Online Safety Act 2023 — duties, enforcement, and new criminal offences
Deep guide to the Online Safety Act 2023: which services are caught, the risk-assessment / safety-duty framework, the categorisation regime (Category 1, 2A, 2B), Ofcom's enforcement powers, and the new criminal offences (cyberflashing, threatening intimate-image abuse, deepfakes, false communications, encouraging self-harm).
ਜਾਣ-ਪਛਾਣ
The Online Safety Act 2023 (OSA) is one of the most far-reaching tech-regulation statutes in the world. It imposes statutory duties on user-to-user services, search services, and pornography services to prevent users encountering illegal content and (for services likely to be accessed by children) harmful content. Ofcom is the regulator, with extensive information-gathering, audit, fine (up to £18m or 10% of qualifying worldwide revenue), business-disruption-measure, and individual senior-manager-liability powers. Implementation is phased: illegal-content duties (children's safety, transparency, fraudulent advertising) came into force across 2024-2026 with codes of practice from Ofcom progressively introducing detailed compliance expectations. The Act also creates new criminal offences inserted into the Sexual Offences Act 2003 and the Malicious Communications Act 1988, plus stand-alone offences for false communications and encouraging serious self-harm. Several provisions remain controversial — particularly the 'spy clause' (s.121) on encrypted messaging accountability, and the still-unimplemented 'legal but harmful' provisions for adults that were dropped before Royal Assent.
In Brief
The Online Safety Act 2023 imposes statutory duties on user-to-user services, search services, and pornography services to prevent users encountering illegal and harmful content. Ofcom enforces with fines up to £18m or 10% of global turnover, business disruption measures, and senior manager liability. The Act also creates new criminal offences (cyberflashing, intimate-image abuse, false communications, encouraging self-harm, deepfakes). Implementation is phased across 2024-2026.
ਮੂਲ ਸਿਧਾਂਤ
Scope (s.3-4) — three regulated service types: user-to-user (most social media, forums, marketplaces), search (Google, Bing, etc.), and Part 5 pornography services. Some exemptions (one-to-one email, internal business comms, traditional news publishers).
Illegal content duties (s.9-10, 24-25) — risk assessment + take-down + proportionate measures. Specified 'priority offences' (terrorism, CSEA, fraud, drugs etc.) trigger additional obligations.
Children's safety duties (s.11-12) — services likely to be accessed by children must conduct children's risk assessments + implement protections (age assurance, content filtering).
Categorisation (s.85-95 + Sch 11) — Category 1 (highest user reach + functionality), 2A (large search), 2B (medium user-to-user). Cat 1 has additional duties: user empowerment, fraud-advert prevention, content reporting.
Ofcom enforcement — information notices, audit, super-complaints (s.146), provisional notices of contravention, fines (up to £18m or 10% global turnover), business disruption measures (s.144-145), senior manager liability for non-compliance (s.110).
New criminal offences — cyberflashing (SOA 2003 s.66A, in force 31 Jan 2024); intimate image abuse and threats (SOA 2003 ss.66B-D); false communications (OSA s.179); threats (s.181); encouraging serious self-harm (s.184); 'deepfake' intimate-image creation (added by Criminal Justice Act 2024).
Codes of practice (s.41-42) — Ofcom issues codes; compliance with a code is a 'safe harbour' for the underlying duty.
Spy clause (s.121) — Ofcom can require services to use 'accredited technology' to detect CSEA / terrorism content, including in end-to-end-encrypted services. Implementation deferred pending technical viability.
ਮੁੱਖ ਐਕਟ
Online Safety Act 2023
Sexual Offences Act 2003
Malicious Communications Act 1988
Communications Act 2003
Criminal Justice Act 2024
ਪ੍ਰਮੁੱਖ ਕੇਸ
R (Wikimedia Foundation) v Secretary of State for Science, Innovation and Technology
[2025] EWHC (Admin) (Category 1 challenge)
Bindel v News Group Newspapers (defamation tangentially)
[2024] EWHC 906 (KB)
Frequently Asked Questions
Which services are caught by the Online Safety Act?
Three categories: (1) user-to-user services — almost all social media, forums, marketplaces, comments sections, multiplayer games with text/voice chat; (2) search services — Google, Bing, DuckDuckGo etc.; (3) Part 5 pornography services. Exemptions include one-to-one email, internal business communications, certain regulated news publisher content, and some limited functionality services. The threshold is low — many community forums and small online services are in scope.
What are the new criminal offences for individuals?
OSA inserted offences into the Sexual Offences Act 2003: cyberflashing (s.66A, in force 31 January 2024), intimate-image abuse (ss.66B-D, sharing or threatening to share intimate images without consent). The OSA itself creates: false communications offence (s.179 — knowingly false communications causing non-trivial psychological or physical harm), threats offence (s.181), encouraging serious self-harm (s.184). The Criminal Justice Act 2024 added a deepfake intimate-image creation offence.
What is 'Category 1' status?
Category 1 captures the largest user-to-user services with specified functionalities (typically those allowing users to forward content widely). Cat 1 services have additional duties: user empowerment tools (block/mute trolls; opt out of unverified-user content), fraudulent-advertising prevention, transparency reporting, content-reporting transparency. The first wave of Cat 1 designations is being challenged — see R (Wikimedia Foundation) v SSSIT for the Wikipedia challenge.
Has the 'legal but harmful' adult content regime been implemented?
No. The 'legal but harmful' provisions for adults were dropped from the Bill before Royal Assent following free-speech concerns. The OSA as passed only imposes harmful-content duties for content that is harmful to children (or illegal). Adult users get 'user empowerment' tools instead — the ability to opt out of certain categories of content on the largest platforms.
What To Do Next
Get Professional Help