The Online Safety Act: What you need to know now

The Online Safety Act (the Act) came into force in October 2023, introducing a set of important new rules for certain online services operating in the UK that fall within its scope.

Ofcom, the UK’s communications regulator, is responsible for enforcing the Act. As the legislation is being rolled out in phases, Ofcom will continue to release guidance and codes of practice to help businesses understand their obligations and how to meet them.

Staying informed and acting promptly is essential to ensure your organisation remains compliant. If you're unsure about your responsibilities under the Act or need support to prepare for the changes, our data protection solicitors are here to guide you through the process.

So, what's the latest?

Illegal content duties

In December 2024, Ofcom published its illegal content Codes of Practice and supporting guidance, focusing on how platforms must deal with criminal content.

Services in scope, including user-to-user services and search engines, were required to complete their risk assessments by March 16, 2025. From 17 March onwards, they have been expected to take active steps to reduce illegal content, such as terrorism, child sexual abuse material and fraud.

If this applies to you, it means you now need to implement appropriate safety measures – either by following Ofcom’s guidance or adopting equally effective alternatives. Ofcom has already initiated its first investigation under the Online Safety Act, signalling that enforcement is underway.

Protecting children online: new guidance and deadlines

Ofcom has also released its final statement and guidance on children’s risk assessments for services likely to be accessed by children under 18. This has triggered some key new deadlines.

By 24 July 2025, if your platform is in scope and could be used by children, you must complete and record a ‘children’s risk assessment’ outlining the potential harms they might face. If Ofcom’s children’s safety codes are approved by Parliament by 25 July, you’ll then need to introduce measures in line with those codes – or show that your alternative approach is equally effective.

These rules are broad and cover actions you’ll need to take to identify and manage risks to children. While it’s not mandatory to follow Ofcom’s codes, doing so provides a clear route to compliance with the Act.

Ofcom has stated that it plans to use its powers proactively, and we expect a strict approach to non-compliance, particularly where children’s safety is concerned.

Time to act

If your platform falls within the scope of the Act and could be accessed by children, you’ll need to act quickly to meet your legal duties.

David Sant, Senior Commercial Technology & Data Protection Solicitor, comments:

“The Online Safety Act is now in force, and some obligations are already enforceable. Ofcom can issue fines of up to £18 million or 10% of global turnover – whichever is higher. This isn’t about ticking boxes. It’s about keeping people safe and protecting your reputation. There has been huge ongoing public concern and scrutiny around child safety and the real-world impact of harmful content. Failing to comply with these critical rules can result in not just legal risks but catastrophic brand damage. So don’t see this as a burden, see this as a chance to build safer platforms to make the digital environment safer for all.”

If you’re still getting to grips with how the new rules might affect your business, this overview of the Online Safety Act breaks down the key points and obligations in a clear, practical way.

And if you need tailored advice or support navigating your specific duties under the Act, our data protection solicitors are ready to help you make sense of the requirements and stay compliant.