Trust and Safety at the Half-Year Mark

What Has Happened, and What That Says About What Is to Come

The first half of 2026 brought sustained activity across Trust and Safety: regulatory enforcement intensifying, AI moving to the centre as both tool and threat, and attention shifting toward not only moderation of harm but also platform design. Drawing on Tremau's Safety Space briefings, intelligence, and analytics, this look-back sets out the five trends that defined the half-year, and the questions each leaves open.

To get beyond our own read on these trends, we spoke with senior voices from across the field, who shared with us where they see these trends heading, and what the rest of 2026 is likely to bring.

Child safety generated significant regulatory activity in the first half of 2026, while new research continued to highlight a fast evolving risk landscape. A 20,000-response study from Protect Children and Ofcom identified early exposure to platforms and generative AI as compounding risk factors for minors. At the same time, the global response to youth online safety governance remains fragmented as evidenced by NYU Stern's comparison of 26 laws across 19 jurisdictions.

The regulatory response has been a combination of new legislation and stronger enforcement of existing rules. Brazil and Indonesia both passed statutes, and the UAE issued a federal child-protection decree, and Türkiye amended its Internet Law to account for risks to children on gaming platforms and social media. Several laws advanced through legislatures without yet taking effect, including the UK's under-16 restriction, Germany's proposed under-14 ban, and Spain's pending draft legislation to block under-16s from social media platforms. There is also talk of an upcoming proposal from the European Commission on an EU-wide age restriction to avoid fragmented rules across the bloc. North America also saw movement with Canada's introduction of Bill C-34, which includes a conditional under-16 social media ban backed by age verification, and the US House passed the Kids Internet and Digital Safety (KIDS) Act, which is now headed to the Senate. In addition to the expansive volume of new and proposed laws, enforcement of existing laws continued at pace: the European Commission's preliminary findings against Meta regarding under-13s, its proceedings against Shein, Snapchat and four adult-content platforms, and Ofcom's fine of 4chan, its binding information notices to more than 40 platforms, and its letters to six major services.

Platforms also responded by further strengthening child safety features and introducing additional age-based protections. Teen-by-default settings, parent-managed accounts, age-based experiences, and tighter age assurance measures became increasingly common. Age assurance remained central to many of these changes and continued to be the primary mechanism regulators relied upon, even as questions around its technical reliability and effectiveness remain unresolved.

Despite this level of regulatory and platform activity, whether this has translated to children being safer online remains unclear. Empirical evaluations indicate a divergence between policy implementation and measurable outcomes: the Molly Rose Foundation reported adolescent exposure to high-risk content statistically unchanged in the UK post-Online Safety Act, while a peer-reviewed BMJ study observed that over 85% of minors under 16 continued to access restricted platforms post-ban. Whether these initial findings reflect effectiveness of the policy or simply the time required for new policies to take effect remains an open question.

Mitali Sud (Senior Policy Manager, Internet Matters) comments:

“Internet Matters’ research with children and parents in the UK found that 68% of children and 67% of parents had noticed changes to children’s online accounts, including more age checks, improved reporting tools and restrictions on certain features. Yet 49% of children had experienced at least one online harm in the previous month, while 46% believed age checks were easy to bypass and 32% said they had bypassed one in the previous two months.”

“These findings suggest that changes are not yet translating consistently into safer experiences for children. In H2, the UK policy debate is likely to focus on how effectively existing online safety regulation is working in practice and how forthcoming measures are implemented. Longer term, the UK will need a more coherent and risk-based approach that works across existing and emerging technologies, with safety-by-design at its core.”

Beyond child safety, regulators globally moved from first-of-kind actions into steady operation.

The European Commission designated WhatsApp as a VLOP, opened proceedings against Shein over illegal goods and addictive design, issued a preliminary breach finding against TikTok on product features, and preliminarily found Meta in breach over under-13s, and issued its second fine under the DSA. The Digital Services Coordinators also started getting more active. Austria's Digital Services Coordinator commissioned and published a study counting more than 634,000 fraudulent or problematic ads across Facebook and Instagram in three months, framing scam advertising as a systemic DSA risk that regulators may draw on in future systemic-risk cases. Ireland's Coimisiún na Meán opened investigations into Facebook and Instagram over whether users can easily switch to a non-profiling recommender system and whether the platforms use “dark patterns” to discourage that choice. The Netherlands' ACM opened its own investigation into Roblox over whether the platform takes sufficient measures to protect minors from risks including violent or explicit content, grooming, and manipulative design. And on 16 July, the UK's Ofcom opened an investigation into TikTok under Section 12 of the Online Safety Act, examining whether its age-inference systems adequately identify child users and prevent their exposure to harmful content.

The UK saw a parallel level of enforcement activity. Ofcom fined 4chan, issued binding information notices to more than 40 platforms, wrote to six major services on keeping children off their platforms, opened investigations into Telegram and teen chat sites, and brought a statutory CSEA reporting portal into force; and, in June, it expanded its Year 2 illegal-content risk-assessment requirements to cover suicide and self-harm and cyberflashing. In July, Ofcom also published its list of Categorised Services under the Online Safety Act, formally identifying which platforms fall into Category 1, 2A, and 2B and therefore face the Act's most extensive duties.

This enforcement activity was not confined to Europe, as global regulators increasingly shifted from setting expectations on paper to executing against active legal measures. Australia's eSafety Commissioner moved toward court action against Meta, TikTok, Snapchat, and YouTube over the under-16 ban, and is developing a broader Digital Duty of Care to deepen and expand the set of obligations that apply in the online space. In Asia, Singapore's IMDA cautioned X and TikTok over illegal-content and child-safety failures and brought its app-distribution code into effect, while Malaysia began enforcing an under-16 account ban backed by platform age-verification duties and fines for non-compliance. Meanwhile, in the US, enforcement is largely still left to the courts with Florida's Attorney General suing TikTok under the state's under-14 law.

Owen Bennett (Online Safety Expert) comments:

“Three things platforms should be watching out for: one, the 27 national regulators have begun to flex their muscles, both by pursuing local enforcement actions and by using their voice and influence to shape the DSA enforcement priorities in Brussels. Two, regulators are not yet prioritising international coordination and coherence, as naturally, their focus is on implementing their own domestic rulebooks. There is a big opportunity for industry to develop shared methodologies for items like risk assessment methodologies and age assurance deployment standards; taking the lead on bridging the gaps between how the different international rulebooks interpret overlapping requirements. And three, enforcement action is expensive and fraught with risk for online safety regulators, and for most of them, it's the last resort in their theory of change. Informal supervisory dialogues help companies to understand compliance expectations and provide an opportunity to explain how their compliance programmes meet regulatory requirements.”

During the first half of 2026, AI-generated harm and the corresponding regulatory response emerged concurrently, with both unsettled domains developing in direct relation to one another.

The true scale of this threat is heavily concentrated in synthetic visual content. The Internet Watch Foundation recorded a 26% increase in AI-generated child sexual abuse videos over the previous year — most in its highest-severity category — alongside a 114% year-on-year rise in commercial synthetic abuse sites. And a study by UNICEF, ECPAT, and INTERPOL across 11 countries showed that at least 1.2 million children disclosed having had their images manipulated into sexually explicit deepfakes in the past year.

On the harm side, the first half of the year saw a diversification of abuse vectors rather than the dominance of a single category. Autonomous AI environments emerged as a novel vector. Moltbook, a social network where AI agents (not humans) post, comment and upvote across topic-based communities, illustrated the risk: an analysis found coordinated spam, prompt-injection activity and crypto-focused abuse arising with no human moderator in the loop.

Concurrently, AI-enabled financial fraud expanded, with Experian's 2026 Future of Fraud Forecast showing that 72% of business leaders now classify it as a top operational challenge. Deepfakes have become the most common form of digital identity fraud faced by enterprises, accounting for 42.5% of all fraud attempts detected in the financial sector, while 52% of individuals report exposure to deepfake scams targeting personal information or capital. Ultimately, the unifying trend across all of these vectors is that generative applications materially reduce both the technical friction and the resource investments required to facilitate harm.

Regulators, alarmed by the rise in AI-generated harms, have reacted by leveraging existing enforcement regimes while concurrently advancing new laws. These initial interventions are heavily concentrated on the most acute content threats, with several oversight bodies addressing NCII abuse under established online safety frameworks and initiating investigations, with the UK additionally pursuing criminal liability provisions. Statutory frameworks are also evolving to provide direct remedies, as seen in the U.S. Senate passing legislation to allow victims of non-consensual deepfakes to sue for civil damages. In contrast, the response to the wider spectrum of threats, including autonomous-agent abuse, synthetic disinformation, and AI-enabled fraud, is significantly less developed and remains primarily at the stage of description and inquiry.

What we are seeing today is that the harms and the instruments meant to address them are being defined in the same window, each shaping the other as it goes.

David Wright (CEO, SWGfL, Revenge Porn Helpline / StopNCII.org) comments:

“In January, off the back of the Grok incident, we didn't see the uptake in calls we expected. The conclusion was that people generally don't know that content is being created about them. The hypothesis we're working with is that calls will build over time as people realise their content exists. When it comes to NCII content, whether it's synthetic media or not doesn't matter, because the impact is the same on the individual. It's fair to say synthetically created content is making cases more complex.”

“On the regulatory side, when Ofcom picked out obligations to prevent NCII in their additional safety measures in February, I can imagine the timing was accelerated because of what happened with Grok. On behalf of victims, that is a positive move.”

AI's relationship with Trust & Safety grew more entangled in the first half of 2026. AI is simultaneously becoming a Trust & Safety tool, a source of new risks, and a force reshaping the Trust & Safety function itself.

AI moved further into the tooling stack, building on capabilities from the previous year: prompt-based policy tools that turn written requirements into working classifiers, methods to detect policy-violating output while it is still being generated, and features that surface the topics children discuss with chatbots to parents. Frameworks began to form alongside the tools, with several regulators opening inquiries into a chatbot and at least one AI developer, and the European Commission publishing a voluntary Code of Practice on labelling AI-generated content ahead of the AI Act's transparency deadlines.

And as a force on the function itself, AI featured in how teams are being resized and governed. Several major platforms reduced headcount in roles including Trust and Safety while citing AI efficiencies, with some cuts falling at hubs with significant safety operations, and one major AI developer folded its dedicated safety function into its product teams. These moves raise a question the period did not resolve: whether AI is augmenting the discipline or redrawing its boundaries, changing both what the function is expected to do and who does it.

Taken together, the three strands describe a relationship that is neither straightforwardly beneficial nor straightforwardly harmful. AI is becoming core T&S infrastructure and, in the same motion, changing the work, the risk surface, and the teams themselves.

Aaron Rodericks (Head of Trust & Safety, Bluesky) comments:

“AI's most reliable value in T&S today is proactivity at scale; it lets a challenger surface and action the high-confidence, high-volume cases fast, without the thousands of moderators incumbents hired to get to that size. However, scale makes edge cases more frequent. AI is dependable where confidence is high and context is cheap, and shaky wherever the right call hinges on nuance the model doesn't hold.

Having an AI moderation solution doesn't exempt you from oversight; it makes that oversight more important. Set yourself up with pressure valves before you switch it on: monitor appeals, run QA on decisions with expert moderators, and build feedback loops so errors update the models or the policies behind them. Treat the policy driving the tool as a versioned artifact, and be deliberate about rollout: sensible ramp-ups before full production, with permissions scoped to what the tool actually needs in your stack.”

A distinct thread through the first half of 2026 was accountability for how services are built. The Commission's preliminary findings against TikTok cited product features such as infinite scroll, autoplay, push notifications and highly personalised recommendations as risk drivers, rather than specific user-generated content. In the US, a jury found Meta and Google liable in a case concerning addictive design and a young person's mental health, a verdict reported as likely to influence a large number of pending cases.

Legislation moved the same way, increasingly naming specific design features. Connecticut's Public Act 26-15 set default one-hour time limits on personalised feeds, restricted night-time notifications, and added age-verification and chatbot safeguards. Brazil's child-safety statute reaches into product mechanics, affecting loot-box-style features, monetisation, and flows that risk encouraging excessive engagement or spending. Meanwhile, UK proposals would allow features such as infinite scroll and in-service AI chatbots to be restricted for younger users. Regulators increasingly framed expectations around safety by design, and the Commission's scrutiny of one platform extended to the adequacy of its risk-assessment methodology.

Independent research highlighted a similar point. The Molly Rose Foundation attributed much of children's exposure it recorded to suicide, self-harm, depression and eating disorder content to algorithmic recommendation rather than search or direct contact. A separate audit of safety features across four major platforms found that a majority of those tested did not function as intended. Others have noted the underlying tension the design exposes: optimising for time-on-platform and optimising for user protection often pull in different directions which is part of what makes design-level change harder than content-level change.

Taken together, these developments relocate the question from what appears on a service to the design choices that shape what users see and how they behave. How “addictive” or “compulsive” features come to be defined in enforceable terms, and whether liability settles around product design, are among the questions the period brought to the forefront.

Carmen Valtierra de Luis (VP of Product, Tremau) comments:

“The hardest thing to defend is a feature that's doing exactly what it was designed to do. Infinite scroll, autoplay and aggressive notifications aren't bugs; they're optimised against engagement and revenue, which is precisely why they're now in scope. The uncomfortable truth is that the features that drive engagement and the features that protect users are rarely the same.

The current shift for platform design practices pushes T&S and the business into the room at ideation and wireframe stage, not after launch to clean up. If safety is the last box to tick before launch, it loses to the growth targets every time. The shift I'd argue for is treating design as a way to build trust rather than extract it. Honest exit points that let people leave with a sense of completion, and a light education layer in the UI, a simple 'you've been scrolling for two hours' nudge, do more for long-term retention than any dark pattern.”