UK Online Safety Act and platform regulation

Child protection duties and the cost of platform enforcement

On 26 October 2023, the United Kingdom's Online Safety Act received Royal Assent and became chapter 50 of that year's statute book. The Act created a regulatory framework for user-to-user services and search services with relevant links to the United Kingdom, supervised by Ofcom. Providers were expected to assess risks and take proportionate steps against specified kinds of illegal content, while services likely to be accessed by children faced additional duties. The law addressed online harm through service design, compliance and enforcement rather than creating one universal ban on offensive material.

The legislation raised conflicting concerns from the outset. Victims' organisations and child-protection campaigners argued that online platforms had allowed sexual exploitation, harassment and self-harm promotion to spread without sufficient safeguards. Digital-rights advocates cautioned that age checks, broad removal duties and private companies' fear of penalties could restrict lawful speech or increase the collection of sensitive identity data. Those competing interests implicated digital content moderation intensity and digital censorship even when the government described the statute as a safety measure. The presence of a safety objective does not resolve whether particular enforcement tools are necessary and proportionate.

The British government issued explanatory guidance in May 2024 and updated it in April 2025 as Ofcom moved toward implementation. The guidance set out different classes of harmful material, including terrorism, sexual exploitation, self-harm promotion, eating-disorder content and some forms of illegal abuse. Child-safety obligations were not identical to general illegal-content duties. The Act also contemplated reporting, risk assessment, age assurance and the power to impose substantial sanctions on noncompliant firms. Operators based outside Britain could still be covered where they served or targeted UK users in the prescribed ways.

On 17 March 2025, the government recorded the start of key illegal-content duties for covered platforms. On 24 April 2025, the Department for Science, Innovation and Technology published material explaining Ofcom's child-protection codes of practice. On 25 July 2025, further child-safety duties entered into force, including highly effective age assurance for pornography and other specified content. The staggered sequence means a statement that the entire 2023 law became operational on one day would be inaccurate. Different requirements commenced at different stages and affected services according to type, reach and risk.

On 1 August 2025, the government published further information about protections newly operating for under-18s. It cited concerns about children encountering pornography and content promoting eating disorders, suicide or self-harm. The enforcement approach can reduce unwanted exposure when properly targeted, but age-verification systems may themselves process personal information, block legitimate users or exclude people unable to satisfy checks. These possible costs are not grounds to dismiss documented harms; they are reasons to evaluate the proportionality and accountability of the chosen technical protections.

The Act also intersects technology and digital-rights regulation and European platform regulation, but Britain created a distinct legal structure rather than merely applying the European Union's Digital Services Act. Differences in service coverage, enforcement, procedural rights and regulator powers matter to firms operating in both jurisdictions. The dated legal record supplies four clear stages: enactment in October 2023, public implementation guidance in 2024–25, illegal-content duties in March 2025, and child-safety duties in July 2025. Long-term judgments about effectiveness require observed changes in child safety, privacy and lawful expression after those implementation milestones.