Source: Ofcom published on this website Wednesday 22 April 2026 by Jill Powell
Ofcom are investigating whether the provider of Telegram, Telegram Messenger Inc. has failed, or is failing to comply with its illegal content safety duties under the Online Safety Act 2023 in respect of Child Sexual Abuse Material.
Part 3 of the Online Safety Act 2023 (‘the Act’) imposes illegal content safety duties (‘Illegal Content Duties’) on providers of regulated user‑to‑user (‘U2U’) services. In summary, these duties require providers to operate their services using proportionate systems and processes designed to:
- prevent individuals from encountering priority illegal content – including Child Sexual Abuse Material (CSAM) – by means of the service;
- effectively mitigate and manage the risk of the service being used to facilitate the commission of a priority offence, including offences around the sharing of CSAM; and,
- minimise the length of time for which any priority illegal content is present and swiftly take it down when they are made aware of its presence.
Regulated U2U service providers can comply with the Illegal Content Duties by implementing measures recommended in Ofcom’s illegal content Codes of Practice for user-to-user services issued on 24 February 2025 (the ‘Codes of Practice’), or through alternative measures.
These duties came into effect on 17 March 2025.
Ofcom has on 21 April 2026, opened an investigation into Telegram Messenger Inc., as the provider of Telegram, to investigate whether it has failed, or is failing, to comply with the Illegal Content Duties in respect of CSAM pursuant to Section 10 of the Act.
They have gathered evidence regarding the alleged presence and sharing of CSAM on Telegram, including from their own assessment of the platform, and from the Canadian Centre for Child Protection.
Ofcom’s Online Safety Enforcement Guidance sets out how Ofcom will normally approach enforcement under the Act. This includes our approach to information gathering and analysis and the procedural steps Ofcom must take to fairly determine the outcome of the investigation.
Where Ofcom identify compliance failures, they can impose fines of up to £18 million or 10% of qualifying worldwide revenue (whichever is greater). In the most serious cases of non-compliance, and where appropriate given risks of harm to individuals in the UK, they can seek a court order to require third parties to take action to disrupt the business of the provider. This may require third parties (such as providers of payment or advertising services, or Internet Service Providers) to withdraw services from, or block access to, a regulated service in the UK.
Ofcom will provide an update on this investigation in due course.
