Quick answer
The 60-second version
- Who has new duties?
- Mainly websites, apps and search services—not individual users.
- What must they do?
- Understand risks, tackle illegal material and give children extra protection where the rules apply.
- Will everyone upload ID?
- No. Some services need strong age checks, but age assurance can use several methods.
- Who enforces it?
- Ofcom, the UK communications regulator.
- What still matters?
- Safety measures must also respect privacy, lawful expression and proportionality.
In the law Summary checked against the Act and Ofcom’s implementation roadmap. source source
What the Act is for
In the lawThe Online Safety Act 2023 received Royal Assent on 26 October 2023. “Online Harm Bill” is this project's campaign name; the legislation itself is an Act. Its general purpose is to make regulated internet services safer, with particular protection for children, while also addressing freedom of expression and privacy. source
Different provisions began operating at different times. Ofcom's roadmap is the clearest high-level guide to duties already in force and regulatory work still under way. source
What happened when
- Royal AssentThe Bill becomes the Online Safety Act 2023.
- Illegal-harms phaseOfcom publishes core codes and guidance, followed by commencement of relevant duties.
- Protection of childrenRelevant child-safety duties begin operating.
- Technology-notice frameworkOfcom publishes final guidance and accuracy advice; further steps remain.
- CategorisationThe first Category 1, 2A and 2B register is published.
- This snapshotFuture codes, statements and transparency work remain scheduled into 2027.
Which websites and apps are covered?
In the lawThe regime principally covers qualifying user-to-user services and search services with links to the UK. A user-to-user service is one where content generated, uploaded or shared by one user can be encountered by another. Pornography-provider duties also apply in specified circumstances. Scope turns on functionality and UK links, not simply on where a company is incorporated. source
| Service pattern | Starting question | What matters |
|---|---|---|
| Forum, social network or game chat | Can one user's content reach another? | Functions, users, content risks and UK links |
| Search engine | Does it search more than one site or database? | Search functionality and UK users |
| Publisher comments | Is user interaction limited to provider content? | The exact limited-function exemption and its conditions |
| Internal business tool | Is access limited to an organisation's people? | The internal-business exemption conditions |
This guide is public information, not legal advice. Providers should use Ofcom's scope tools and obtain advice where necessary. source
Conditional exemptions
Schedule 1 contains exemptions for particular service patterns, including email-only, SMS/MMS-only, one-to-one live audio, limited user interaction, internal business, public-body and certain education or childcare services. The conditions and exceptions matter: “email is exempt” is too broad if a service has other user-to-user functions. source
What providers have to do
Assess risk
Complete and keep up to date the risk assessments that apply to the service.
Reduce harm
Use proportionate systems and processes for illegal content and, where relevant, content harmful to children.
Explain and respond
Maintain terms, reporting and complaints arrangements required for the service.
Record and review
Keep required records, review measures, and respond to Ofcom's lawful information requests.
Exact duties vary by service. Category 1, 2A and 2B services have additional duties; the first register was published in July 2026. source source
Enforcement
In the lawOfcom can investigate, require information, issue confirmation decisions and impose financial penalties. In specified serious circumstances the Act also provides for business-disruption measures through the courts. These are powers with procedures and statutory tests—not automatic consequences of a mistake. source
Expression, privacy and proportionality safeguards
The Act requires providers and Ofcom to consider freedom of expression and privacy in several parts of the regime. Measures must be proportionate, and provider size and capacity can be relevant. Technology notices have additional necessity, proportionality, accuracy and process safeguards. source source
Our view Safeguards matter only if their operation can be tested. We want transparent decisions, independent technical scrutiny, accessible appeals and published evidence of outcomes.
Common questions
Is this still a Bill?
No. The Online Safety Bill became the Online Safety Act 2023 on 26 October 2023.
Does the Act require everyone to upload ID?
No. Age assurance uses different methods, and the appropriate method depends on the duty and risk. Some methods may use identity documents; others do not.
Does every website have the same duties?
No. Duties depend on service functionality, risk, likely child access and category. Proportionality is part of the framework.
Has Ofcom ordered all encrypted messages to be scanned?
No such blanket order is established in the official sources checked for this site. The Act contains a targeted technology-notice power, but standards, accreditation and an actual notice are distinct stages.
Short glossary
- Age assurance
- Methods for establishing or estimating age, or whether someone is above a threshold.
- Categorised service
- A service entered on Ofcom's register as Category 1, 2A or 2B and subject to corresponding additional duties.
- CSEA content
- Child sexual exploitation and abuse content, as addressed in the Act.
- User-to-user service
- A service where content generated, uploaded or shared by one user may be encountered by another user.
- Technology notice
- A notice under section 121 requiring specified action using accredited technology, subject to statutory conditions.
Sources for this page
- Regulator statement
Ofcom. Ofcom's approach to implementing the Online Safety Act.
Ofcom's implementation roadmap, milestones, active duties and planned regulatory work, updated in July 2026. Published 26 October 2023; last checked 8 August 2026.
- Regulatory guidance
Ofcom. Online Safety Act compliance guide for providers of online services.
Practical regulatory guidance for services on deciding whether the Act applies and meeting their duties. Published 16 December 2024; last checked 8 August 2026.
- Regulator statement
Ofcom. Register of categorised services and list of emerging Category 1 services.
The statutory register published in July 2026, with Category 1, 2A and 2B services and applicable thresholds. Published 30 June 2026; last checked 8 August 2026.
- Regulator statement
Ofcom. Statement: Technology Notices.
Ofcom's final guidance on exercising technology-notice powers and advice on minimum accuracy standards. Published 8 May 2026; last checked 8 August 2026.
- Primary legislation
UK Parliament. Online Safety Act 2023.
The current consolidated text of the Act, including regulated services, duties, enforcement powers, safeguards and exemptions. Published 26 October 2023; last checked 8 August 2026.