Online Safety Act duties for online services

The Online Safety Act 2023 creates a new regulatory framework for online services operating in the UK. If your service allows users to post content, share messages, or search the internet, you likely have duties under this Act.

Ofcom is the regulator. Non-compliance can result in fines of up to £18 million or 10% of qualifying worldwide revenue (whichever is greater), and senior managers can face personal criminal liability for failing to cooperate with investigations.

Is your service in scope?

The Act regulates two types of service:

User-to-user services - platforms where users can share content with other users:

• Social media platforms
• Video sharing services
• Forums and message boards
• Dating apps
• Gaming platforms with chat or community features
• Online marketplaces and other sites where users post content that other users can see
• Messaging services, other than email, SMS and MMS

Search services - services enabling users to search multiple websites or databases:

• General search engines
• Specialist search engines (not limited to one website)

The Act applies wherever you are based if your service has links with the UK. That means it has a significant number of UK users, UK users are a target market, or it can be used in the UK and there is a material risk of significant harm to people here.

Out of scope:

• Services where the only content users share is email, SMS or MMS messages, or one-to-one live voice calls
• Internal tools available only to your business, its officers and the people who work for it
• Services where users can only comment on, review, like or rate content you publish yourself, such as product reviews or comments on your own articles
• Services with no links with the UK

Overview of your duties

The Act imposes duties based on service type and size. All regulated services have baseline duties, with additional obligations for larger platforms and those accessible by children.

Service categories

Ofcom assesses the largest services against thresholds set in regulations and lists those that meet them in a register of categorised services. The extra duties for Category 1, 2A and 2B apply once your service is on the register.

Category 1 (largest user-to-user services)

A user-to-user service meets the Category 1 thresholds if it has either:

• Option A: more than 34 million monthly active UK users AND a content recommender system
• Option B: more than 7 million monthly active UK users AND a content recommender system AND a feature that lets users forward or share content with other users

Category 1 services must offer adult users features to control the content they see, protect content of democratic importance, news publisher content and journalistic content, tackle fraudulent advertising, and publish transparency reports.

Category 2A (search services)

Search engines with more than 7 million monthly active UK users, other than search engines that only search selected sites on one topic through an arrangement with those sites. They must tackle fraudulent advertising in search results and publish transparency reports.

Category 2B (user-to-user with direct messaging)

User-to-user services with more than 3 million monthly active UK users that let users send direct messages to each other. They must publish transparency reports.

All other regulated services

Services below category thresholds still have baseline duties covering illegal content risk assessment, content removal, terms of service, and complaints procedures.

Key duties in detail

Illegal content duty

All regulated services must take steps to prevent users encountering priority illegal content. This covers 130+ offences listed in Schedule 7 of the Act, including:

• Child sexual exploitation and abuse material (CSEA)
• Terrorism content
• Hate crimes
• Fraud and financial crime
• Drugs and weapons offences
• Revenge pornography and intimate image abuse
• Harassment and stalking
• Immigration crime facilitation

You must conduct a risk assessment, implement safety measures proportionate to your risks, and remove illegal content swiftly when you become aware of it.

Children's safety duty

If children can access your service, you must protect them from content that is harmful to children, even if that content is legal for adults. This includes:

• Pornographic content
• Content promoting self-harm, suicide, or eating disorders
• Content promoting violence
• Bullying content
• Content that is harmful for children to see

You must conduct a children's access assessment to determine if children are likely to access your service. If yes, you must implement age assurance measures and apply additional protections.

When the duties apply

The Online Safety Act duties are in force. If your service is in scope and you have not yet met them, you are at risk of enforcement action now.

What this means for you

Illegal content risk assessment: You must have a written assessment identifying how your service could be used to commit or facilitate illegal activity, and be able to show it to Ofcom if asked. A new service must complete it within 3 months of launch. Carry out a new assessment before you make a significant change to your service.

Illegal content safety measures: Your content moderation systems, reporting mechanisms and removal processes must be working now. Ofcom can enforce these duties.

Children's access assessment: You must assess whether children are likely to access your service. A new service must do this within 3 months of becoming available to UK users. If you do not, your service is treated as likely to be accessed by children.

Children's safety duties: If children are likely to access your service, complete a children's risk assessment within 3 months and have age assurance and child-specific protections in place. Ofcom can enforce these duties.

Ofcom's codes of practice

If you take the measures Ofcom's codes of practice recommend for a duty, you are treated as complying with that duty.

Data protection

Age assurance and content moderation involve processing personal data, so UK GDPR and the Data Protection Act 2018 apply alongside the Act. If children are likely to use your service, the Information Commission's age-appropriate design code (the Children's code) sets the data protection standards it expects.

Steps to compliance

Enforcement and penalties

Ofcom has substantial enforcement powers under the Online Safety Act:

• Information notices: Ofcom can require you to provide information about your service, users, and safety measures
• Provisional and confirmation notices: Formal warnings requiring you to take specific action to comply
• Fines: Up to 10% of qualifying worldwide revenue or £18 million, whichever is greater
• Business disruption measures: Court orders to restrict payment services or advertising, or require ISPs to block access to non-compliant services
• Senior manager liability: Criminal offences for failing to comply with information notices or obstructing Ofcom investigations

Ofcom prioritises the most serious harms - particularly child sexual exploitation, terrorism, and fraud. However, all in-scope services must meet baseline compliance requirements.