The Online Safety Act: age checks and new platform duties

The Online Safety Act 2023 is a UK law that, for the first time, places a legal duty on internet services to keep users safe — above all children. It received Royal Assent on 26 October 2023, and the main duties were phased in across 2024 and 2025.

Who does the law apply to?

It covers search services and platforms where users post content or interact: social media, forums, video-sharing sites, file-sharing services, dating services and messaging apps. It also applies to overseas services if they have a significant UK audience or target the UK as a market.

ADV · A003We build websites for tradespeople and sole traders — £219Customers see your work and prices and message you straight away. Ready in 3 days, £219 instead of £438.Advertise here

What must services do?

Platforms must assess and reduce the risk that illegal content spreads through them, and remove it when it appears. A separate strand is child protection: services must shield under-18s from the most dangerous content (Primary Priority Content — pornography, and material promoting self-harm, eating disorders and suicide) and give age-appropriate access to other harmful content such as bullying, serious violence and dangerous challenges.

How do the age checks work?

Services that publish their own pornographic content must introduce robust age checks that meet the requirements of the regulator, Ofcom. The provision for these checks (section 81) came into force on 17 January 2025, and Ofcom published its age assurance guidance in January 2025. If a platform sets a minimum age, it must state in its terms how it enforces it and apply it consistently.

What does it mean for an ordinary user?

For most people the law means more visible protection tools. The largest services (so-called Category 1) must give adult users extra options: to limit exposure to legal but potentially harmful content, and to filter out messages from non-verified accounts. All platforms should have clear ways to report content and block unwanted interactions. During 2025, services likely to be accessed by children carried out children's risk assessments, and the full child-safety regime took effect by the summer. In practice that means stricter default settings for teenagers and faster responses to complaints.

What are the penalties?

Ofcom is the regulator. It issues codes of practice and can fine breaches up to £18 million or 10% of global revenue, whichever is greater. In extreme cases, with a court's agreement, Ofcom can require payment providers, advertisers and internet providers to stop working with a service, effectively cutting it off from money or UK access. Senior managers can also face personal liability for certain failures.