least threaten the business model. Nobody’s advertising revenue depends on whether a pornography site checks ages properly. A great deal of revenue does depend on keeping a teenager scrolling through a personalised feed. Ian Russell’s complaint — that Ofcom has pursued “small technicalities” rather than “the major flaws in TikTok and Instagram’s design features” — stings precisely because the enforcement record, so far, supports it. The July 2026 TikTok investigation into child safety and age checks will be a test of whether that pattern changes, but an investigation is not an outcome, and the legal challenges from Meta, TikTok and X mean every ambitious step will be litigated.

The coming ban cannot do the Act’s job

Ministers will be tempted to present the under-16 social media ban, due next spring, as the answer to this review. It is not, for three reasons the review itself makes plain. First, the ban covers named social media platforms, while children encounter harm on gaming services, messaging apps and search as well — services the Act covers but the ban does not. Second, 16- and 17-year-olds, who report some of the highest exposure rates in the review, will still use social media lawfully. Third, a ban answers the question of access, while Ofcom’s evidence answers a question about experience: what the feed does to the children who are already on it, lawfully or otherwise. The ban may reduce the number of younger children on some platforms. It will not fix the recommender systems waiting for the children who remain. The quieter lever in this review — upgrading body stigma and depression content to priority status — may matter more in the long run, because it would force every regulated service to treat cumulative, low-level harm as a core duty rather than a risk-assessment footnote.

What to watch next

Five things will decide whether this review is remembered as a turning point or a warning ignored. First, whether Lisa Nandy accepts Ofcom’s recommendation on body stigma and depression content, and how quickly secondary legislation follows. Second, the outcome of the TikTok investigation opened in July 2026, and whether Ofcom moves from age checks to design features. Third, the next wave of exposure data covering the spring 2026 period, when Ofcom says it stepped up pressure on the largest platforms — the first dataset that could show whether tougher supervision changes the feed. Fourth, the practical shape of the under-16 ban, including Ofcom’s forthcoming assessment of what counts as highly effective age assurance. And fifth, the courts: if the legal challenges from the largest platforms succeed in narrowing Ofcom’s powers, the regulator’s warning about being “clobbered legally” will read less like rhetoric and more like prophecy. Parents, teachers and policymakers should watch all five — because the children in this survey cannot wait for the system to learn at its current pace.

Sources

• Ofcom — Report on content harmful to children (section 63 review, published 22 October 2026)
• PA via Bury Times — Online safety laws have so far not helped protect children in UK, Ofcom says (24 October 2026)
• Diplo / dig.watch — Ofcom publishes first review of content harmful to children (24 October 2026)
• MLex — UK children see as much harm online as before platform safety duties, Ofcom says (22 October 2026)