The law is designed to target large companies that aren't seen as doing enough to prevent harm on the internet. Setting up a CIC doesn't dodge the law, the legal entity (the CIC) remains accountable for conduct on the website. Setting up a CIC removes the risk from the individual website operator because they're no longer operating the website, instead the website is operated by a separate legal entity. The website could still be held accountable for violating the law but the consequence would be the CIC is fined, not the individual behind it. The same principle as any limited liability company.

If the person committed a criminal offence under the Computer Misuse Act then they would face criminal sanctions, personally.

The Online safety bill gives Ofcom the power to levy regulatory fines, not criminal sanctions, so is very different

There are plans to remove the small company p & l exemption and new rules on verifying directors ids. Costs are going up too. It looks like a CIC you can only file online if full accounts. https://find-and-update.company-information.service.gov.uk/a...

You have to keep accounts if a business even if not incorporated. A company has to keep accounts if it has any assets (e.g. a domain) or any financial transactions (e.g. paying for hosting)

You will also probably have to file a tax return. You have to keep a register of shareholders.

In fact if definitely not making a profit a standard ltd might be simpler (or maybe a company limited by guarantee) then a CIC as all a CIC does it add restrictions and extra regulation https://assets.publishing.service.gov.uk/media/5a7b800640f0b...