A regulator grading itself
On 15 September 2026, Oliver Griffiths, Ofcom's group director for online safety, told the House of Lords Communications and Digital Committee that Ofcom is "underwhelmed" by the Online Safety Act's overall effect so far. He said the duties for the largest categorised services will not be fully operational until around mid-2027. He also warned that without extra staff and funding, handling the government's planned under-16 social media ban alongside existing duties means "something will have to give", as City AM reported.
Regulators rarely describe their own regime this bluntly. The remark comes as the Lords committee examines how the Act is being implemented and enforced. Its inquiry asks whether the shortfall is a matter of implementation, enforcement appetite or legislative design.
The strongest case for the Act
The case for the Act is serious, and the evidence behind it is real. The Online Safety Act 2023 gave Ofcom enforceable duties over services children use, and its child protection duties began in July 2025. Ofcom's first statutory Use of Age Assurance Report, published on 15 July 2026, found that highly effective age checks work when properly deployed.
Across a sample of 32 services, more than 69 million age checks were completed in the second half of 2025. That is a 23-fold rise on the previous six months. All of the UK's ten most-visited pornography sites now run age checks, and the share of children meeting highly effective checks when asked to verify their age rose from 25% to 43% between July 2025 and January 2026. Anyone who thinks the regime has done nothing should start there.
Why the headline numbers flatter the outcome
The same report shows where the problem sits. The gains are concentrated in the pornography sector, where a small number of identifiable sites can be pressed to add a gate. The platforms children actually spend time on are a different story. Ofcom found that social media services have failed to enforce their existing minimum-age requirements, and it expressed "serious doubts" about age inference, which estimates age from behavioural signals instead of verifying it. It is also investigating TikTok over whether its age-detection technology adequately identified children.
This is the gap Griffiths described. A 23-fold increase in checks across 32 sampled companies is an activity measure. It says nothing about whether a 13-year-old's feed is safer. Children's Commissioner Rachel de Souza has reported that young people think the law has made "absolutely no difference" to their experience, and Ofcom's own admission of being underwhelmed lines up with that view.
The delay on categorised services compounds the problem. The Act sorts the largest platforms into categories carrying the heaviest transparency and user-empowerment duties. Those duties, which bear on exactly the services children use most, are not expected to be fully in force until around mid-2027, nearly four years after the Act passed in 2023.
Piling an under-16 ban onto an unfinished regime
The government's proposed under-16 restriction is where the argument turns. Its backers have a coherent case: if platforms will not enforce minimum ages voluntarily, a clear statutory line is easier to explain and enforce than a regime built on risk assessments. Ofcom says highly effective age checks "will be vital in underpinning future social media restrictions for under 16s" and has committed to give Parliament a rapid assessment of what counts as highly effective for that purpose by October 2026.
But a ban is only as strong as the age assurance beneath it, and that layer is the one Ofcom has just said is weakest on the big platforms. Griffiths told peers both initiatives are "doable" if properly resourced and sequenced, and said Ofcom plans a revised implementation roadmap by the end of the year. The risk is the condition attached: Ofcom was, in his words, already fully loaded before the ban was announced.
That is a resourcing and sequencing problem, and it should be treated as one. If Ofcom is stretched, the likely casualty is the unglamorous work: supervising the largest platforms, testing whether their age assurance functions, and publishing evidence on what works. A new headline duty will also push enforcement toward whatever is easiest to show, which tends to be the pornography sites rather than the global platforms.
What proportionate regulation looks like from here
A pro-innovation, evidence-led approach points to four priorities.
- Sequence, don't stack. Finish the categorised-services duties and show measurable outcomes for children before layering a new prohibition on the same regulator.
- Fund the work. If Parliament wants both, it should resource both. A statutory ban without capacity is a promise the regulator has already said it may not keep.
- Measure outcomes, not checks. Ofcom should publish child-exposure metrics for the largest platforms, not only counts of age checks completed.
- Keep privacy and speech costs in view. Age checks at the scale of 69 million a half-year mean more identity data in circulation and more adults gated from lawful content. Vendor accountability and data minimisation are conditions of the policy, not afterthoughts.
The Lords inquiry gives Parliament a chance to ask the question the Act's critics and defenders both need answered. Is the regime failing because the law is wrong, or because it has not yet been fully switched on and staffed? Ofcom's own testimony suggests the second, and the answer to that argues for finishing the job before expanding it.