Ofcom Investigates 4chan and Porn Sites Under Online Safety Act: Technical and Regulatory Implications

The UK communications regulator Ofcom has launched investigations into nine online services, including the anonymous message board 4chan and adult content provider First Time Videos LLC, under the Online Safety Act 2023. The probes focus on failures to address illegal content risks and inadequate age verification systems, with potential penalties including fines up to £18 million or service blocking in the UK¹.

Key Findings and Regulatory Framework

Ofcom’s investigations target three categories of services: anonymous platforms (4chan), adult content hosts (FTVGirls.com, FTVMilfs.com), and seven file-sharing sites (Im.ge, Krakenfiles, Nippybox, etc.). The regulator alleges these platforms violated the Online Safety Act by either ignoring statutory information requests or failing to implement mandatory safeguards against illegal content like child sexual abuse material (CSAM)².

The Online Safety Act requires platforms to conduct illegal harms risk assessments and enforce robust age verification for adult content by July 2025. Ofcom issued formal requests in April 2025, but 4chan and the file-sharing services reportedly failed to respond¹.

Technical Enforcement Mechanisms

For technical professionals, Ofcom’s actions highlight several critical enforcement mechanisms:

Service	Technical Requirement	Compliance Deadline
Adult Content Platforms	Facial scanning or equivalent age verification	July 2025
User-Generated Content Platforms	CSAM detection systems + risk assessments	Immediate
File-Sharing Services	Hash-matching for known illegal content	Immediate

The file-sharing services under investigation (Yolobit, Nippyshare, etc.) are accused of hosting CSAM while lacking content moderation infrastructure. This contrasts with larger platforms that use PhotoDNA or similar hash-matching systems².

Security and Privacy Considerations

4chan’s investigation raises questions about anonymous platforms’ ability to comply with the Online Safety Act. The site’s lack of user authentication makes content tracing difficult, a feature that has historically made it attractive for certain threat actors¹.

Age verification mandates have drawn criticism from privacy advocates. The UK requires facial recognition or credit card checks for adult sites, which could create new attack surfaces for credential harvesting if implemented improperly².

Global Context and Precedents

Similar regulatory actions are occurring in the EU, where Pornhub, Stripchat, and XVideos face investigations under the Digital Services Act (DSA). In 2024, Pornhub exited the French market rather than comply with age verification requirements².

The investigations may influence how platforms architect their compliance systems. Some adult sites have adopted geo-blocking for the UK, while others are testing decentralized storage models to avoid regulatory jurisdiction¹.