Daily Junction.mobi portalNews · August 14, 2025 · Daily Junction Editorial Team · 9 min
Ofcom has begun enforcing the Online Safety Act 2023, with powers to fine platforms up to £18 million or 10% of global revenue. But critics question whether the regulator has the resources, expertise, and political will to hold Big Tech accountable.
Ofcom, the UK's communications regulator, has been handed one of the most ambitious and contentious regulatory mandates in the democratic world: policing social media platforms under the Online Safety Act 2023. The Act, which came into force in March 2025, gives Ofcom sweeping powers to fine platforms up to £18 million or 10% of global revenue for failing to protect users from illegal and harmful content. It is the UK's attempt to bring Big Tech under democratic control, ending the era of self-regulation and forcing platforms to take responsibility for the harms they enable.
But can Ofcom actually do this? The regulator has approximately 350 staff working on online safety, facing off against companies like Meta, Google, and TikTok that employ tens of thousands of engineers and content moderators and have legal budgets that dwarf Ofcom's entire annual funding. Early enforcement has been cautious, focusing on illegal content removal rather than the systemic issues—algorithmic amplification, addictive design, misinformation—that critics say are the real harms. And tech platforms have already signalled they may restrict UK services rather than comply with transparency requirements they consider commercially sensitive.
The question is whether Ofcom has the resources, expertise, and political backing to hold Big Tech accountable—or whether the Online Safety Act will prove to be another example of ambitious legislation undermined by weak enforcement.
The Online Safety Act 2023 is one of the most comprehensive attempts by any democracy to regulate social media. It places legal duties on platforms to:
Platforms must conduct regular risk assessments, publish transparency reports, and demonstrate to Ofcom that they are taking "proportionate measures" to mitigate identified risks. Ofcom has the power to demand internal data, audit algorithmic systems, and impose fines for non-compliance.
The Act applies to any platform with over 1 million UK users, covering Meta (Facebook, Instagram, WhatsApp), Google (YouTube), X (formerly Twitter), TikTok, Snapchat, Reddit, Telegram, and dozens of smaller services.
Ofcom's online safety division has approximately 350 staff and an annual budget of around £90 million for this function. This sounds substantial until you compare it to the scale of the platforms it must regulate.
Meta employs over 40,000 content moderators globally and spends an estimated $5 billion annually on safety and security systems. Google has similar resources. TikTok, despite being smaller, employs over 10,000 moderators. These companies have armies of engineers, data scientists, lawyers, and policy experts dedicated to content moderation and regulatory compliance.
Ofcom, by contrast, must regulate all of these platforms—plus dozens of smaller ones—with a staff that is a fraction of the size of a single platform's safety team. The regulator has hired technical experts, but it lacks the deep engineering expertise to audit complex algorithmic systems or the legal firepower to fight prolonged court battles against companies with effectively unlimited resources.
Critics argue this is a fundamental mismatch. "Ofcom is being asked to regulate some of the most powerful and technically sophisticated companies in the world with a budget smaller than a mid-sized tech startup," said one former regulator. "It is not a fair fight."
Ofcom's response is that it does not need to match platforms' resources because it can compel disclosure, hire external auditors, and impose fines large enough to force compliance. But this assumes platforms will cooperate, that external auditors can understand proprietary systems, and that fines will be enforced—none of which is guaranteed.
Ofcom's enforcement to date has been cautious. The regulator began by requiring platforms to submit risk assessments and safety policies, which are being reviewed on a rolling basis. Information requests have been sent to major platforms, asking for data on content moderation volumes, algorithmic amplification, and user complaints.
But as of August 2025, no fines have been issued. Ofcom has indicated that formal enforcement will begin once the initial compliance period ends in late 2025, and that early actions will focus on clear-cut failures—such as platforms that fail to remove child sexual abuse material or do not have basic age verification for pornography.
What Ofcom has not done is tackle the systemic issues that many critics see as the core harms of social media: algorithmic amplification of misinformation, addictive design features, and business models that profit from engagement regardless of social cost. These are harder to regulate because they are not about specific pieces of content but about how platforms are designed and operated.
Ofcom has published guidance on algorithmic transparency, requiring platforms to explain how their recommendation systems work and what they optimise for. But platforms have resisted, arguing that algorithmic details are commercially sensitive and that disclosure would allow bad actors to game the system. Ofcom has not yet forced the issue, leading critics to question whether it ever will.
Tech platforms have not passively accepted regulation. Several have threatened to restrict UK services rather than comply with requirements they consider unreasonable or commercially damaging.
Meta has warned that end-to-end encryption on WhatsApp and Messenger may be incompatible with the Online Safety Act's requirements to scan for child sexual abuse material, and that it may withdraw encrypted services from the UK rather than weaken encryption globally. Privacy advocates support Meta on this point, arguing that client-side scanning (the proposed solution) would undermine encryption and create security vulnerabilities.
X (formerly Twitter) has been more openly hostile. Elon Musk has described the Online Safety Act as "Orwellian" and suggested that X may limit UK operations rather than comply with transparency requirements. While this is likely bluster—the UK is too large a market to abandon—it signals that platforms will fight regulation aggressively.
Smaller platforms, particularly those based outside the UK and EU, may simply ignore Ofcom's requirements, calculating that the regulator lacks the resources to pursue enforcement globally. Ofcom can seek court orders to block non-compliant platforms, but this is politically and technically difficult, and risks accusations of censorship.
One of the most contentious aspects of the Online Safety Act is its treatment of encrypted messaging. The Act requires platforms to prevent the sharing of child sexual abuse material, even on end-to-end encrypted services like WhatsApp, Signal, and iMessage.
The problem is that end-to-end encryption, by design, prevents anyone—including the platform—from seeing message content. The only way to detect illegal material on encrypted services is to scan messages before they are encrypted (client-side scanning) or to weaken encryption by creating "backdoors" for law enforcement.
Both approaches are opposed by privacy and security experts, who argue that client-side scanning is technically flawed, easily circumvented, and creates vulnerabilities that hostile states and criminals will exploit. Weakening encryption, they argue, would undermine the security of billions of users to catch a small number of offenders.
Meta, Apple, and Signal have all said they will not implement client-side scanning and will withdraw encrypted services from the UK if required to do so. This puts Ofcom in an impossible position: enforce the law and lose encrypted services that protect journalists, activists, and ordinary users, or back down and be accused of failing to protect children.
The government has insisted that the Act does not ban encryption and that technical solutions exist. But as of mid-2025, no such solution has been demonstrated, and the standoff continues.
For the Online Safety Act to succeed, Ofcom would need to:
This is a tall order. Ofcom is a regulator that has historically focused on broadcasting and telecoms, not global tech platforms. It has a culture of negotiation and consensus-building, not aggressive enforcement. And it operates in a political environment where the government is wary of being seen as anti-innovation or hostile to business.
The risk is that the Online Safety Act becomes another example of ambitious legislation that looks tough on paper but is undermined by weak enforcement, industry resistance, and regulatory capture. Platforms submit risk assessments, publish transparency reports, and make minor changes to content moderation policies, but the fundamental business model—maximising engagement through algorithmic amplification of divisive content—remains untouched.
The UK is not the only country trying to regulate social media. The EU's Digital Services Act (DSA), which came into force in 2024, imposes similar requirements on platforms, with the European Commission as the primary enforcer for the largest platforms. The DSA has more resources and a larger market to leverage, but it faces similar challenges around enforcement, encryption, and platform resistance.
Australia, Canada, and several US states have also introduced online safety legislation, though none as comprehensive as the UK or EU. The global trend is toward greater regulation, but the effectiveness of these laws remains unproven.
The advantage of the UK acting alongside the EU is that platforms cannot easily ignore two of the world's largest markets. If the UK and EU coordinate enforcement and share intelligence, they have more leverage. But if they diverge—or if platforms successfully play regulators off against each other—the impact will be diluted.
![[View image]](/img/ofcom-social-media-regulation-2025.jpg){kind=link}