Ofcom has fined the provider of OnlyFans, Fenix International Limited, £1.05 million for failing to accurately respond to formal requests for information about its age assurance measures on the platform.
In June 2022 and June 2023, Ofcom sought information from Fenix on the age assurance measures it had in place on OnlyFans. This included asking how the platform was implementing age checks and, specifically, about the effectiveness of OnlyFans’ third-party facial estimation technology. This was part of an information gathering exercise by Ofcom using its powers under the video sharing platform regulations that pre-date the Online Safety Act – to monitor how video-sharing platforms were keeping children safe online. The information was published in a report on Ofcom’s first year of regulating VSPs in October 2022.
As part of its submission, Fenix stated that it had directed its third-party provider to set a “challenge age” for its facial age estimation technology at 23 years old. The technology works by requiring a prospective user to upload a live selfie, which it then uses to estimate their age. If the tool estimates the prospective user’s age as being above the challenge age, they can continue to create an account on the OnlyFans platform. Any user not estimated to be above the challenge age is required to verify that they are over 18 via a secondary method.
On 4 January 2024, Fenix learned from its technology provider that the challenge age for OnlyFans was in fact set at 20 years old, not 23 years old. Fenix later confirmed it had been set to 20 since 1 November 2021. After discovering this, Fenix raised the challenge age to 23 on 16 January 2025, but changed it back to 21 years old on 19 January 2025. Fenix did not inform Ofcom about the error until 22 January 2024.
Given this disclosure and following engagement with the company to clarify the impact of the potential breach, Ofcom launched an investigation on 1 May 2024 to review whether Fenix had failed to comply with its duties to provide complete and accurate information to it. It concluded that Fenix contravened its duties to provide accurate and complete information to Ofcom in response to two statutory information requests.
Ofcom expects that robust checks are in place to ensure information is properly interrogated, crosschecked, and reviewed through appropriate channels, before it is submitted in response to a formal information request.
Its investigation raised several concerns, including that it took the company over 16 months to discover that it had provided Ofcom with inaccurate information. Ofcom said that robust fact checking processes would have meant that the incorrect submission would have come to light sooner.
Due to these failings, Ofcom has imposed a financial penalty on Fenix of £1.05 million, which will be passed on to HM Treasury. This includes a 30% reduction from the penalty it would otherwise have imposed, due to resource savings achieved through Fenix accepting Ofcom’s findings and settling the case.
Ofcom considers that the penalty is appropriate and proportionate to the contravention because Fenix is a large, well-resourced company, which is aware of its regulatory obligations. Ofcom says that with this in mind, Fenix should have taken steps to ensure the data supplied was properly reviewed and verified through appropriate governance channels before being submitted to Ofcom. The data inaccuracy undermined Ofcom’s ability to carry out its regulatory function, as it led to Ofcom publishing inaccurate data. It also caused Ofcom additional work to issue a note of correction for the error. After Fenix identified the error, it took more than two weeks to report the issue to Ofcom. While Ofcom acknowledges that Fenix ultimately self-reported the issue to it, it expects companies to inform it about any possible contraventions as soon as possible. This did not happen in this case.
The case offers a glimpse of how Ofcom might treat similar cases under the Online Safety Act 2023.
