17.1 The Online Safety Act in practice

Status reviewed 22 September 2026. The illegal-content and child-safety duties described below are in force. Ofcom's categorised-services register was last updated on 14 August 2026; several additional Category 1 duties are still the subject of consultation and implementation work.

What the Act is

The Online Safety Act 2023 received Royal Assent in October 2023 and has been brought into force in stages since. It is the single most consequential internet law the UK has passed.

Its stated purpose is to make the UK "the safest place in the world to be online", chiefly by requiring online services to protect users, especially children, from illegal content and material judged harmful. Most of the restrictions elsewhere in this chapter either flow from it or sit alongside it.

The Act does not ban particular words or images directly. Instead it imposes legal "duties of care" on the companies that run online services. The duties are deliberately broad and outcome-focused: assess the risks your users face and take proportionate steps to reduce them.

What "proportionate" means in practice is filled in by the regulator, Ofcom, through codes of practice and guidance. That matters: the real rules are set by a regulator interpreting open-ended duties, not by Parliament line by line, a process that is faster to change and harder for the public to follow.

Who it applies to

The Act regulates defined kinds of service with a relevant link to the UK, chiefly:

• user-to-user services;
• search services;
• services publishing their own pornographic content.

Social networks, messaging and sharing services, forums, parts of gaming and dating services, and search engines can fall within those definitions, including providers based abroad.

Myth: every website with a UK visitor is regulated. Reality: there are statutory exclusions or qualifications for email, SMS and MMS, limited-functionality services, some internal business services, news-publisher content and other activities. Scope turns on the service's actual features, not a label like "small website" or "community".

Size does not create a general exemption, but the regime is risk-based and leans on proportionality throughout.

• A small low-risk service is not expected to deploy every measure a very large high-risk platform uses.
• A small service can still have material duties, particularly risk assessment, record keeping, reporting and action against illegal content.

The additional categorised-service regime is narrower. Ofcom published the first Category 1, 2A and 2B register on 10 July 2026 for services meeting statutory thresholds.

Category 1 brings further duties on user choice, identity verification, terms, complaints, journalistic and democratic content, and freedom-of-expression and privacy assessments. Ofcom was still consulting on parts of that implementation at this review date.

What services must now do

An in-scope service is now expected to:

• carry out and document risk assessments;
• put systems in place to detect and remove illegal content;
• give users ways to report problems;
• enforce its own terms of service consistently;
• where children can access it, protect them from a defined set of harms.

When the duties arrived:

• January 2025: pornography duties for providers publishing their own content.
• March 2025: illegal-content duties, requiring action against material such as terrorism content, child sexual abuse material, fraud and incitement.
• July 2025: wider child-safety duties for user-to-user services.

These are the duties that brought mandatory age checks into everyday life for affected services.

The result is a lot of new machinery: automated scanning and filtering, age-assurance systems, reporting tools and compliance teams. Large companies can absorb the cost. For small ones it can decide whether they keep operating at all.

The Act does not prescribe specific tools, but doing nothing is not an option. So the safest course for a nervous operator is to over-remove and over-restrict rather than risk a finding of non-compliance.

The role of Ofcom

Ofcom, previously known mainly as the broadcasting and telecoms regulator, enforces the Act, and its powers are formidable:

• demanding information from companies;
• issuing codes of practice that effectively define compliance;
• fines of up to £18 million or ten per cent of worldwide annual turnover, whichever is greater;
• in the most serious cases, seeking court orders requiring payment providers and internet infrastructure firms to withdraw services from a non-compliant site ("business disruption").

Senior managers can face criminal liability in defined circumstances.

Enforcement is no longer merely prospective. In its 28 August compliance update, Ofcom said its small-but-risky-services team had led seven services dedicated to particularly harmful content to block UK access. Other services introduced age checks or changed moderation and reporting systems.

Those outcomes do not create new legal duties, and a provider's decision to geo-block is not the same as a statutory blocking order. They do show that supervision can change access before, or without, a completed formal enforcement case.

This concentration of power is one of the regime's most significant features. Because the duties are broad and the codes detailed and revisable, Ofcom's interpretation shapes what UK users can do online more directly than the Act's own text.

What counts as proportionate, which age-assurance methods are acceptable, how aggressively services must police content: these are, in effect, regulatory judgements rather than democratic ones. Whatever you think of the goals, it is a substantial transfer of authority over public discourse to an administrative body, and it deserves close scrutiny.

"Legal but harmful" and the speech question

An earlier version of the Bill would have made platforms tackle content that was lawful but considered harmful to adults. After sustained criticism that this would license removing perfectly legal speech, that adult duty was largely replaced with a different approach:

• tools for adult users to filter content they do not want to see;
• holding platforms to their own stated terms.

That was a genuine improvement, worth acknowledging when criticism of the Act is otherwise sharp.

The speech concerns did not disappear, though. Broad duties plus severe penalties give platforms a strong incentive to remove anything that might plausibly be illegal or harmful rather than risk being wrong.

Automated systems at scale cannot reliably tell satire from threat, education from promotion, or reporting from endorsement. The predictable result is over-removal: lawful, valuable or merely awkward speech caught in filters built for the genuinely unlawful.

This dynamic, and the wider erosion of speech it produces, runs throughout Chapter 16, especially 16.3 and 16.4.

The chilling effect on small sites

Small, independent communities face a real fixed cost: understanding scope, completing risk assessments, keeping records, handling reports and complaints, and keeping up with changing codes.

Some operators have publicly said they closed, restricted features or blocked UK access because they could not justify that cost. Those examples show a burden, but they do not prove every small forum faces the same measures or maximum enforcement risk.

Proportionality is central, not a footnote, to what a small service should actually do. Ofcom provides a digital safety toolkit aimed at smaller providers. A sensible order for an operator:

• work out whether the service is in scope;
• document its features and risk analysis;
• apply measures relevant to those risks.

The legitimate criticism: even this takes time and judgement a volunteer-run service may lack, while a large platform spreads the work across specialist staff.

What it means for you

For most people the Act shows up indirectly: more age checks, more removals, more friction, and some smaller communities disappearing.

You cannot opt out of a law, and this guide does not suggest trying. What you can do is understand the system you now operate in, so its effects do not surprise you and you can choose where you spend your time and how much you disclose.

In practice, three things:

• Treat large platforms as the heavily regulated, heavily monitored spaces they now are. Keep sensitive or easily misread expression off them where another channel serves better, as discussed in 16.8.
• Support and use independent, privacy-respecting services where you can, since their survival is not guaranteed.
• Follow the specific measures in the rest of this chapter (age assurance in 17.2, encryption in 17.5). The Act is the framework; those are where it touches your daily life most directly.

The consolidated practical steps are in 17.7.

Primary sources: Ofcom's compliance timetable, register of categorised services, Category 1 consultation, and 28 August 2026 compliance update.