UK Online Safety Act

United Kingdom Online platforms

Status

In force. Royal Assent 26 Oct 2023; duties phased in by Ofcom codes and commencement regulations. Part 5 age checks since 17 Jan 2025; illegal content duties enforceable since 17 Mar 2025; child-safety duties since 25 Jul 2025; CSEA reporting to the NCA (user-to-user services) since 7 Apr 2026. Most extra duties for categorised services are still being consulted on (final statements expected by mid-2027).✓OSA 2023 introduction (Royal Assent); s.81; ss.9-10; ss.35-37; s.66; SI 2026/262 · Sources: ofcom.org.uk, legislation.gov.uk, bratby.law

Who it applies to

User-to-user services (social media, forums, messaging, gaming, dating, file-sharing, etc.), search services, and providers that publish their own pornographic content (Part 5), wherever based, if they have UK links: a significant number of UK users; the UK as a target market (or the only one); or the service can be used in the UK and there is a material risk of significant harm to people in the UK. Some services are exempt (Sch 1 and 2).✓OSA 2023 s.4(2)-(6); Sch 1-2; Part 5 (s.79-81) · Sources: legislation.gov.uk, jenner.com, gov.uk

Size thresholds

No size threshold for core duties. Extra duties for categorised services (SI 2025/226), by average monthly active UK users: Category 1 = user-to-user with a recommender system and >34m users, or >7m users plus resharing; Category 2A = search >7m users (not narrow vertical search); Category 2B = user-to-user with direct messaging and >3m users. Ofcom published the register in July 2026 (10 Category 1, 4 Category 2A, 25 Category 2B services, plus 4 on an 'emerging Category 1' list). Fees: providers with qualifying worldwide revenue (QWR) of £250m or more must notify Ofcom and pay fees (SI 2025/1204), unless UK referable revenue is under £10m.✓Threshold Conditions Regs 2025 (SI 2025/226) regs 3-5; OSA s.95-96; Fees (Threshold Figure) Regs 2025 (SI 2025/1204); OSA Part 6 · Sources: legislation.gov.uk, ofcom.org.uk, ofcom.org.uk, api.parliament.uk

Regulator

Ofcom (Office of Communications)✓OSA 2023 s.1 & Part 7 · Sources: gov.uk, ofcom.org.uk, bratby.law

Breach or incident reporting

No general incident-notification duty. Since 7 Apr 2026, regulated user-to-user services must report detected, unreported child sexual exploitation and abuse (CSEA) content to the National Crime Agency (UK providers: all such content; non-UK providers: UK-linked content), in the form and timeframes set by SI 2026/268. Content already reported to a qualifying foreign body such as NCMEC need not be re-reported. The duty is not yet applied to search services.✓OSA 2023 s.66-67; SI 2026/262 (commencement); SI 2026/268 (CSEA reporting regs) · Sources: legislation.gov.uk, ofcom.org.uk, zwillgen.com

Data protection officer

Ofcom's illegal content codes say every service should name an individual accountable to its most senior governance body for the illegal content safety duties and reporting and complaints duties (ICU A2 / ICS A2). Small services without a board can report to a senior manager responsible for online safety.✓Illegal content codes for U2U services, ICU A2 (search: ICS A2); OSA s.41 · Sources: ofcom.org.uk, fieldfisher.com

Local representative

No UK-representative requirement was found in the Act. Ofcom can require a provider to name a senior manager in an information notice (s.103); that person can be criminally liable if the company fails to comply and they did not take all reasonable steps to prevent it (s.110).✓OSA 2023 s.103 (naming a senior manager); s.109-110 (offences) · Sources: legislation.gov.uk, kangssolicitors.co.uk, gov.uk

Cookies and consent

Age assurance, not consent. Part 5 porn publishers must use highly effective age assurance (since 17 Jan 2025). Since 25 Jul 2025, services likely to be accessed by children must meet the child-safety duties; services that allow pornographic content must use highly effective age assurance to stop children readily accessing it.✓OSA 2023 s.81 (Part 5); s.12 & Ofcom Protection of Children Codes; Ofcom age assurance guidance · Sources: ofcom.org.uk, ofcom.org.uk, bratby.law, jenner.com

Maximum penalty

Up to £18 million or 10% of qualifying worldwide revenue, whichever is greater (Sch 13 para 4). Ofcom can also impose daily penalties and, with a court order, business disruption measures requiring payment, advertising or internet access providers to stop working with a service or block it in the UK. Senior managers can face criminal liability for certain information and enforcement failures.✓OSA 2023 Sch 13 para 4(1); ss.144-148 (business disruption); ss.109-110 · Sources: legislation.gov.uk, gov.uk, ofcom.org.uk, techinsights.linklaters.com

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

• Check whether your service has UK links and falls in scope.
• Complete and record an illegal content risk assessment; redo it before significant changes.
• Apply Ofcom's illegal content codes, including naming an accountable individual.
• Do a children's access assessment; if children are likely users, do a children's risk assessment and apply the child-safety codes.
• Use highly effective age assurance where you host or publish pornography.
• Report detected CSEA content to the NCA (user-to-user services).
• Notify Ofcom and pay fees if qualifying worldwide revenue is £250m or more.

Recent changes

Ofcom published the register of categorised services in July 2026; Category 1 and 2A services must give Ofcom risk assessment records by Oct 2026 and publish summaries by Nov 2026. Wikipedia is on the 'emerging Category 1' list, not the register, after the High Court dismissed the Wikimedia Foundation's challenge to the threshold rules in Aug 2025. Fees regime live: 2026/27 notifications closed 11 Apr 2026, invoices from autumn 2026. CSEA reporting began 7 Apr 2026. Crime and Policing Act 2026 added a 48-hour takedown duty for reported intimate image content (from 29 Jun 2026). Enforcement: 8579 LLC fined £1.4m (Feb 2026); a suicide forum fined £950,000 (May 2026), which remains unpaid and is geoblocked, with no business disruption order sought; Ofcom opened an investigation into Meta's Instagram Instants risk assessments (6 Oct 2026).✓

Sources

• Primary source: https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/important-dates-for-online-safety-compliance
• Second source: https://bratby.law/online-safety-act-duties/
• Regulator: Ofcom (Office of Communications)

✓ = confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.