Closed
Fenix International Limited, in its capacity as provider of the VSP OnlyFans
1 May 2024
26 March 2025
Investigation into whether Fenix, provider of OnlyFans, failed to provide complete and accurate responses to statutory information requests.
Section 368Y(3)(b) and Section 368Z10(6) of the Communications Act 2003 (the ‘Act’)
On 26 March 2025 Ofcom has issued its final decision to Fenix International Limited (Fenix) under Part 4B of the Communications Act 2003 (the ‘Act’).
Ofcom has confirmed that Fenix has contravened its duties under the following sections of the Act:
- section 368Y(3)(b): a duty to comply with a requirement for information under section 368Z10; and
- section 368Z10(6): a duty to provide information in such manner and form and within such reasonable period as may be specified by Ofcom in a demand for information under section 368Z10.
Our investigation determined that Fenix failed to provide Ofcom with accurate data on two occasions, in response to two statutory information requests, issued on 6 June 2022 and 23 June 2023. In response to each request, Fenix informed Ofcom that the age estimation ‘challenge age’ for OnlyFans was set to 23 years old, whereas it had in fact been set to 20 years old.
As a result of these failings, Ofcom has fined Fenix £1.05 million. The penalty includes a 30% reduction from the penalty we would otherwise have imposed, as a result of Fenix accepting our findings and settling the case.
In deciding the level of penalty, we took into account, among other things, that:
- the data inaccuracies had a direct impact on our regulatory work– notably hindering our ability to effectively monitor the age assurance measures in place on OnlyFans and undermining the process for making that information public;
- the incorrect data was published in Ofcom’s Year 1 VSP report - Fenix’s submission of inaccurate information in response to the 2022 Notice resulted in Ofcom publishing incorrect information in our first VSP transparency report in October 2022. The purpose of this report was to provide transparency to the industry and to the public while highlighting how VSP providers set, enforce, and test the measures they put in place to protect users;
- the contravention persisted for over 16 months – the same inaccurate information was submitted in response to two statutory information requests and it took a significant length of time to identify the error;
- Fenix is a large, well-resourced company, which is well aware of its regulatory obligations. As such, we would have expected it to take much greater care to ensure that any data submitted to Ofcom was properly interrogated, cross-checked and reviewed prior to being submitted to Ofcom;
- it took 18 days for Fenix to report the contravention to Ofcom after it was discovered. Ofcom expects to be informed of any potential contraventions as soon as possible and within as short a period as is reasonable depending on the circumstances of the case; and
- Fenix self-notified the breach to us. While we are concerned that it took Fenix 18 days to notify Ofcom about the issue, we acknowledge that Fenix proactively self-reported to us and the correct information has since been provided.
Following our consideration of the information gathered in this case, including from Fenix International Limited as the provider of OnlyFans, we have revised the scope of the investigation.
We have decided to close our investigation into whether Fenix International Limited breached its duty under Section 368Z1(2) of the Act to implement measures taken in such a way as to carry out the purpose of protecting persons under the age of 18 from encountering restricted material such as pornography. Where appropriate, Ofcom’s Supervision team will continue to engage with OnlyFans around the way it implements measures to protect children from restricted material.
We have also decided to close our investigation into whether Fenix International Limited failed to co-operate fully with Ofcom in breach of its duty under Section 368Y(3)(c) of the Act.
We are making no findings on these issues and should further information come to light, reserve our right to re-open this investigation.
The investigation continues to examine whether there are reasonable grounds to believe that Fenix International Limited has failed to comply with its duties under Section 368Y(3)(b) and Section 368Z10(6) of the Act to provide complete and accurate responses to statutory information requests.
We will update the bulletin once we’ve concluded our investigation.
Following the launch of our investigation on 1 May 2024 into Fenix International Limited as the provider of OnlyFans, we subsequently issued a statutory request for information. We have received a response to our information request and are currently reviewing the information. We will provide a further update in due course.
Ofcom has been the regulator of UK established video sharing platforms (VSPs) since November 2020 and children’s safety online is one of our top priorities. As part of our functions in this regime, we monitor how persons under-18 are protected from restricted material such as material which might impair their physical, mental or moral development.
To carry out our work in relation to this, it is imperative that we can gather accurate information about the measures put in place by regulated VSPs to protect users to enable us to report on these and monitor their effectiveness. This includes understanding systems, such as age assurance measures and software used, to help ensure that children are protected from restricted material. Ofcom may use the information we gather to prepare and publish reports under section 368Z11 of the Act.
Under section 368Z1(1)(a) of the Act, VSP providers are obliged to take such of the measures set out in Schedule 15A as are appropriate for the purposes of protecting persons under the age of 18 from videos and audiovisual commercial communications containing restricted material.
Under section 368Z1(2) of the Act, where such measures are taken, VSP providers must implement the measure in such a way as to carry out the specified purpose.
Additionally, section 368Y(3) of the Act obliges a VSP provider to:
- provide the information requested by Ofcom pursuant to section 368Z10 of the Act; and
- co-operate fully with Ofcom for any purpose mentioned in section 368Z10(3).
Where Ofcom has reasonable grounds for believing that a contravention of the above-mentioned obligations has occurred or is occurring, we may take enforcement action under section 368Z2 and 368Z3 of the Act.
Investigation
Today we have opened an investigation into Fenix International Limited, the provider of VSP OnlyFans. The investigation concerns OnlyFans’ compliance with its statutory obligations under sections 368Y(3)(b) and (c), 368Z10(6), and 368Z1(2) of the Act. Specifically, our investigation concerns OnlyFans’ requirement to:
(i) implement the age assurance measures it has taken in such a way as to protect under 18s from restricted material, including pornographic material; and
(ii) comply with two information request notices issued on 6 June 2022 and 23 June 2023 under section 368Z10 of the Act.
Among other things, these notices requested information to:
- understand and monitor the measures OnlyFans had in place, including measures to assure the age of its users, and how they were implemented to help ensure under-18 users were protected from restricted material, including pornography; and
- enable Ofcom to publish a report under section 368Z11 highlighting how OnlyFans and other VSPs are protecting under 18s from restricted material.
'Users' means anyone able to access and/or view videos on OnlyFans.
The available evidence suggests that the information provided by OnlyFans in response to the two notices may not have been complete and accurate, and that the age assurance measures it had taken may not have been implemented in such a way as to protect under 18s from restricted material.
Ofcom’s investigation will therefore examine whether there are reasonable grounds for believing that OnlyFans has failed to comply with section 368Z1(2) of the Act and/or has contravened sections 368Y(3)(b) and (c), and 368Z10(6) of the Act.
We expect to provide an update on this investigation by August 2024.
CW/01283/04/24