Sir / Madam,
Illegal Content Risk Assessment Enforcement Programme
We acknowledge the email of 31 March 2025 from your legal representatives setting out your view
that Kiwi Farms is not subject to the Online Safety Act 2023 (‘the Act’). We also note that you have
since IP blocked people in the United Kingdom (‘UK’) from accessing your service.1
Taking the latter point into account, we have decided not to proceed with issuing an information
notice requesting a copy of the written record of the illegal content risk assessment conducted in
respect of Kiwi Farms at this time.
The purpose of the Act is to protect UK users of internet services from content that is illegal in the
UK or potentially harmful to UK children. The Act requires that providers of services with links to the
UK take action to protect users based in the UK – it does not require them to take action in relation
to users based anywhere else in the world. For further information please see: Protecting people in
the UK from illegal online content – regardless of its origin - Ofcom.
If a service restricts access by UK users, that action would need to be effective in order for the
service to fall out of scope of the Act. The relevant test remains whether the service has links to the
UK. A service can have links to the UK if it has a significant number of UK users, or if UK users are a
target market. Duties to protect UK users also apply to providers of services that are capable of
being used by individuals in the UK and which pose a material risk of significant harm to them. As
explained in our note, the targeting of UK users by, for example, promoting ways of evading access
restrictions, could be relevant to whether that service still has links to the UK, depending on the
specific circumstances.
In view of the above, although we are not issuing an information notice at this time, we may revisit
this matter in future, taking account of any relevant evidence (including about whether your service
is in scope).
Yours sincerely,
Ofcom
1 It is a service provider’s choice whether it chooses to prevent users in the UK from accessing its service
instead of complying with the requirements of the Act to protect UK users.
