Last amended by Data (Use and Access) Act 2025 (interaction) in 2026. Adjustments to age assurance and verification interplay between OSA 2023 Part 5 (pornography) and the data protection framework.
Independent editorial summary — not the official statute text. Read the official version on legislation.gov.uk.
Summary
The Online Safety Act 2023 establishes the United Kingdom's regulatory framework for the safety of online services, with Ofcom designated as the independent regulator. The Act applies to providers of regulated user-to-user services and regulated search services with links to the UK. It imposes duties of care: providers must assess risks of illegal content, take proportionate steps to prevent users encountering priority illegal content, and protect children from content harmful to them. Particular categorical services (Category 1, 2A, 2B) attract additional duties around freedom of expression, news publisher content, transparency, and user empowerment. The Act creates new communications offences (s.179 false communications, s.181 threatening communications, s.187 cyberflashing). Ofcom can impose fines up to £18 million or 10% of qualifying worldwide revenue, and senior managers face personal criminal liability for failures to comply with confirmation decisions. The duties are being phased in via Ofcom codes of practice from 2024-2026.
Key Points
- Duties of care on providers of user-to-user services and search services to assess and mitigate risks (Part 3)
- Priority illegal content duties — terrorism, child sexual exploitation and abuse, fraud, immigration crime, and others (s.7 and Schedule 5)
- Children's safety duties — providers likely to be accessed by children must carry out a children's risk assessment and protect children from primary priority and priority content harmful to them (s.12)
- Category 1 services have additional duties including transparency reporting (s.68), user empowerment tools (s.14), and protection of journalistic and news-publisher content (ss.18-19)
- New offences: false communications (s.179), threatening communications (s.181), cyberflashing (s.187), epilepsy-trolling (s.183), encouraging or assisting serious self-harm (s.184)
- Ofcom as regulator with enforcement powers including fines up to £18m or 10% of global turnover, business disruption measures, and service restriction orders (Part 7)
- Senior manager liability for failure to comply with information notices or confirmation decisions (s.110)
- Age verification and age assurance requirements for pornography providers (Part 5)
- Removed pre-bill 'legal but harmful for adults' category replaced with user empowerment duties on Category 1
- Transparency reporting requirements for Category 1, 2A, 2B services (s.68)
Parts & Sections
Amendments History
2024 — Online Safety Act 2023 (Commencement Nos 1-4) Regulations
Phased commencement of the duties of care. Illegal harms duties commenced March 2025 alongside the Ofcom Illegal Harms Code of Practice. Children's safety duties commenced July 2025 with the Children's Safety Codes.
2025 — Investigatory Powers (Amendment) Act 2024 (interaction)
Information-sharing provisions between Ofcom and law enforcement clarified for the purposes of investigating online communications offences.
2026 — Data (Use and Access) Act 2025 (interaction)
Adjustments to age assurance and verification interplay between OSA 2023 Part 5 (pornography) and the data protection framework.
Frequently asked questions
- Who does the Online Safety Act 2023 apply to?
- The Online Safety Act 2023 applies to providers of regulated user-to-user services and regulated search services that have links to the UK. These providers must assess risks of illegal content, take proportionate steps to prevent users encountering priority illegal content, and protect children from harmful content. Specific categories of services face additional duties regarding transparency and user empowerment.
- What powers does Ofcom have under the Online Safety Act?
- Ofcom is the independent regulator designated to enforce the Act. It can impose fines of up to £18 million or 10% of a provider's qualifying worldwide revenue, whichever is greater. Ofcom also has powers to issue confirmation decisions, impose business disruption measures, and issue service restriction orders to ensure compliance with safety duties.
- What duties do online service providers have regarding children's safety?
- Providers likely to be accessed by children must carry out a children's risk assessment. They are required to take proportionate measures to prevent children from encountering primary priority content harmful to them and to protect them from other priority and non-designated content that is harmful to children.
- What new criminal offences were introduced by the Act?
- The Act creates several new criminal offences, including false communications (s.179), threatening communications (s.181), and cyberflashing (s.187). Cyberflashing involves sending images of a person's genitals with intent to cause alarm, distress, or humiliation. Other offences include epilepsy-trolling and encouraging serious self-harm.
- When do the new safety duties start applying?
- The duties are being phased in between 2024 and 2026 via Ofcom codes of practice. The illegal harms duties commenced in March 2025 alongside the Ofcom Illegal Harms Code of Practice. The children's safety duties commenced in July 2025 with the introduction of the Children's Safety Codes.