UK child online safety duties take effect

Verdict and Western stakes — PROVEN

On 25 July 2025, the United Kingdom's Online Safety Act regime reached a major implementation date: Ofcom's Protection of Children Codes of Practice came into force and relevant online services were required to comply with child-safety duties. This turned years of political promises into a concrete regulatory obligation for platforms likely to be accessed by children. The intended beneficiaries are young users exposed to pornography, encouragement of self-harm and other specified categories of harmful material. The costs fall on service providers implementing risk management, access controls, moderation and age-assurance systems; adult users can also encounter friction when proving eligibility for restricted material. The dated event was commencement of operational duties and codes, not a new Act of Parliament on that day.

Core record — dated act and legal stage

The Online Safety Act 2023 received Royal Assent on 26 October 2023. Its duties have been introduced in stages. Illegal-content safety obligations had begun applying on 17 March 2025. Child-safety risk assessment guidance and the first version of Ofcom's Protection of Children Codes were published in April 2025, with child risk assessments due by 24 July. On 25 July 2025 the child-safety codes took effect. Services likely to be accessed by children must comply with applicable statutory duties; providers can follow relevant Ofcom measures or use another route that demonstrably meets the legal requirements. This is a binding regulatory compliance milestone, but not every online service faces identical obligations.

Power and veto

Parliament enacted the statutory duties. Ofcom, as the designated regulator, issues codes, guidance and enforcement decisions under that legal authority. Covered platforms carry out children's access assessments, assess risks and deploy proportionate safety measures. Courts can examine legal disputes and challenges. Ministers may possess delegated powers in parts of the framework, but a government press release does not replace the Act and codes. Age-assurance providers have significant technical influence over the user experience without becoming the statutory regulator. The distinction matters because it tells parents and platform users whom to hold accountable for a failure.

Money, access and ownership

The immediate costs involve developing child-risk assessments, age assurance, moderation systems, audits, user reporting channels and documented policies. Firms with large compliance teams may absorb fixed governance costs more readily than smaller online communities. Ofcom's enforcement powers can include substantial financial penalties and other legal tools subject to statutory conditions. A maximum potential penalty must not be represented as a fine already levied. Likewise there is no verified national total for compliance spending or for children harmed or protected specifically because the duties commenced. Successful age checks may reduce access to age-restricted material; they can also shift use to services with weaker controls.

Stakes — who benefits and who pays

Children and parents stand to benefit when companies prevent harmful content being recommended and make the reporting process more effective. Young users with legitimate educational or support needs may face unintended barriers when systems cannot distinguish context or age reliably. Adult users seeking age-restricted but legal content may have to submit information to services or verification intermediaries, raising questions about privacy and retention. Businesses must balance legal exposure against customer trust and operating cost. Civil liberties organisations argue that mandatory verification could normalise surveillance or encourage dangerous data collection. That is a meaningful risk, not proof the statutory goal is illegitimate.

Timeline

• 26 October 2023: the Online Safety Act receives Royal Assent.
• 17 March 2025: illegal-content codes and safety duties take effect.
• 24 April 2025: Ofcom publishes child-risk guidance and child-safety codes.
• 24 July 2025: deadline for relevant child-risk assessments.
• 25 July 2025: children's safety codes enter into force and the corresponding duties apply.
• Later compliance periods: Ofcom monitors whether firms actually implement appropriate measures.

Strongest counter-view

The strongest objection is that intrusive age checks impose privacy risk on everyone while vulnerable children may move toward harder-to-regulate online spaces. That must be assessed with evidence about data minimisation, circumvention and actual exposure. The narrower legal finding stands: from 25 July 2025 covered providers faced an operative and enforceable child-safety regime.

Open questions and signals

Which providers were noncompliant after commencement? How often did systems wrongly deny access? Was harmful-content exposure reduced or merely displaced? Watch Ofcom enforcement notices, codes revisions, independent child-safety evaluations and privacy regulatory findings.

Related on Factrail

• Keir Starmer (opens in a new tab)
• Anthony Albanese (opens in a new tab)