Ofcom Category 1 Duties and UK Traffic 2026

TL;DR. Ofcom published its Register of Categorised Services on 10 July 2026 and named eleven Category 1 services: Facebook, Instagram, Pinterest, Quora, Reddit, Roblox, Snapchat, TikTok, WhatsApp, X and YouTube. Those are the platforms your creators farm for free UK traffic. Category 1 status triggers the heaviest duties in the Act, including user empowerment under section 15 and identity verification under section 64. The one that touches your reach is the feature letting a UK adult filter out non-verified users, defined as any individual, inside the United Kingdom or outside it, who has not verified their identity to that platform. Your creators' promotion accounts are non-verified. None of it ships yet: the consultations close at 5pm on 2 October 2026 and Ofcom has committed to final versions by mid-2027 at the latest. This is educational information, not legal advice.

Every other page ranking for this is a law firm explainer written for platform legal teams. You do not run a platform. You run traffic across eleven of them, and your UK audience may soon be handed a switch that turns your accounts off.

What Ofcom Published on 10 July 2026

The register landed on 10 July 2026, about a year later than Ofcom first planned. The slip traces to the Wikimedia Foundation's legal challenge to the categorisation regulations, which concluded in August 2025. 10 July 2026 is the date to cite.

Several things landed together. The Register of Categorised Services, naming every service Ofcom has assessed as meeting a Category 1, Category 2A or Category 2B threshold condition. The list of emerging Category 1 services, naming services close to the line. A consultation titled "Giving users more choice, control and trust in their online experience", carrying a draft Additional Duties Code of Practice for Category 1 Services plus accompanying volumes and draft guidance. And, the same day, a separate consultation on a draft fraudulent advertising code aimed at Category 1 and Category 2A services. Both close on the same date.

The thresholds come from the Online Safety Act 2023 (Category 1, Category 2A and Category 2B Threshold Conditions) Regulations 2025, not from Ofcom's discretion. A service is Category 1 if the user-to-user part has an average of more than 34 million monthly active United Kingdom users and uses a content recommender system, or more than 7 million with a recommender system plus a functionality letting users forward or share user-generated content. Category 2A is a search engine above 7 million monthly active UK users. Category 2B is a user-to-user service above 3 million monthly active UK users that offers direct messaging.

Ofcom issued provisional decisions to providers in March 2026 and gave them a written representations window before finalising. Section 96 of the Act, the duty to maintain the register, lets a provider request at any time that Ofcom remove entries relating to its service, and obliges Ofcom to reassess and update when a service or the regulations change. It is a live document, not a stone tablet.

This runs in a different direction from the enforcement you already track. The fines conversation, covered in our read of Ofcom age verification fines and where agencies are exposed, is about duties landing on adult sites. This is duties landing on the mainstream platforms you use for free.

The Eleven Category 1 Services Are the Agency Traffic Stack

Read the list as a media plan rather than a legal annex.

Facebook, Instagram, Pinterest, Quora, Reddit, Roblox, Snapchat, TikTok, WhatsApp, X and YouTube. Eleven services, five corporate parents doing most of the work.

Strip out Roblox and Facebook and you are left with almost exactly the funnel a competent OnlyFans agency runs: short form on TikTok and Instagram, forum posting on Reddit and Quora, timeline posting and replies on X, evergreen search on Pinterest and YouTube, and Snapchat as a conversion surface. Nine of the eleven carry adult traffic for somebody on your roster.

The more useful observation is about who is absent. Telegram does not appear anywhere on the register. Neither does Bluesky. Neither does OnlyFans, and neither does Fansly. The surfaces you have been migrating toward as the mainstream platforms tightened are the surfaces Ofcom has not categorised. That is not a loophole and it is not permanent, because section 96 requires Ofcom to keep the register updated and it can assess and add services in later rounds. But while the Category 1 codes are still in consultation, the asymmetry is real.

Pornhub sits on the register as Category 2B, caught by the direct messaging threshold, so part of the tube tier is categorised even though it escaped the Category 1 package. Discord and Twitch are Category 2B as well, which means transparency and accountability obligations rather than the user empowerment tooling. If you are still rerouting UK discovery after the shutdown of X Communities, put the categorisation map next to that plan.

Which Category 1 Duties Bite Now and Which Are Still Draft

Here is where the coverage gets sloppy, so be precise.

Sections 15 and 16 of the Act, the user empowerment duties, have been in force since 10 January 2024, commenced by SI 2023/1420. They have simply never applied to anything, because by their own terms they apply only in relation to Category 1 services, and until 10 July 2026 there were no Category 1 services. The register did not create the duties. It created the population.

What is genuinely unfinished is Ofcom's implementation layer. The 10 July package covers the additional duties on user empowerment, user identity verification, terms of service and complaints, news publisher content, journalistic content and content of democratic importance, plus freedom of expression and privacy impact assessments, with fraudulent advertising handled in its own parallel consultation. Transparency reporting runs on a separate track again: Ofcom issues transparency notices to categorised services after publication, with the first reports expected in summer 2027.

For an agency owner the commencement mechanics are not the useful question. When the toggles appear in the product is, and that is governed by the code of practice rather than the statute. Ofcom has committed to final versions by mid-2027 at the latest, and earlier where it can. Plan on tooling shipping during 2027, built globally rather than fenced to UK accounts, and do not let anyone tell you the feature exists today.

User Empowerment Duties in Plain Terms

Section 15 sets out two separate duties that get collapsed into one headline and should not be.

Duty one, content controls. A duty to include features adult users may apply if they wish to increase their control over certain content, to the extent that it is proportionate to do so. Those features must either reduce the likelihood of the user encountering that content or alert the user to it, be available to all adult users and easy to access, and be described in the terms of service.

The default prompt is the part product teams will feel. Section 15(5) requires a system that offers every registered adult user the earliest possible opportunity to keep or change the default setting for each control feature. Section 16(6) extends that to all registered adult users, not just those who join after the duty begins. A Category 1 service has to walk its entire existing UK adult base through a choice screen for every control feature it ships.

Duty two, filtering out non-verified users. Section 15(9) is a duty to include features which adult users may apply if they wish to filter out non-verified users. Section 15(10) says those features must effectively prevent non-verified users from interacting with content that the filtering user generates, uploads or shares, and reduce the likelihood of that user encountering content that non-verified users generate, upload or share.

Put the two side by side and notice the drafting. Subsection (2) is qualified by "to the extent that it is proportionate to do so". Subsection (9) carries no proportionality qualifier at all. The anonymity filter is written harder than the content filter.

Content Filters Cover Three Harms, and Adult Content Is Not One

The single most common misreading in owner chats this month is that Ofcom is about to force a "hide adult content" switch onto every UK feed. It is not, and section 16 is unambiguous about why.

Section 16(2) applies the control feature duty to regulated user-generated content within subsections (3), (4) or (5). Subsection (3) is content that encourages, promotes or provides instructions for suicide, an act of deliberate self-injury, an eating disorder or behaviours associated with one. Subsection (4) is abusive content targeting race, religion, sex, sexual orientation, disability or gender reassignment. Subsection (5) is content inciting hatred against people with those characteristics.

Sexual content is not on that list. Nudity is not on that list.

That does not mean UK adult reach is safe. It means the pressure arrives through a different pipe: the children's access duties, the Part 5 pornography provisions, age assurance, and each platform's own policy, which is the terrain covered in our breakdown of Reddit age verification and adult promotion. Aim your compliance attention at the correct mechanism. The Category 1 user empowerment package is keyed to anonymity and to three specific harms, not to nudity.

The Non-Verified User Filter Is the One That Reaches You

Now the sentence worth reading twice. Section 16(7) defines a non-verified user as a user who is an individual, whether in the United Kingdom or outside it, and who has not verified their identity to the provider of a service.

Whether in the United Kingdom or outside it. The filter is switched on by a UK adult, but what it catches is verification status, not geography. A creator posting from Los Angeles, a chatter in Manila, a promotion account run from your office in Warsaw: all non-verified users unless that specific platform has verified them.

Section 64 sits on the other side of the same coin. A Category 1 provider must offer all adult users the option to verify their identity where verification is not already required for access. The process may be of any kind and, in the Act's words, "it need not require documentation to be provided". Terms of service must explain how it works. It applies to all adult users, not just new ones, and only to the user-to-user part of the service and its design, operation and use in the United Kingdom.

Nobody is forced to verify. There is no mandatory real name policy for UK social media, and a creator who declines breaks no law. What changes is that declining now carries a distribution cost, because a UK adult who applies the filter stops seeing her and stops letting her reply.

Two things nobody can tell you yet, so do not let anyone sell you a number. What proportion of UK adults will verify, and what proportion will apply the filter. The section 15(5) forced choice prompt is written around control features, which the Act ties to the section 15(2) content features, so on the current drafting the non-verified filter may not get the same mandatory prompt. Uptake is the entire commercial variable and it is unmeasured.

Platform by Platform: Where UK Reach Could Move

Model it per surface rather than as one number.

Reddit. Categorised as a discussion forum. The whole outbound model there is unverified accounts posting into large rooms, so a filter that reduces the likelihood of encountering content from non-verified users is aimed squarely at that behaviour. Reddit's UK age checks run through a third party age assurance vendor rather than an account-level identity system it owns, so a section 64 verification option would likely mean building something new.

X. Its paid subscription badge signals a paid, phone-verified account rather than a check of legal identity, though X has layered optional document based verification on top for some users. Whether any of that satisfies section 64 is exactly the question the consultation resolves. If the final guidance says a paid tier can qualify, buying subscriptions for creator accounts quietly becomes a UK reach purchase rather than a vanity one.

Instagram. Meta already runs a paid subscription tier built on a government identity document check in the markets where it is offered, so it has more of the plumbing than anyone else on the list. Meta is also the platform most willing to act on account clusters, the risk documented in our piece on Instagram linked account ban sweeps. Verifying identity across a creator's account estate has consequences well beyond Ofcom.

TikTok. Discovery is recommender driven, so "reduce the likelihood of encountering content from non-verified users" translates to a For You page filter. That is potentially the largest single reach effect on the list, and the hardest to detect, because you will see a UK share decline with no policy notice attached.

Snapchat, Pinterest, Quora and YouTube. Lower volume for most rosters, same mechanic. Pinterest and YouTube matter disproportionately for evergreen search traffic, the slowest kind to rebuild. WhatsApp is the oddest entry on the list, a messaging service in Category 1 with no obvious feed to filter.

Surfaces off the register are untouched by this package, which is why the funnel design in our note on Bluesky age verification and the adult funnel is worth revisiting with the register in hand.

DM Deliverability and the Verified-User Problem

Direct messages are where this gets genuinely uncertain, so treat what follows as a question to monitor.

Section 15(10)(a) requires the filter to prevent non-verified users from interacting with content that the filtering user generates, uploads or shares. Whether a direct message counts as interacting with that user's content is not obvious on the face of the statute. A DM is content in the Act's broad sense, but it is not usually an interaction with something the recipient posted. The draft code and the user empowerment volume of the consultation are where that line gets drawn.

If the answer reaches DMs, cold outreach from unverified accounts to UK recipients degrades on Instagram, X and Snapchat at once, and every welcome sequence that depends on a fan replying from a mainstream inbox loses a slice of its UK base. If it stops at replies, mentions and comments, the damage stays in discovery rather than conversion.

Either way, the structural lesson is one agencies keep relearning: a funnel whose conversion step sits in a mainstream platform inbox is renting a step it does not control. Move the commitment point to an owned surface, a link in bio, an email capture, a broadcast channel, or the platform where the money already lives.

The Timeline, and What to Change Before the Codes Land

Four dates for the calendar. 10 July 2026, register published and the additional duties consultations opened. 5pm on 2 October 2026, consultations close. Mid-2027 at the latest, and earlier where possible, is when Ofcom says it will publish the final versions. Then whatever implementation runway the code sets after that.

That is a prep window, not an emergency, and prep windows reward instrumentation over reaction.

Measure UK share per creator per platform this week. Impressions, clicks, subscriptions and revenue, split by country. If your reporting cannot produce a UK number today, that gap is the finding: without a 2026 baseline you cannot attribute a 2027 decline to anything.

Stress test the roster. For each creator, what happens to monthly new subscribers if UK-sourced discovery on the eleven Category 1 services falls by a quarter, then by half. Practitioner experience puts UK share in the low tens of percent for most English-language rosters, but treat that as a working assumption and replace it with your own data.

Decide your verification policy before you need it. Which accounts would you ever verify, whose legal identity would be attached, and who holds that decision. The answer should be the creator, in writing, with no pressure from you. An agency that quietly verifies a persona account under a staff member's identity has created a problem it will not enjoy explaining.

Respond to the consultation. It is open to anyone until 5pm on 2 October 2026. Adult sector operators almost never file, which is why the resulting codes rarely account for how this industry works.

Diversify UK discovery toward surfaces that are not categorised, while remembering that the register updates. This is the same displacement logic already playing out in Europe, mapped in our piece on EU DSA charges against adult platforms and traffic displacement.

Do not reprice, do not warn creators that their reach is about to collapse, and do not buy verification on speculation. Nothing has shipped. Announcing a decline that may never arrive costs trust you will want in 2027.

This is educational information about a developing UK regime, not legal advice, and several readings above interpret draft material rather than settled law. If your agency has UK entities, UK creators or material UK revenue, take the specifics to a solicitor who works on the Online Safety Act. WhaleFinders works white-label as the marketing direction arm inside OnlyFans agencies, from 349 dollars per creator per month for a single channel up to 799 dollars for omni channel, and never posts, chats or touches creator accounts, so what we help owners build here is the measurement layer. We are on Telegram at t.me/whalefindersupport.

Frequently Asked Questions About Ofcom Category 1

What are Ofcom's Category 1 services?

Eleven services are named on the Register of Categorised Services published on 10 July 2026: Facebook, Instagram, Pinterest, Quora, Reddit, Roblox, Snapchat, TikTok, WhatsApp, X and YouTube. A service qualifies if the user-to-user part exceeds 34 million monthly active UK users and uses a content recommender system, or exceeds 7 million monthly active UK users with a recommender system plus content forwarding or sharing. Category 1 carries the heaviest additional duties in the Online Safety Act, including user empowerment and user identity verification.

When do Ofcom's user empowerment duties actually apply?

Sections 15 and 16 have been in force since January 2024 but applied to nothing until Category 1 services existed. What is still unfinished is Ofcom's implementation layer: the draft Additional Duties Code of Practice for Category 1 Services and its accompanying guidance are out for consultation until 5pm on 2 October 2026, and Ofcom has said it will publish final versions by mid-2027 at the latest. Expect the actual product features during 2027, not this year.

Will UK users be able to hide adult content on Category 1 platforms?

Not through this duty. Section 16 limits the content control features to three categories: content encouraging or promoting suicide, deliberate self-injury or eating disorders; abusive content targeting race, religion, sex, sexual orientation, disability or gender reassignment; and content inciting hatred against those groups. Sexual content is not on the list. Pressure on adult reach comes from age assurance, the children's access duties and platform policy instead, which are separate regimes with separate timelines.

Does the non-verified user filter apply to creators outside the UK?

Yes, on the face of the Act. Section 16(7) defines a non-verified user as an individual, whether in the United Kingdom or outside it, who has not verified their identity to that provider. The filter is applied by a UK adult, but what it screens is verification status, not location. A creator in the United States or a chatter in the Philippines is a non-verified user for these purposes unless that specific platform has verified them.

Is OnlyFans a Category 1 service?

No. OnlyFans does not appear on the Register of Categorised Services, and neither does Fansly, Telegram or Bluesky. Pornhub does appear, as Category 2B on the direct messaging threshold, alongside services such as Discord and Twitch. Category 2B carries transparency and accountability obligations rather than the Category 1 user empowerment package. Absence from the register is not permanent: section 96 requires Ofcom to keep it updated, and it can assess and add services in future rounds.

What should an OnlyFans agency do before October 2026?

Baseline UK share of impressions, clicks and new subscribers per creator per platform, so a 2027 decline can be attributed rather than argued about. Model a quarter and a half reduction in UK-sourced discovery across the eleven services. Agree a written verification policy that leaves the decision with the creator. Consider filing a consultation response before 2 October. Do not reprice, pre-announce reach losses, or buy verification on speculation.