---
title: "Online Safety Act"
description: "The UK law that makes services answerable for their systems rather than for each post. What it requires, what Ofcom has enforced since 2025, and what its critics say."
url: https://attentionmachine.org/en/laws/online-safety-act/
lang: en
updated: 2026-10-25
license: "CC BY-NC-SA 4.0 (https://creativecommons.org/licenses/by-nc-sa/4.0/)"
---

# Online Safety Act

The United Kingdom took a different route from the EU. Instead of writing rules for the biggest platforms, it wrote duties for almost every service where people can post to each other — and handed them to one regulator with the power to fine.

## What the Act is

The Online Safety Act 2023[^src-online-safety-2023] received Royal Assent on 26 October 2023. Its long title is modest: an Act "to make provision for and in connection with the regulation by OFCOM of certain internet services". What it changes is the question being asked. Before it, a service's main legal exposure in the UK was for individual items of content once it had been told about them. The Act instead places a duty of care on the service itself — on its systems, its processes and its design. Ofcom[^src-ofcom-2024], the communications regulator, writes the codes of practice and enforces them.

> **Duty of care**
>
> A duty to take reasonable steps to prevent a foreseeable harm, rather than a liability for each thing that goes wrong. The Online Safety Act borrows the idea from health-and-safety law: a regulated service must assess the risks its own design creates, and use proportionate systems and processes to reduce them. It is not a duty to be perfect, and it is not a duty about any particular post. That is what makes it hard to verify — the question moves from "was this content removed?" to "were the systems adequate?"
>
> **Sources**
>
> - [Online Safety Act 2023, Part 3](https://www.legislation.gov.uk/ukpga/2023/50/part/3) — "Providers of regulated user-to-user services and regulated search services: duties of care".

It reaches further than a UK law might be expected to. Under section 4[^src-online-safety-2023-b] a service is regulated if it "has links with the United Kingdom" — a significant number of UK users, UK users as one of its target markets, or simply being usable in the UK where there are reasonable grounds to believe it presents a material risk of significant harm. Where the company is registered does not decide it.

## What it requires

Three layers, which arrived in order.

**Illegal content.** Every regulated user-to-user and search service must assess the risk that its users encounter illegal content — a list running from terrorism and child sexual abuse material to fraud and content encouraging or assisting suicide — and use proportionate systems to prevent it, to limit how long it stays up, and to remove it once the service knows. Ofcom published these codes on 16 December 2024[^src-ofcom-2024]; risk assessments were due by 16 March 2025 and the duties took effect on 17 March 2025.

**Children's safety.** A service likely to be accessed by children must carry out a separate children's risk assessment and take proportionate measures against "primary priority content" — pornography, and content encouraging suicide, self-harm or eating disorders. Ofcom published the children's codes on 24 April 2025[^src-ofcom-2025] with more than 40 measures; assessments were due by 24 July 2025 and the duties took effect on 25 July 2025.

**Age checks.** Section 12(4)[^src-online-safety-2023-d] requires a provider to use age verification or age estimation to keep children of any age from primary priority content, and section 12(6) says it must be "highly effective at correctly determining whether or not a particular user is a child". That statutory phrase is where the summer of 2025 came from: it is the reason UK users of pornography sites, and of ordinary platforms carrying the same material, met an age check.

> **Age verification / age assurance**
>
> The set of methods for establishing how old a user is — from a typed birthday, which anyone can defeat, through to document checks, facial age-estimation, mobile-operator checks, open banking or a third-party digital identity service. The Online Safety Act does not name a method. It sets a standard of result: under section 12(6), whatever is used must be "highly effective at correctly determining whether or not a particular user is a child". Ofcom's guidance translates that as technically accurate, robust, reliable and fair, and rules out self-declaration. The dilemma is unchanged by the wording: a check strong enough to stop a determined teenager generally has to identify every adult too.
>
> **Sources**
>
> - [Online Safety Act 2023, section 12](https://www.legislation.gov.uk/ukpga/2023/50/section/12) — safety duties protecting children; subsection (6) sets the "highly effective" standard.
> - [Ofcom, _Age checks to protect children online_](https://www.ofcom.org.uk/online-safety/protecting-children/age-checks-to-protect-children-online) (16 January 2025).

The penalty ceiling is set by Schedule 13[^src-online-safety-2023-e]: whichever is greater of £18 million or 10% of the provider's qualifying worldwide revenue. Ofcom[^src-ofcom-2024] also states that "in very serious cases we can apply for a court order to block a site in the UK".

## What has happened since enforcement began

Ofcom's first investigation under the Act, opened in 2025, was into an online suicide forum. On 13 May 2026 it fined the provider £950,000[^src-ofcom-2026-b], finding failures to carry out "a suitable and sufficient illegal content risk assessment", to use proportionate measures against priority illegal content, and to take such content down swiftly. Ofcom decided not to name the forum or its provider, and gave it ten working days to comply.

The first fine under the Act came earlier and was smaller. On 13 October 2025 Ofcom fined 4chan £20,000[^src-ofcom-2025-b], plus £100 a day, for not answering statutory information requests; the same update recorded five enforcement programmes and 21 investigations into the providers of 69 sites and apps. On 19 March 2026 Ofcom imposed three further penalties on 4chan totalling £520,000[^src-ofcom-2026] — £450,000 for the missing age checks, £50,000 for the missing illegal-content risk assessment and £20,000 for its terms of service — with daily penalties attached to a 2 April deadline.

Most of the penalties so far have concerned age checks on pornography sites. On 20 November 2025 Ofcom fined Itai Tech Ltd £50,000[^src-ofcom-2025-c], plus £5,000 for an unanswered information request, over the "nudification" site Undress.cc — a service that generates fake nude images of real people. Ofcom's June 2026 industry bulletin[^src-ofcom-2026-c] records further penalties in the same strand, among them £600,000 against Youngtek Solutions Ltd and £80,000 against First Time Videos LLC.

## The age checks, and what followed

From 25 July 2025[^src-ofcom-2025] the checks had to be in place. What followed is measurable; what it means is not settled. Ofcom's chief executive, Dame Melanie Dawes, told two parliamentary committees on 8 October 2025[^src-dawes-2025] that after the deadline "UK daily active users of VPN apps temporarily doubl\[ed] to around 1.5 million", and that use "has now fallen back to around 1 million by the end of September" — a pattern she said had also followed age checks in other countries and US states. A VPN hides where a user is, so it is one way past a check; it is also an ordinary privacy tool, and the figures do not say which use drove the spike. The question Ofcom says it is watching, "though it is hard to measure", is whether VPN use is rising among children; data from Internet Matters collected before July suggested "around one in ten under-18s used VPNs", skewed towards older teenagers.

Opposition was not only technical. A petition on the UK Parliament website to repeal the Act collected 550,136 signatures[^src-parliament-petition-2025]; the government responded on 28 July 2025 and MPs debated it on 15 December 2025.

## What it does, and does not do, about engagement-driven design

The Act does reach the feed, in two places. A children's risk assessment[^src-online-safety-2023-c] must take into account "algorithms used by the service and how easily, quickly and widely content may be disseminated", and how the design of the service, in particular its functionalities, affects the level of risk. And the safety duties[^src-online-safety-2023-d] apply "across all areas of a service, including the way it is designed, operated and used", listing "design of functionalities, algorithms and other features" among the areas where a provider must act if it is proportionate to do so. Ofcom turned that into a concrete measure: any provider operating a recommender system[^src-ofcom] that its risk assessment puts at medium or high risk "must configure their algorithms to filter out harmful content from children's feeds".

What the Act does not do is ask what the feed is optimising for. Nothing in it requires a service to stop ranking for engagement, to disclose what its recommender maximises, or to offer an adult a feed that is not personalised. The duties attach to categories of content — illegal, or harmful to children. A feed can be as absorbing as its designers can make it, provided what flows through it falls outside both lists. On this point the EU went one step further: Article 38 of the Digital Services Act[^src-regulation-2022] requires the largest platforms to offer at least one option for each recommender system "which is not based on profiling".

## Three different bets

Placed side by side, the three regimes this site describes are betting on different things. The [Digital Services Act](https://attentionmachine.org/en/laws/dsa/) bets on scale: the heaviest duties fall on a few dozen very large platforms, supervised by the European Commission, and the central obligation is to assess and mitigate _systemic risk_ from the design of their own systems. The Online Safety Act bets on breadth: comparable duties apply to a very large number of services of every size, supervised by Ofcom[^src-ofcom-2024], and the central obligation is about defined categories of content. Australia's [minimum-age law](https://attentionmachine.org/en/laws/age-restrictions/) bets on access: no account at all for under-16s, and little about design or business model. None of the three has been in force long enough to be evaluated against the others.

## The criticism

From digital-rights organisations, the objection is that the Act buys a protection that is easy to step around at the price of everyone's privacy, and that duties framed around "harmful" content push services to remove lawful speech. The Electronic Frontier Foundation, Open Rights Group, Big Brother Watch and Index on Censorship[^src-electronic-frontier-2025] put that case to UK politicians in December 2025, asking for the Act to be reformed or repealed.

A second challenge came from an unexpected direction. The Wikimedia Foundation and a Wikipedia editor challenged the regulations that decide which services fall into "Category 1", the tier carrying the heaviest duties, arguing that Wikipedia could be swept in alongside commercial social platforms and that identity requirements would expose its volunteers. On 11 August 2025 the High Court dismissed all four grounds[^src-high-court-2025]; Mr Justice Johnson held the question was contingent on what Ofcom actually decided, and noted that the claimants could bring fresh proceedings if Ofcom did categorise Wikipedia that way. The Foundation says Ofcom notified it on 10 July 2026[^src-wikimedia-foundation-2026] that Wikipedia is not currently a Category 1 service, but stays on a "watch list" of platforms that could become one later.

From the United States, the objection is about reach. The House Judiciary Committee's interim staff report of 3 February 2026[^src-committee-judiciary-2026] calls the Act "perhaps the most notable foreign attempt to imitate the Digital Services Act" and treats both as a foreign threat to American speech. Because section 4[^src-online-safety-2023-b] ties the duties to UK users rather than to where a company sits, a US service with UK users is inside the regime — which is the fact the argument is about, and which both sides read differently.

**How we know — what is settled here, and what is not**

**Settled.** The duties, the dates, the codes and the penalty ceiling are in the statute[^src-online-safety-2023] and in Ofcom's published codes[^src-ofcom-2024], and every enforcement decision above is a published Ofcom decision. Those are documents, not estimates.

**Not settled.** Whether any of it improves outcomes for children. The children's codes have been in force only since July 2025, and no published independent evaluation of their effect exists yet. Ofcom itself[^src-dawes-2025] describes the measurement problem plainly — whether children's VPN use is rising is "hard to measure" — and its VPN figures count all UK users, so on their own they say nothing about the group the duties are for.

**Genuinely two-sided.** Whether duties written around "harmful content" can be enforced without catching lawful speech is contested from both directions, and the Wikimedia judgment[^src-high-court-2025] illustrates why: the court would not decide the question in the abstract, because the answer depends on how the regulator applies the rules case by case. The age-assurance trade-off — a check strong enough to work generally has to identify everyone — is the same unresolved problem set out on [Age Restrictions](https://attentionmachine.org/en/laws/age-restrictions/), and it is not solved by the Act's "highly effective" standard, which specifies a result rather than a method.

## Sources

[^src-online-safety-2023]: [_Online Safety Act 2023_](https://www.legislation.gov.uk/ukpga/2023/50/contents) (c. 50), legislation.gov.uk — Royal Assent 26 October 2023.

[^src-online-safety-2023-b]: [Online Safety Act 2023, section 4](https://www.legislation.gov.uk/ukpga/2023/50/section/4) — which services are regulated, and what "links with the United Kingdom" means.

[^src-online-safety-2023-c]: [Online Safety Act 2023, section 11](https://www.legislation.gov.uk/ukpga/2023/50/section/11) — children's risk assessment duties, including algorithms and dissemination.

[^src-online-safety-2023-d]: [Online Safety Act 2023, section 12](https://www.legislation.gov.uk/ukpga/2023/50/section/12) — children's safety duties, age verification or estimation, and "design of functionalities, algorithms and other features".

[^src-online-safety-2023-e]: [Online Safety Act 2023, Schedule 13](https://www.legislation.gov.uk/ukpga/2023/50/schedule/13) — maximum penalty: the greater of £18 million or 10% of qualifying worldwide revenue.

[^src-ofcom-2024]: Ofcom (16 December 2024), [_Time for tech firms to act: UK online safety regulation comes into force_](https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/time-for-tech-firms-to-act-uk-online-safety-regulation-comes-into-force/) — illegal-harms codes, the 16 March and 17 March 2025 dates, and the fining powers.

[^src-ofcom-2025]: Ofcom (24 April 2025), [_Protecting children from harms online_](https://www.ofcom.org.uk/online-safety/protecting-children/protecting-children-from-harms-online) — the Protection of Children Codes, risk assessments by 24 July 2025, duties from 25 July 2025.

[^src-ofcom]: Ofcom, [_New rules for a safer generation of children online_](https://www.ofcom.org.uk/online-safety/protecting-children/new-rules-for-a-safer-generation-of-children-online) — more than 40 measures, and the recommender-system requirement.

[^src-ofcom-2025-b]: Ofcom (13 October 2025), [_Ofcom issues update on Online Safety Act investigations_](https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/ofcom-issues-update-on-online-safety-act-investigations) — the £20,000 fine on 4chan, five enforcement programmes, 21 investigations into 69 sites and apps.

[^src-ofcom-2025-c]: Ofcom (20 November 2025), [_Ofcom fines nudification site £50,000 for failing to introduce age-checks_](https://www.ofcom.org.uk/online-safety/protecting-children/ofcom-fines-nudification-site-50000-for-failing-to-introduce-age-checks) — Itai Tech Ltd, plus £5,000 for an unanswered information request.

[^src-ofcom-2026]: Ofcom (19 March 2026), [_4chan fined £450,000 for not protecting children from online pornography_](https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/4chan-fined-450000-for-not-protecting-children-from-online-pornography) — three penalties totalling £520,000 and the 2 April daily penalties.

[^src-ofcom-2026-b]: Ofcom (13 May 2026), [_Ofcom fines online suicide forum £950,000_](https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/ofcom-fines-online-suicide-forum-950000) — the duties breached, the decision not to name the service, ten working days to comply.

[^src-ofcom-2026-c]: Ofcom (29 June 2026), [_Online safety industry bulletin — June 2026_](https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/online-safety-industry-bulletins/online-safety-industry-bulletin-june-2026) — later penalties, including Youngtek Solutions Ltd and First Time Videos LLC.

[^src-dawes-2025]: Dawes, M., Ofcom (8 October 2025), [_Online Safety Act — driving change in 2025_](https://www.ofcom.org.uk/siteassets/resources/documents/about-ofcom/public-correspondence/2025/letter-from-dame-melanie-dawes-on-the-online-safety-act-driving-change-in-2025.pdf?v=406250), letter to the House of Lords Communications and Digital Committee and the House of Commons Science, Innovation and Technology Committee — the VPN figures and the Internet Matters data.

[^src-parliament-petition-2025]: [UK Parliament petition 722903, _Repeal the Online Safety Act_](https://petition.parliament.uk/petitions/722903) — 550,136 signatures; government response 28 July 2025; debated 15 December 2025.

[^src-high-court-2025]: High Court of Justice, King's Bench Division (11 August 2025), [_Wikimedia Foundation & Anor v Secretary of State for Science, Innovation and Technology_](https://caselaw.nationalarchives.gov.uk/ewhc/admin/2025/2086) \[2025] EWHC 2086 (Admin) — challenge to the Category 1 threshold regulations dismissed on all four grounds.

[^src-wikimedia-foundation-2026]: Wikimedia Foundation (10 July 2026), [_Wikimedia Foundation challenges UK Online Safety Act regulations_](https://wikimediafoundation.org/news/2026/07/10/wikimedia-foundation-challenges-uk-online-safety-act-regulations/) — the case history and Ofcom's notification that Wikipedia is not currently a Category 1 service but stays on its "watch list".

[^src-electronic-frontier-2025]: Electronic Frontier Foundation, Open Rights Group, Big Brother Watch and Index on Censorship (December 2025), [_EFF, Open Rights Group, Big Brother Watch, and Index on Censorship call on UK government to reform or repeal the Online Safety Act_](https://www.eff.org/deeplinks/2025/12/eff-open-rights-group-big-brother-watch-and-index-censorship-call-uk-government).

[^src-committee-judiciary-2026]: Committee on the Judiciary, US House of Representatives (3 February 2026), [_The Foreign Censorship Threat, Part II_](https://judiciary.house.gov/sites/evo-subsites/republicans-judiciary.house.gov/files/2026-02/THE-FOREIGN-CENSORSHIP-THREAT-PART-II-2-3-26.pdf), interim staff report — the Online Safety Act as an imitation of the Digital Services Act (p. 137).

[^src-regulation-2022]: [Regulation (EU) 2022/2065 (Digital Services Act)](https://eur-lex.europa.eu/eli/reg/2022/2065/oj), Article 38 — at least one recommender option not based on profiling.

[Digital Services Act →](https://attentionmachine.org/en/laws/dsa/)\
[Age Restrictions →](https://attentionmachine.org/en/laws/age-restrictions/)\
[Freedom of Speech →](https://attentionmachine.org/en/truth/free-speech/)

---

Some content on this site was created with the assistance of AI tools and may contain errors. [How we use AI →](https://attentionmachine.org/en/about/how-we-use-ai/)