The Online Safety Act is the Online Safety Act 2023 of the United Kingdom, the statute that places legal duties of care on online services to reduce illegal content and to protect children from harmful material. In online safety regulation it is one of the most extensive national frameworks, built around risk assessments, safety measures and codes of practice issued and enforced by the communications regulator Ofcom.
The act received Royal Assent on 26 October 2023 and is coming into force in phases driven by Ofcom codes and secondary legislation. Australia has a separate law with the same name, the Online Safety Act 2021, supervised by the eSafety Commissioner; this page concerns the UK act unless stated otherwise. It is a description for orientation, not legal advice, and parts of the regime are still being implemented.
Services in scope of the Online Safety Act
The act applies to three kinds of service that have links with the United Kingdom, meaning a significant number of UK users, the UK as a target market, or a material risk of significant harm to UK users. Location of the company does not matter, so many non-UK services are covered.
| Service type | Examples | Core duties |
|---|---|---|
| User-to-user services | Social media, forums, messaging, video sharing, online games with chat | Illegal content and child safety duties |
| Search services | General and vertical search engines | Minimize exposure to illegal and harmful results |
| Pornography providers | Services publishing their own pornographic content | Highly effective age assurance |
Email, SMS, one-to-one live voice calls, internal business tools and comments on a provider’s own content are among the exempt categories. Larger services can be designated as categorized services, which face additional duties on transparency, user empowerment and protection of news and journalistic content.
How the duty of care model works
The act does not list individual posts that must be removed. Instead it requires services to assess the risks their design creates and to take proportionate measures to mitigate them. Ofcom codes of practice describe recommended measures; a provider that follows them is treated as compliant with the corresponding duties, while one that chooses alternative measures must show they are equally effective.
| Duty | What the provider must do | Typical measures |
|---|---|---|
| Illegal content risk assessment | Assess the risk of priority offenses such as terrorism, CSAM and fraud | Documented assessment reviewed after significant changes |
| Illegal content safety duty | Prevent, minimize and swiftly remove illegal content | Moderation teams, hash matching, reporting tools |
| Children’s access assessment | Decide whether children are likely to access the service | Assessment based on user evidence |
| Child safety duties | Protect children from harmful content | Age assurance, safer feeds, restricted contact |
| User reporting and complaints | Provide easy reporting and complaint routes | In-product reporting and appeal processes |
Content harmful to children is graded. Primary priority content, such as pornography and material encouraging suicide, self-harm or eating disorders, must be prevented from reaching children, which in practice requires highly effective age assurance. Priority content, such as bullying or dangerous challenges, must be mitigated through age-appropriate design.
Implementation phases and enforcement powers
Ofcom has implemented the act through three broad phases: illegal harms, protection of children, and additional duties for categorized services. The dates below reflect the schedule as it has unfolded; later phases depend on secondary legislation and may shift.
| Milestone | Approximate date | Status note |
|---|---|---|
| Royal Assent | 26 October 2023 | Fixed |
| New criminal offenses such as cyberflashing | 31 January 2024 | In force |
| Illegal content safety duties enforceable | 17 March 2025 | In force after risk assessments were due |
| Child safety duties and age checks | 25 July 2025 | In force |
| Categorized service duties | From 2026 onward | Subject to register, codes and possible delay |
Ofcom can impose fines of up to GBP 18 million or 10 percent of qualifying worldwide revenue, whichever is greater. In serious cases it can apply to court for business disruption measures that require payment providers, advertisers or internet access providers to withdraw services. Senior managers can face criminal liability for failing to comply with information requests.
How the act compares with related laws
The Online Safety Act is often compared with the EU Digital Services Act. Both regulate platforms, but the UK act relies more on a duty of care toward users, while the DSA focuses on procedural due diligence and systemic risk for very large services.
| Law | Jurisdiction | Distinctive feature |
|---|---|---|
| Digital Services Act | European Union | Notice and action, statements of reasons, audits of very large platforms |
| Online Safety Act 2021 | Australia | Removal notices and a social media minimum age |
| Kids Online Safety Act | United States, proposed | Duty of care toward minors, not enacted at federal level |
| Age-appropriate design code | United Kingdom | Data protection code for services likely accessed by children |
Controversies and common mistakes
The act remains debated. Critics point to privacy risks of age verification, the burden on small community sites and the power to require accredited technology for scanning content, which could affect end-to-end encrypted messaging. Ofcom has indicated that such notices would only follow once technology meets minimum accuracy standards.
- Assuming small services are out of scope. Size affects proportionality, not whether duties apply.
- Skipping documentation. Ofcom expects written, updated risk assessments.
- Relying on self-declared age. Self-declaration is not highly effective age assurance.
- Ignoring UK users abroad. Non-UK services with a significant UK user base are covered.
Understanding it simply
The Online Safety Act is a UK law that makes websites and apps responsible for keeping users safer. They must look for ways their service could spread illegal material or harm children. Then they must fix those risks.
It is a bit like health and safety rules at work. The regulator, Ofcom, does not check every post. It checks whether the company has sensible systems in place, and it can fine companies that do not.
Applied in practice
A hobby forum based outside the UK has about 300,000 monthly users, a third of them in Britain. Under the Online Safety Act, its small team completes an illegal content risk assessment and a children’s access assessment. Because teenagers use the forum, it also carries out a children’s risk assessment.
The forum adds a clear reporting button, hash matching for known abuse images and a rule that only verified adults can send direct messages to strangers. It records each decision in a short compliance file. When Ofcom sends an information request, the team answers within the deadline. The forum stays available in the UK with a manageable, documented level of compliance.