17.1 The Online Safety Act in practice
Status reviewed 15 July 2026. The illegal-content and child-safety duties described below are in force. Ofcom published its register of categorised services on 10 July 2026; several additional Category 1 duties are still the subject of consultation and implementation work.
What the Act is
The Online Safety Act 2023 is a large and far-reaching piece of legislation that received Royal Assent in October 2023 and has been brought into force in stages since. Its stated purpose is to make the UK "the safest place in the world to be online", chiefly by requiring online services to protect users — and especially children — from illegal content and from material judged harmful. It is the single most consequential internet law the UK has passed, and most of the specific restrictions described elsewhere in this chapter either flow from it or sit alongside it.
The Act works not by banning particular words or images directly, but by imposing legal "duties of care" on the companies that run online services. Those duties are deliberately broad and outcome-focused: a service must assess the risks its users face and take proportionate steps to reduce them. The detail of what "proportionate" means in practice is filled in by the regulator, Ofcom, through codes of practice and guidance. This structure matters, because it means the real rules are set not by Parliament line by line but by a regulator interpreting open-ended duties — a process that is faster to change and harder for the public to follow.
Who it applies to
The Act regulates defined kinds of service, chiefly user-to-user services, search services, and services publishing their own pornographic content, where there is a relevant link with the UK. Social networks, messaging and sharing services, forums, parts of gaming and dating services, and search engines can fall within those definitions, including providers based abroad. It does not follow that every website with a UK visitor is regulated: email, SMS and MMS, limited-functionality services, some internal business services, news-publisher content, and other activities have statutory exclusions or qualifications. Scope turns on the actual service features, not a label such as "small website" or "community".
Size does not create a general exemption, but the regime is risk-based and repeatedly uses proportionality. A small low-risk service is not expected to deploy every measure used by a very large high-risk platform. A small service can still have material duties, particularly risk assessment, record keeping, reporting and action against illegal content. The additional categorised-service regime is narrower: Ofcom published the first Category 1, 2A and 2B register on 10 July 2026 for services meeting statutory thresholds. Category 1 brings further duties concerning user choice, identity verification, terms, complaints, journalistic and democratic content, and freedom-of-expression and privacy assessments, but Ofcom was still consulting on parts of that implementation at this review date.
What services must now do
In concrete terms, an in-scope service is now expected to carry out and document risk assessments, put in place systems to detect and remove illegal content, provide mechanisms for users to report problems, enforce its own terms of service consistently, and — where children can access it — protect them from a defined set of harms. From March 2025 the illegal-content duties came into force, requiring services to act against material such as terrorism content, child sexual abuse material, fraud, and incitement. From July 2025 the child-safety duties added requirements to keep children away from pornography and other content judged harmful to them, which is where mandatory age checks entered everyday life.
The practical consequence is a great deal of new machinery: automated scanning and filtering, age-assurance systems, reporting tools, and compliance teams. For large companies this is an expense they can absorb. For small ones it can be the deciding factor in whether they continue to operate at all. The Act does not tell a service exactly which tools to use, but the duties are written so that doing nothing is not an option, and the safest course for a nervous operator is to over-remove and over-restrict rather than risk a finding of non-compliance.
The role of Ofcom
Ofcom, previously known mainly as the broadcasting and telecoms regulator, is the enforcer of the Online Safety Act, and the Act gives it formidable powers. It can demand information from companies, issue codes of practice that effectively define compliance, and impose fines of up to £18 million or ten per cent of a company's worldwide annual turnover, whichever is greater. In the most serious cases it can seek court orders requiring payment providers and internet infrastructure firms to withdraw services from a non-compliant site, a measure sometimes described as "business disruption". Senior managers can face criminal liability in defined circumstances.
This concentration of power in a regulator is one of the most significant features of the regime. Because the duties are broad and the codes are detailed and revisable, Ofcom's interpretation shapes what is permitted online for UK users more directly than the text of the Act itself. Decisions about what counts as proportionate, which age-assurance methods are acceptable, and how aggressively services must police content are, in effect, regulatory judgements rather than democratic ones. Whatever one thinks of the goals, this is a substantial transfer of authority over public discourse to an administrative body, and it deserves close scrutiny.
"Legal but harmful" and the speech question
An earlier version of the Bill would have required platforms to tackle content that was lawful but considered harmful to adults. After sustained criticism that this would license the removal of perfectly legal speech, that specific duty for adults was largely replaced with a different approach: giving adult users tools to filter content they do not wish to see, and holding platforms to their own stated terms. This was a genuine improvement, and it is worth acknowledging when criticism of the Act is otherwise sharp.
The speech concerns did not disappear, however. Because the duties are broad and the penalties severe, platforms have a strong incentive to remove anything that might plausibly be illegal or harmful rather than risk being wrong. Automated systems used at scale cannot reliably tell satire from threat, education from promotion, or reporting from endorsement. The predictable result is over-removal: lawful, valuable, or merely awkward speech caught in filters designed to catch the genuinely unlawful. This dynamic, and the wider erosion of speech it produces, is examined throughout Chapter 16 and especially in 16.3 and 16.4.
The chilling effect on small sites
Small, independent communities face a real fixed cost in understanding scope, completing risk assessments, keeping records, operating reports and complaints, and following changing codes. Some operators have publicly said they closed, restricted features, or blocked UK access because they could not justify that cost. Those examples demonstrate a burden, but they do not establish that every small forum faces the same measures or maximum enforcement risk.
Proportionality is therefore not a footnote: it is central to what a small service should actually do. Ofcom provides a digital safety toolkit aimed at smaller providers. An operator should first determine whether the service is in scope, document its feature and risk analysis, and apply measures relevant to those risks. The legitimate criticism is that doing even this takes time and judgement that a volunteer service may lack, while a large platform can spread compliance work across specialist staff.
What it means for you
For an ordinary user, the Online Safety Act mostly shows up indirectly: more age checks, more content removals, more friction, and the disappearance of some smaller communities. You cannot opt out of a law, and this guide does not suggest trying to. What you can do is understand the system you are now operating within, so that its effects do not surprise you and so that you make informed choices about where you spend your time and how much you disclose.
Practically, that means three things. First, treat large platforms as the heavily-regulated, heavily-monitored spaces they now are, and keep sensitive or easily-misread expression off them where another channel serves better, as discussed in 16.8. Second, support and use independent, privacy-respecting services where you can, since their survival is not guaranteed. Third, follow the specific measures in the rest of this chapter — age assurance in 17.2, encryption in 17.5 — because the Act is the framework, and those are the places where it touches your daily life most directly. The consolidated practical steps are in 17.7.
Primary sources: Ofcom's compliance timetable, register of categorised services, and July 2026 Category 1 consultation.