TL;DR
The UK Online Safety Act 2023 introduces age verification requirements and content standards for social media platforms. This guide explains what the legislation covers, what Ofcom is requiring, and what it means for users and platforms.
UK Finance | Money Guides
The Online Safety Act 2023 received Royal Assent on 26 October 2023 and represents the most significant piece of internet regulation in UK legislative history. It places duties on providers of user-to-user services and search services to prevent access by children to certain categories of harmful content, to tackle illegal content, and to provide greater transparency about how platforms moderate content.
What the Act Requires
Services designated as Category 1 (the largest platforms) face the most extensive obligations under the Act. These include duties to protect children from harmful content, to prevent the spread of illegal content, and to maintain systems allowing adult users to filter or control the content they see. Ofcom, the communications regulator, is responsible for implementing and enforcing the Act.
The Act introduces new criminal offences including the sending of communications with intent to cause harm, the sharing of intimate images without consent, and the encouragement of self-harm. These offences apply to individuals as well as to platform operators who fail to meet their duties.
Age Verification
A key element of the Act is the requirement for platforms to implement age assurance measures to prevent children from accessing content that is harmful to them. Ofcom published its Children's Safety Codes in early 2025 setting out the technical standards expected of platforms. Age assurance can take a variety of forms including open standards age estimation, document-based verification, or account-based verification via mobile operators.
The Act does not prescribe a specific age verification technology. Ofcom's approach is outcomes-based, requiring platforms to demonstrate that their age assurance measures are effective, rather than mandating a specific method.
Who Is Covered
The Act applies to any service that allows users to generate, share, or interact with user-generated content, or which connects users with other users, if that service has links to the UK. This includes social media platforms, video sharing services, forums, online marketplaces, and gaming platforms with communication features. Purely internal corporate services and email are excluded.
Enforcement
Ofcom has power to fine platforms up to 10 percent of global annual turnover for breaches of their duties under the Act. In serious cases involving persistent failure, Ofcom can apply to a court to block access to a service in the UK. Senior managers at platforms can be held personally liable for certain failures. Ofcom published its first enforcement notices under the Act in late 2024.
What It Means for Users
Adult users may encounter age verification prompts or additional friction when accessing certain content on platforms subject to age assurance requirements. Users have rights under the Act to complain to platforms about content moderation decisions, and platforms are required to provide accessible complaints mechanisms. Ofcom operates a complaints process for users who believe a platform has not met its legal duties.
Frequently Asked Questions
Does the Online Safety Act ban social media for under-18s?
No. The Act requires platforms to implement age assurance measures and to protect children from harmful content. It does not ban social media for people under 18.
What is Ofcom's role under the Online Safety Act?
Ofcom is the designated regulator responsible for implementing and enforcing the Online Safety Act. It publishes codes of practice, issues enforcement notices, and can fine platforms up to 10 percent of global turnover for breaches.
Which platforms are covered by the Online Safety Act?
Any service allowing user-generated content or user connections with links to the UK is in scope. This includes major social media platforms, video sharing services, forums, and many gaming platforms. Email and internal corporate tools are excluded.
