Let’s get ready to rumble? Ofcom fines OnlyFans £1.05 million under the VSP regime

Many online service providers that fall within the scope of the Online Safety Act (OSA) have been busy this year preparing for its gradual entry into force. However, yesterday’s decision by Ofcom to fine OnlyFans provider Fenix International Limited £1.05 million, for its failure to adequately respond to age-assurance related information requests, reminds us that this is not the first content sharing regulation that online services have had to comply with. In fact, Ofcom has been investigating and holding online services accountable for their safety measures for some time, including under the video-sharing platform (VSP) regulation which was introduced in 2020. 

Although the VSP regime has been repealed and will ultimately transition into the OSA, Ofcom’s recent enforcement activity in this area is notable and perhaps lays down a marker of its intention to step up its enforcement efforts under the OSA too (once it is fully in force). 

Those tracking the OSA will of course know that Ofcom has been vocal about its enforcement plans. This was made particularly clear just last week when the regulator announced its enforcement programme to tackle child sexual abuse imagery online, with its enforcement Director Suzanne Cater noting that “any provider who fails to introduce the necessary protections can expect to face the full force of our enforcement action.”  

Details of the fine

OnlyFans is an online content subscription platform where creators can share exclusive content with their subscribers for a fee. It is widely known for allowing adult content and has implemented age assurance measures to check whether users are above 18 years old. The checks work by requiring a user to upload a live selfie, which the tool uses to estimate the user’s age. If the user is judged to be above a “challenge age” (which OnlyFans said was set at 23 years old), then an account can be created. However, if the tool determines that the user looks below 23, they are required to verify their age using a secondary method.

However, as reported by Ofcom, OnlyFans learnt (on 4 January 2024) from its technology provider that since November 2021, the tool had actually set the “challenge age” to be 20 years old and not 23 years old as it had originally claimed to Ofcom. This meant that it had taken the business over a year to discover the error with the age assurance tool.

OnlyFans then raised the “challenge age” to 23 years old on 16 January 2025, but then changed it again to 21 years old on 19 January 2025. Importantly, OnlyFans only first reported the age-gating issue to Ofcom on 22 January 2024. Ofcom therefore held that OnlyFans had contravened its duties to provide accurate and complete information to Ofcom in response to two statutory information requests under the old VSP regime, in 2022 and 2023 respectively. 

Key takeaways

So, what can we learn from this fine and Ofcom’s approach to enforcement more generally? Firstly, while the fine is under the old VSP regime and not the OSA, it suggests, as noted above, that Ofcom is willing to fine organisations that don’t take online safety compliance, and specifically requests for information, seriously. Indeed, this fine comes hot off the heels of Ofcom fining TikTok £1.875m for providing inaccurate data on safety controls to it, last year. 

The OSA provides Ofcom with very significant information gathering powers, including a general power to ask companies to provide “any information” that it requires for the purpose of exercising its online safety functions. Violation of these provisions can result in criminal liability and personal liability for senior management of such companies – so requests for information are not something to ignore! For more information on enforcement obligations under the OSA see our explainer article on enforcement here. 

Secondly, Ofcom noted that while OnlyFans ultimately self-reported the issue to the regulator, it expects companies to inform it of any possible contraventions “as soon as possible”, which it says did not happen in this case. While it seems fair to say that it should not have taken OnlyFans over a year to discover the original error with its age assurance tool, there was only a two-week gap between OnlyFans identifying the issue on 4 January 2024 and its initial report to Ofcom on 22 January 2024, suggesting that businesses should not only be auditing their age-assurance measures regularly for accuracy, but should also have a speedy process in place to report errors to Ofcom when they are found. This means that in practice reports should ideally be made within days, not weeks!

Finally, this fine shines a light on Part 5 of the OSA, which is a standalone section specifically addressing providers of online pornography services. A key obligation under this Part of the OSA is for providers to implement highly effective age verification and estimation measures. With a fine now imposed on one of the biggest adult content platforms, Ofcom  may be indicating that businesses subject to this Part of the OSA will come under scrutiny and should prepare to demonstrate that it has implemented solutions which meet OSA standards. This is especially given that in January this year, Ofcom launched its enforcement program in relation to highly effective age assurance measures to keep children off pornographic content related platforms. For more information on Part 5 of the OSA (and indeed all things online safety), please check out this page on our dedicated online safety hub, The Safety Net.