What Is the Online Safety Act? The UK's Internet Rules, Explained

What is the Online Safety Act?

It is a UK law that puts safety duties on online services rather than on users. Services that host user content or run search must assess the risks on their platform, remove illegal content, and shield children from harmful material, with Ofcom as the regulator and fines of up to 18 million pounds or 10 percent of worldwide revenue for failures.

The Act received Royal Assent on 26 October 2023 after years of drafts and debate. The core idea is a duty of care: the law does not generally tell you what you can post, it tells platforms what systems they must run. The government's own explainer ↗ frames it as making companies more responsible for their users' safety, with the strongest protections aimed at children.

Who does the Online Safety Act apply to?

It applies to user-to-user services and search services with links to the UK, wherever the company is based. That covers social media, video platforms, forums, dating apps, messaging services, cloud storage with sharing, and sites that publish pornography.

A service is in scope if it has a significant number of UK users, treats the UK as a target market, or poses a material risk of harm to people here. So an American social network or a forum run from anywhere can still owe duties to its UK users. Duties scale with size and risk: the largest, riskiest services will face extra obligations as categorised services, which is the part of the regime still being rolled out.

What has actually changed for ordinary users?

The Act arrived in stages, so the changes you have noticed came at different times. The short version: new criminal offences in 2024, illegal-content duties in March 2025, and child-safety duties with age checks from July 2025.

• -From 31 January 2024: new criminal offences took effect, including cyberflashing, threatening communications, and sending false information intended to cause harm
• -From 17 March 2025: platforms had to have completed illegal content risk assessments, and Ofcom began enforcing ↗ the illegal content duties
• -From 25 July 2025: the Protection of Children codes came into force, and services that allow pornography had to bring in highly effective age assurance

For most people, the visible change is the last one. Content feeds aimed at teenagers are supposed to be filtered for material like self-harm and pornography, and adult sites now stand behind an age gate.

Why do so many sites ask me to verify my age now?

Because since 25 July 2025 the Act requires services that host or allow pornography to check that users are adults, using methods Ofcom accepts as highly effective. Ticking a box that says you are 18 no longer counts.

In practice that means uploading photo ID, letting a camera estimate your age, or confirming adulthood through your bank or mobile provider, usually via a third-party verification company. That hand-over of ID documents and face scans is its own privacy question, and I unpack it in is UK age verification safe. The age gates also triggered a huge spike in VPN sign-ups, and a wave of confused headlines about VPNs being outlawed, which I fact-check in is the UK actually banning VPNs. Short version: no, VPNs remain legal.

What are the criticisms of the Online Safety Act?

The main criticisms are about privacy, encryption, and speech. The sharpest fight is over Section 121, which lets Ofcom order a platform to use accredited technology to scan for child sexual abuse content, even in private messages.

Critics call Section 121 ↗ the spy clause, because scanning inside an end-to-end encrypted app would mean weakening the encryption for everyone. Signal and WhatsApp both said during the Bill's passage that they would leave the UK rather than break their encryption. The government told Parliament in September 2023 that the power would not be used until scanning was technically feasible without compromising privacy, and no such notice has been issued. The power remains on the statute book, which is exactly why campaigners like the Open Rights Group and Amnesty International keep watching it.

On speech, critics argue the compliance burden pushes platforms to over-remove content to stay safe, and some small volunteer-run forums shut down or blocked UK users rather than take on the risk-assessment paperwork. Supporters counter that the Act targets systems, not opinions, and that children were the point. Both things can be true: the duties are aimed at design, and the cost of them lands unevenly. One thing the Act is often blamed for but does not do: police live facial recognition in public spaces is not part of this law at all, it runs under separate police powers, covered in UK police facial recognition explained.

Is the under-16 social media ban part of the Act?

No. The ban on social media for under-16s announced in June 2026 is a separate government plan, not a duty in the Online Safety Act, and it is not law yet.

The two get merged constantly in coverage, so it is worth being precise. The Online Safety Act is law and its duties are in force. The under-16 ban was announced on 15 June 2026 as government policy, to be delivered through regulations expected to take effect around Spring 2027. What was announced, which apps are covered, and what changes for 16 and 17-year-olds is all in the UK under-16 social media ban explained.

What is coming next?

The remaining big piece is the categorised services regime, the extra duties for the largest platforms, which Ofcom is rolling out through 2026.

• -Ofcom expects to publish the register of categorised services in July 2026, formally naming which platforms carry the extra Category 1, 2A, and 2B duties
• -Categorised services face further deadlines through late 2026, including updated risk assessments and published risk summaries
• -Extra duties for the biggest platforms will include transparency reporting and, for Category 1, user tools such as verification options
• -Separately, the under-16 social media regulations are expected in Parliament by the end of 2026, and ministers have said they may consider measures on VPNs. Both are proposals until passed

The pattern to expect: more services checking who you are, more often. Whatever you think of the aims, the mechanics of this law run on identity.

That is the thread that connects the Act to you personally. Age checks, verification providers, and account sign-ups all grow your digital footprint, and that footprint, the accounts, breached credentials, and public records already attached to your name and email, is the part you can actually see and shrink. Clearfront scans it in one sweep, free and open source, on your own machine, so none of it leaves your hands. Install Clearfront free and see what is already out there before the next age gate asks who you are, or get the free removal guide to start clearing what turns up.