Ofcom Probes Telegram and Chat Sites Over Online Safety Act Compliance

Ofcom, the United Kingdom’s independent communications regulator, has initiated a formal investigation into several high-profile digital platforms. According to BleepingComputer, the investigation focuses on Telegram and two chat-oriented services, Monkey and Yubo, following reports that these platforms are being used for the dissemination of Child Sexual Abuse Material (CSAM). This regulatory action represents a significant escalation in the UK’s efforts to hold tech companies accountable under the recently established Online Safety Act (OSA) framework.

Ofcom Online Safety Act Enforcement and Regulatory Oversight

The investigation marks one of the first major applications of the UK’s new regulatory powers. The OSA was designed to provide Ofcom with the authority to oversee how services identify and mitigate the risks of illegal content. Under this legislation, platforms are required to implement proactive measures to prevent, identify, and remove harmful material. For Telegram, a service that has historically operated with a minimal moderation policy, this probe signals a shift in how its hands-off approach will be treated by European regulators.

The regulatory body’s concerns regarding Telegram content moderation compliance stem from the platform’s public channel and large group features. These features can be weaponized by actors who utilize specific TTP patterns to circulate illicit links and media while evading standard detection mechanisms. While the platform has recently shown some willingness to cooperate with law enforcement globally, this investigation specifically targets their adherence to systemic safety duties.

The Role of Chat Services Monkey and Yubo

While Telegram’s scale makes it a primary focus, the inclusion of Monkey and Yubo in the probe highlights the risks associated with ‘random chat’ and youth-oriented social networking. These platforms often lack the EDR or behavioral analytics seen in enterprise environments, making them attractive for predators. Ofcom has indicated that these platforms may not be doing enough to verify the age of their users or to filter out harmful content before it reaches vulnerable audiences. For these companies, the investigation is not merely about a single piece of content but rather the systemic failure of their safety architecture.

Analysis of Preventing CSAM Sharing on Messaging Platforms

From a technical standpoint, preventing CSAM sharing on messaging platforms requires a multi-layered approach. Modern platforms must balance privacy—often through end-to-end encryption—with the need for safety. When material is shared via public or semi-public channels, the regulatory expectation is that automated scanning tools and robust reporting systems are in place. Failure to maintain these systems can lead to platforms being used as a staging ground for wider malicious activities, including the distribution of links for Phishing or malware delivery.

For security professionals and compliance officers, this investigation underscores the transition of platform liability. A lack of proactive moderation is no longer legally defensible in the UK. Ofcom has the power to levy significant fines—up to £18 million or 10% of global annual turnover, whichever is higher—and, in extreme cases, can request court orders to block access to services that fail to comply with safety requirements.

Actionable Recommendations for Compliance and Safety

1. Policy Review: Organizations operating public-facing messaging or community features should review their moderation policies to ensure they align with the Online Safety Act’s ‘Safety by Design’ principles.
2. Reporting Mechanisms: Implement and test user reporting tools to ensure they are accessible and that reported content is triaged within a timeline that meets regulatory expectations.
3. Automated Detection: Deploy hash-matching technologies and known-CSAM databases (such as those provided by NCMEC or IWF) to automatically flag and remove illegal media at the point of upload or transmission in non-encrypted environments.
4. Audit Logs: Maintain detailed logs of moderation actions and safety interventions. These records are essential when responding to regulatory inquiries or demonstrating compliance during an investigation.