Online Safety Act 2023
United Kingdom · Law · UK Parliament
Our summary
Legislation establishing duties on social media platforms, search services and user-generated content websites to protect users from illegal activity and harmful content. The law requires platforms to assess risks, remove illegal content, and implement safety measures; it grants Ofcom authority to regulate compliance through codes of practice and enforcement. Enhanced protections apply to children, while adult users gain tools for controlling content exposure.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
24 sections
Jump to a chapter
- What does the Online Safety Act do?
- Who the Act applies to
- How the Online Safety Act is being implemented
- The new offences that the Act has introduced
- Types of content the Act tackles
- Age-appropriate experiences for children online
- Adults will have more control over the content they see
- The Act will tackle suicide and self-harm content
- How the Act will be enforced
- How the Act affects companies that are not based in the UK
- How the Act will tackle harmful algorithms
- How the Act protects women and girls
- How the Act tackles Misinformation and Disinformation
- Independent Review of Pornography Regulation, Legislation and Enforcement
- Is this page useful?
What does the Online Safety Act do?
The Act imposes duties on platforms and search services to protect users from illegal activity and harmful content. For children specifically, platforms must prevent access to unsuitable material and provide transparent reporting tools. Adults gain the right to know what potentially harmful content services permit and to exercise greater discretion over their feed.
Who the Act applies to
Applies to search services and platforms enabling user-generated content or interaction, including social media, cloud storage, video platforms, forums, dating services, and messaging apps. The Act covers services outside the UK if they target UK users, have a significant UK user base, or are accessible to UK users with material risk of significant harm.
How the Online Safety Act is being implemented
Passed into law on 26 October 2023 with phased implementation led by Ofcom. Illegal content duties are now enforced as of 17 March 2025 with providers' risk assessment deadline of 16 March completed. Child safety duties require providers to implement age checks for pornographic content by 17 January 2025 and complete children's access and risk assessments by 16 April and 24 July 2025 respectively.
The new offences that the Act has introduced
The Act created six criminal offences that took effect on 31 January 2024: promoting serious self-injury, cyberflashing, spreading false information intended to cause significant harm, threatening messages, non-consensual intimate imagery, and photosensitive seizure trolling. These apply to individuals who commit them, and prosecutions have already succeeded under the cyberflashing and threatening communications rules.
Types of content the Act tackles
2 sections
The Act addresses illegal content and content harmful to children.
Illegal content
Requires all companies to implement measures reducing risks of illegal activity and systems for removing illegal content, with search services having similar reduction duties. Platforms must proactively protect against priority offences and remove any other illegal content with individual victims when flagged or discovered. Illegal content types include child sexual abuse, coercive behaviour, extreme sexual violence and pornography, fraud, racially or religiously aggravated offences, inciting violence, illegal immigration, suicide promotion, intimate image abuse, illegal drugs or weapons sales, sexual exploitation, and terrorism.
Content that is harmful to children
Requires in-scope companies likely to be accessed by children to protect them from harmful and age-inappropriate content. Children must be prevented from Primary Priority Content and given age-appropriate access to Priority Content.
Primary Priority Content
Priority Content
Age-appropriate experiences for children online
Social media companies must assess child safety risks, set appropriate age restrictions, and specify in terms of service what age-enforcement measures are used, enforcing them consistently to ensure age-appropriate experiences and protection from harmful content.
Adults will have more control over the content they see
Category 1 services must offer adult users optional tools to verify identity, reduce contact from non-verified users, and control exposure to legal content encouraging suicide, self-harm, eating disorders, and abusive or hate content including racist, antisemitic, homophobic, or misogynist material. Tools must be effective and easily accessible.
The Act will tackle suicide and self-harm content
How the Act will be enforced
Ofcom monitors platform compliance and can impose penalties: fines of up to 18 million pounds or 10 percent of annual qualifying worldwide revenue, whichever is higher. Senior managers who ignore Ofcom information requests face criminal prosecution. Ofcom can hold companies and managers criminally liable for non-compliance with enforcement notices on child safety and child sexual abuse duties.
How the Act affects companies that are not based in the UK
Ofcom has powers to enforce against all in-scope companies regardless of location if their services have relevant UK links, including having significant UK users or targeting UK markets, or providing in-scope content presenting significant harm risk to UK people.
How the Act will tackle harmful algorithms
Services must assess how algorithmic systems could drive users toward illegal content or expose children to harmful material, then adopt measures to mitigate such risks through platform design and features. The law recognises that distributing content algorithmically in high volumes to a child in short timeframes can cause harm. Large services must disclose annually what algorithms they employ and how these shape user experience, particularly for children.
How the Act protects women and girls
How the Act tackles Misinformation and Disinformation
The Act addresses false and misleading information that is either illegal or harmful to children, requiring services to remove illegal disinformation including state-sponsored falsehoods under the Foreign Interference Offence. Services accessible to children must provide safeguards against in-scope false and misleading information. Large platforms must also remove certain false and misleading material that breaches their published rules.
Independent Review of Pornography Regulation, Legislation and Enforcement
1 section
The government commissioned an independent review, led by Baroness Gabby Bertin since December 2023, to examine how online and offline pornography is regulated, legislated and enforced, reflecting changes in media consumption over two decades. The final report with recommendations was published on 27 February 2025 and is currently under government assessment.
Background information: useful websites
Legislation
Notices
Guidance and letters (including Ofcom advice and DSIT Secretary of State letters)
Consultations and Calls for Evidence (including relevant Ofcom consultations)
Is this page useful?
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 0 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 0 are shown.
Change history
No changes recorded since we began monitoring this policy.