Nine months into the most ambitious child protection regime ever imposed on social media platforms in Britain, the proportion of children encountering harmful content is essentially unchanged. That is the central, damning finding of Ofcom’s own review of the Online Safety Act’s children’s safety duties, which came into force in July 2025. The thesis is uncomfortable but clear: landmark regulation has so far produced landmark failure.
Ofcom found “no significant change” in the proportion of children being exposed to unsafe material across user-to-user services. The regulator itself called the finding “concerning”. There was, it added, no evidence of any reduction in the severity of harm either. For a piece of legislation that passed through Parliament with near-universal political support and was sold as a generational shift in how Britain governs the internet, this is a serious indictment — not only of the platforms, but of the regulatory architecture constructed to discipline them.
The harms documented are not abstract. Children were served footage of a murder, graphic pornography, and weapon-related content that left them frightened in their own schools and neighbourhoods. Suicide and eating disorder material reached girls disproportionately through personalised recommendation feeds. Boys consuming self-improvement content were rapidly funnelled, via the same algorithmic logic, toward misogynistic and racist material. Platforms tolerated misspelled hashtags and coded language specifically designed to evade content moderation. None of this is incidental. It is structural.
The Algorithm Problem Regulators Cannot Wish Away
Ofcom’s review repeatedly identified “for you” recommendation algorithms as the primary mechanism through which harmful content reaches children. This matters enormously for the policy debate. Age verification, content labelling, and reporting tools — the suite of measures the Online Safety Act emphasises — are largely reactive. They operate downstream of the algorithmic engine that determines what a child sees in the first place. Addressing the symptom while leaving the cause intact is unlikely to produce meaningful results, and nine months of evidence now confirms as much.
The regulator is not operating in comfortable conditions. Meta, TikTok, and X have all launched legal challenges against Ofcom’s powers. Dame Melanie Dawes, Ofcom’s chief executive, told MPs this week that the watchdog risks being “absolutely clobbered legally by deep-pocketed individuals and firms.” She also observed, with notable directness, that large social media companies show no evidence of a genuine safety culture. Both statements are credible. Both are also, taken together, a portrait of a regulator that is structurally outgunned.
Ian Russell, whose daughter Molly took her own life in 2017 after viewing suicide material on social media, described the lack of progress as “staggering but sadly not surprising.” He accused Ofcom of timidity, arguing that the regulator has focused on minor technical infractions rather than the fundamental design flaws in platforms such as TikTok and Instagram. His criticism carries weight. Enforcement action against peripheral violations, while the core algorithmic architecture remains untouched, is unlikely to shift the aggregate harm figures that Ofcom’s own data now documents.
The government’s planned response — an Australia-style ban on social media for under-16s, due from next spring and covering Instagram, YouTube, TikTok, Snapchat, Facebook and X — is a political signal as much as a policy instrument. It will not apply to messaging services such as WhatsApp and Signal, nor to gaming platforms, which Ofcom’s review also identifies as vectors for harmful content. Sixteen and seventeen-year-olds will remain on these platforms regardless. The ban, whatever its merits, cannot substitute for making the platforms themselves safer.
Ofcom notes, fairly, that the data predates a more assertive enforcement phase it launched this spring against Facebook, YouTube, Snap, Roblox and TikTok, and that some reductions in harmful content were recorded on platforms including Pinterest, YouTube and Facebook. An investigation into TikTok’s age-verification practices opened in July. These are not trivial developments. But they do not alter the headline finding, and the regulator’s own caution about legal exposure suggests that sustained, systemic enforcement will remain difficult.
The deeper implication is this: Britain built a regulatory framework premised on platform compliance, and the platforms have not complied in any meaningful aggregate sense. The question now facing policymakers is whether the Online Safety Act’s instruments are sufficient to compel behavioural change from firms with vast legal resources, global operations, and business models structurally dependent on maximising engagement — including among children. The evidence from the first nine months suggests the answer is no. Adjusting that answer will require either sharper enforcement powers, structural intervention in algorithmic design, or both. Incremental pressure on willing intermediaries has not worked. It was always unlikely to.