In online safety regulation, a duty of care is a legal obligation on an online service to take proportionate measures to protect its users from foreseeable harm, by assessing risks and designing its systems, policies and features to reduce them. The concept shifts the regulatory focus from individual pieces of content to the systems and processes that shape what users encounter.
The model is most fully developed in the UK Online Safety Act 2023, and comparable ideas appear in the systemic risk obligations of the EU Digital Services Act and in proposals in Australia and the United States. Within tech regulation it marks a move away from pure liability shields toward proactive, accountable platform governance.
How a regulatory duty of care works
A regulatory duty of care works as a cycle of assessment, mitigation and oversight. The service identifies how its features could expose users to harm, adopts measures proportionate to that risk, documents its choices and answers to an independent regulator that can audit and sanction it.
- Risk assessment: the service maps illegal and harmful content risks against its user base, features and business model.
- Mitigation measures: design changes, moderation processes, user controls, age assurance and reporting tools address the identified risks.
- Transparency: the service publishes terms of service, reports and, for larger services, detailed transparency reports.
- Regulatory oversight: a regulator issues codes of practice, requests information and imposes fines or business disruption measures.
The essential feature is that the duty is owed at the level of the system. A platform does not breach it merely because one harmful post slips through; it breaches it when its processes are not reasonably designed to manage known risks.
Duty of care in the UK Online Safety Act
The UK Online Safety Act turns the idea into a set of specific statutory duties, enforced by Ofcom through codes of practice. Services that follow the recommended measures in a code are treated as compliant, which gives the abstract duty a concrete benchmark.
| Duty | Applies to | Core requirement |
|---|---|---|
| Illegal content duties | All user-to-user and search services in scope | Assess risk, reduce exposure, remove illegal content swiftly |
| Children’s safety duties | Services likely to be accessed by children | Prevent access to primary priority content, use age assurance |
| User empowerment duties | Largest Category 1 services | Give adults tools to filter certain content |
| Freedom of expression duties | All services, stronger for Category 1 | Weigh rights when designing safety measures |
| Transparency duties | Categorized services | Publish reports in a form Ofcom specifies |
The illegal content duties took effect in March 2025 and the children’s safety duties in July 2025. Penalties can reach 18 million pounds or 10 percent of qualifying worldwide revenue, whichever is higher, and senior managers can face criminal liability for failing to comply with certain information requests.
Comparison with other legal models
A duty of care sits between two older approaches: notice-and-takedown liability, where a host acts only once informed, and broad immunity, where a platform is largely shielded from responsibility for user content. The table compares the main models.
| Model | Example jurisdiction | Trigger for responsibility | Focus |
|---|---|---|---|
| Broad immunity | United States, Section 230 | Rarely triggered for user content | Protecting intermediaries |
| Notice and takedown | EU hosting safe harbor | Actual knowledge of illegal content | Individual items |
| Systemic risk duties | EU Digital Services Act for very large platforms | Risk to society and users | Systems and audits |
| Statutory duty of care | UK Online Safety Act | Foreseeable harm to users | Design and processes |
| Tort duty of care | Common law negligence | Individual damage claim | Compensation |
The term borrows its name from negligence law, but the regulatory version is different in a crucial way. It is enforced by a regulator rather than through individual lawsuits, and the UK Act does not give users a private right to sue a platform for breach.
Proportionality and practical compliance
Proportionality is the principle that keeps a duty of care workable: what a service must do depends on its size, capacity, risk level and functionality. A small forum is not expected to run the same machinery as a global social network, but it cannot ignore obvious risks either.
| Service profile | Likely risk level | Typical measures |
|---|---|---|
| Small hobby forum, adult users | Low | Clear terms, reporting button, prompt removal |
| Gaming platform with voice chat | Medium to high | Default privacy for minors, moderation, blocking tools |
| Large social network with recommendations | High | Algorithm testing, age assurance, dedicated trust and safety team |
| Adult content site | High for children | Highly effective age assurance before access |
Compliance work is largely documentary and design-driven: written risk assessments, records of decisions, product reviews before launches and governance structures with a named accountable person. Regulators tend to judge the quality of this reasoning as much as the outcome.
Criticism and limitations
- Vagueness of harm: critics argue that duties tied to harmful but legal content can push platforms toward over-removal, which is why the UK Act narrowed its adult provisions.
- Privacy tension: age assurance and scanning measures can conflict with end-to-end encryption and data minimization.
- Regulatory capacity: thousands of services fall in scope, so enforcement inevitably concentrates on the largest or riskiest.
- Measurement problems: it is difficult to prove that a design change reduced harm, which complicates both compliance and enforcement.
In simple terms
Think of a theme park. The owner cannot stop every accident, but it must check its rides, put up barriers and train staff. If it ignores an obvious danger, it is responsible.
A duty of care asks online platforms to act like a responsible owner. They must look for ways their service could hurt people, especially children, and fix the risky parts. The key takeaway is that platforms are judged on how safe their systems are, not on catching every bad post.
A practical example
A mid-sized video sharing app with about two million UK users carries out its first children’s risk assessment. It finds that strangers can send direct messages to accounts registered as 13 to 15 years old, and that its recommendation feed can push teenagers toward extreme dieting videos.
The company changes its defaults so that teen accounts cannot receive messages from unknown adults, adds age estimation at signup, and retrains its feed to downrank content flagged as harmful to minors. It records each decision with the evidence behind it. When Ofcom later requests information, the service can show a documented, proportionate response, which is exactly what the duty of care requires.