United Kingdom

[GB] Ofcom sanctions OnlyFans provider £1.05m over age verification failings

IRIS 2025-4:1/8

Alexandros K. Antoniou

University of Essex

On 27 March 2025, the UK’s communications regulator, Ofcom, imposed a financial penalty of GBP 1.05 million on Fenix International Limited, the company behind OnlyFans, following an investigation into its age assurance practices. The penalty stems from Fenix’s failure to provide accurate and complete responses to two statutory information requests concerning its age verification systems on the adult content platform.

Following an investigation launched in May 2024 under the video-sharing platform (VSP) framework (introduced in 2020 by Part 4B of the Communications Act 2003), Ofcom determined that Fenix had twice submitted inaccurate information in response to formal data requests concerning the platform’s age assurance systems, namely tools designed to prevent access by users under 18 to restricted material, including pornography.

Specifically, the company had misrepresented the "challenge age" setting (used to flag potentially underage users) as 23, when in fact it had been set to 20. To clarify the concept of "challenge age", one might compare it to the practice used at a nightclub entrance: anyone who appears younger than a certain cautious threshold age, e.g., 23, is required to present identification before entry, whereas those clearly appearing older may enter freely. Likewise, OnlyFans’ facial estimation technology sets a similar threshold. Prospective users estimated to be younger or equal to this set "challenge age" must provide additional verification to confirm they are above the minimum age of 18. The elevated threshold is intended to catch those who may be mistakenly judged as over 18 by the technology, adding a buffer of caution to protect minors. In this case, the failings at issue affected Ofcom’s regulatory oversight and resulted in the inclusion of incorrect data in the authority’s first transparency report on VSPs in October 2022 (see IRIS 2023-1:1/18).

The investigation focused on Fenix’s compliance with duties under sections 368Y(3)(b) and 368Z10(6) of the Communications Act, which require VSP providers to supply complete and accurate information within a reasonable time frame when requested by the regulator. Ofcom concluded that Fenix had failed to meet these obligations, thereby undermining its ability to assess and report on OnlyFans’ safeguarding measures for underage users.

As a result, on 26 March 2025, Ofcom imposed a financial penalty of £1.05 million on Fenix. This figure reflects a 30% reduction in recognition of the company’s acceptance of the findings and its decision to settle the case. In assessing the severity of the penalty, Ofcom considered the prolonged duration of non-compliance, the size and resources of the provider, the impact on regulatory processes (including the additional work to issue a note of correction for the error), and the delayed reporting of the contravention (it took Fenix over two weeks to self-report the issue to Ofcom).

Previously, in February 2025, Ofcom had decided to close parts of its initial investigation, including issues relating to the implementation of age assurance measures under section 368Z1(2) of the 2003 Act and broader cooperation duties under section 368Y(3)(c) of the same. Although it is unclear why no findings on these issues were made, Ofcom has nevertheless reserved the right to reopen these lines of inquiry should further evidence arise.

Overall, although the VSP regime has now been repealed (see IRIS 2023-6:1/25) and will ultimately be superseded by the new regime introduced by the Online Safety Act 2023 (OSA), this enforcement action highlights Ofcom’s commitment to ensuring transparency and accountability in the online audiovisual environment, particularly with respect to measures aimed at protecting minors from harmful content in digital spaces. Notably, the OSA equips Ofcom with wide-ranging powers to compel the provision of information necessary for fulfilling its online safety functions, with potential criminal liability for non-compliance, including for senior management. With this in mind, the £1.05 million fine against the OnlyFans provider signals that regulated entities are expected to respond to statutory requests with accuracy and urgency.

This case also draws attention to Part 5 of the OSA, which introduces a dedicated framework for online pornography services, mandating the use of "highly effective" age assurance mechanisms. Given that Ofcom launched a targeted enforcement programme in January 2025 to evaluate such measures, the outcome of this investigation indicates a growing regulatory focus on platforms falling within this scope. Following its earlier £1.875 million sanction against TikTok in July 2024 for inadequate responses concerning its parental control safety features, Ofcom continues to show that compliance failures, especially those linked to child safety, are likely to be met with firm regulatory consequences.