The Online Safety Act is the UK law that makes online platforms legally responsible for keeping their users safe. It puts new duties on social media companies, search engines and sites that publish pornography, and it gives the regulator Ofcom the power to fine companies that fail to protect their users. The Act became law on 26 October 2023, and its main duties have been switched on in stages since then, with the age-check rules for adult content taking effect on 25 July 2025. The government’s own explainer, published on GOV.UK, describes it as a new set of laws that protects children and adults online.

What does the Act actually do?

At its core, the Act is a duty-of-care law. Instead of only punishing harmful content after it appears, it requires services to assess the risks their platforms create and to put systems in place to reduce them. Every service in scope must carry out risk assessments for illegal content, and services likely to be used by children must also assess the risk to children. They must then act on what they find, for example by improving moderation, using automated detection, reviewing content, and giving users clear ways to report problems.

Services must remove illegal content quickly when it appears, and they must protect children from content that is harmful to them, including pornography and material that encourages suicide, self-harm or eating disorders. The largest platforms, known as Category 1 services, must also be more transparent about the kinds of potentially harmful content they allow and give adult users more control over what they see. The duties are proportionate: what a small forum must do is very different from what a global social network must do, because the rules take account of each service’s size, resources and the risks it poses.

Which services have to follow it?

The Act covers three broad kinds of service that have links with the United Kingdom. The first is user-to-user services, where people can post content or interact with each other: social media platforms, online forums, message boards, dating apps, instant messaging services, video-sharing platforms and consumer cloud storage and sharing sites. The second is search services, such as Google and Bing. The third is services on which pornographic content is published or displayed.

A service has links with the UK if it has a significant number of UK users or if UK users are one of its target markets. That means the law reaches many companies based overseas, not only British firms. The Act also creates categories of service. Category 1 covers the largest user-to-user services, Category 2A covers search services and Category 2B covers other large user-to-user services, with extra duties applying to the services in each category. The Secretary of State laid the regulations setting the thresholds for these categories on 16 December 2024, and Ofcom must keep a public register of the services in each category.

What are the age checks, and when did they start?

The age-check rules are the part of the Act most people have noticed. From 16 April 2025, services likely to be accessed by children have had to carry out children’s access assessments, working out whether children can reach their service. From 25 July 2025, services that allow pornography, and user-to-user services that allow the most harmful content for children, have had to use highly effective age assurance to stop under-18s reaching that content.

Ofcom judges an age check against four criteria: it must be technically accurate, robust, reliable and fair. Its guidance lists methods capable of meeting that standard, including photo ID matching, facial age estimation, open banking checks, checks with the user’s mobile network, credit card checks, a digital identity service and email-based age estimation. What does not count is simply asking users to tick a box saying they are over 18, or accepting an online payment that does not itself require the person to be 18. Ofcom’s July 2026 report added age inference, estimating age from a user’s behaviour, to the list of approaches that are not highly effective on their own. Services that publish their own pornographic content must also keep a written record of the age check they use and publish a plain summary of it for users.

What happens to companies that break the rules?

Ofcom can fine a company up to £18 million or 10% of its qualifying worldwide revenue, whichever is greater. Enforcement began in earnest after the children’s safety duties took effect in July 2025. Within days of the deadline Ofcom had opened investigations into dozens of adult sites, and by early 2026 it had opened investigations into more than 90 platforms. The first fine, £1 million against AVS Group, landed in December 2025 for failing to put robust age checks on its adult websites. In February 2026 Ofcom fined 8579 LLC £1.35 million and Kick Online Entertainment £800,000. In the summer of 2026 it opened investigations into TikTok’s age inference and Aylo’s reliance on Apple’s age signals, and on 23 September 2026 it announced an investigation into the provider of Pornhub. In the most serious cases Ofcom can also ask a court to order other businesses to stop providing services to a non-compliant site.

What does it mean for ordinary users?

For most people the most visible change is the age check that now appears before adult content, and clearer reporting tools on the services they use every day. The largest platforms must give adults more control over the kinds of content they are shown, and parents and children must have clear and accessible ways to report problems when they arise. One thing the Act does not do is put Ofcom in charge of removing individual posts: Ofcom regulates the systems and processes services use, and it is the services themselves that must remove illegal content. The rules are also rippling beyond social media. Separate reports this weekend say online marketplaces are tightening their age rules for under-16 sellers, a sign of how the wider safety framework is now shaping everyday online services.

What is still to come?

The Act is not yet fully in force. The House of Commons Library notes that it is expected to be fully implemented by mid-2027, with Ofcom publishing codes of practice and guidance in phases. The illegal harms duties have been in force since March 2025, when Ofcom’s Illegal Harms Codes came into effect, and the child protection duties have applied since the end of July 2025. The criminal offences the Act created, including encouraging or assisting serious self-harm, came into effect earlier, on 31 January 2024. In 2026 the government also opened a consultation on a safer digital childhood, including proposals that would reach further than the current rules, so the framework is still being tightened. Anyone running an online service, or using one, should expect the requirements to keep developing as Ofcom’s enforcement programme continues.

Frequently asked questions

Do I need ID to use social media? No. There is no blanket ID requirement for ordinary social media use. Highly effective age checks apply to pornographic content and to the content the Act treats as most harmful to children, not to everyday posting, messaging or browsing.

Can Ofcom remove a post or video? No. Ofcom does not decide on individual pieces of content. Its job is to make sure services have proper systems for removing illegal content and protecting children, and to take enforcement action when those systems are missing or fail.

Does the Act cover private messages? Messaging services are in scope for some of the Act’s duties, including the illegal content duties. However, the Act does not require providers to break end-to-end encryption, and the government has said it will not use its powers in a way that would do so.