Journey
Comply with the Online Safety Act from scratch
A complete learning path for platform operators new to the Online Safety Act 2023. Covers understanding the Act, determining scope and platform category, conducting risk assessments, protecting children, implementing content moderation, writing compliant terms of service, setting up complaints procedures, implementing age assurance, and registering with Ofcom.
Why the Online Safety Act matters for your platform
If you operate a user-to-user service or search service accessible from the UK, the Online Safety Act 2023 applies to you. Ofcom enforces compliance, and the consequences of non-compliance are severe: fines of up to 10% of qualifying worldwide revenue or 18 million pounds, business disruption measures, and personal criminal liability for senior managers.
This learning path takes you from understanding the Act through to full compliance, step by step.
-
Understand the Online Safety Act
Before taking any compliance action, understand how the Act works, who it applies to, and what Ofcom expects. The OSA creates different duties for different platform categories, so understanding the framework helps you identify exactly what applies to your service.
Understanding the Online Safety Act
Learn what the OSA is, how the regulatory framework works, what user-to-user and search services mean, and how the Act relates to other digital regulation.
-
Determine your platform category
The OSA creates three categories of regulated service based on UK user numbers and platform features. Your category determines which duties apply beyond the baseline illegal content obligations that all services share. Services below all thresholds still have illegal content duties.
-
Conduct your illegal content risk assessment
Every regulated service must assess how it could be used to commit or facilitate priority illegal content offences. This written assessment must be retained for Ofcom inspection and reviewed annually or when your service changes significantly.
Conduct an illegal content risk assessment
Step-by-step guide to assessing risks from 130+ Schedule 7 priority offences, documenting existing safety measures, and producing the written record Ofcom requires.
-
Assess whether children can access your service
All regulated services must assess whether children are likely to access the service. Until you complete this assessment, your service is treated as if children can access it, triggering the full set of children's safety duties.
Conduct a children's access assessment
How to assess whether children are likely to access your service, what factors Ofcom expects you to consider, and what happens if the answer is yes.
-
Understand your children's safety duties
If children are likely to access your service, you must conduct a separate children's risk assessment, implement age assurance, and apply children's safety duties. These are among the most detailed and scrutinised obligations under the Act.
Children's safety duties under the Online Safety Act
Comprehensive guidance on children's risk assessments by age group, harm categories, age assurance requirements, and Ofcom's children's codes of practice.
-
Set up content moderation
Your risk assessment findings must translate into proportionate content moderation systems. Ofcom's codes of practice set out recommended measures based on your service type, size, and risk profile.
Set up content moderation for OSA compliance
How to build content moderation systems that meet OSA requirements, including automated detection, human moderation, user reporting, and record-keeping.
-
Write compliant terms of service and complaints procedures
Your terms of service must clearly state what content is prohibited, how policies are enforced, and how users can report content and complain. Selective or inconsistent enforcement is itself a contravention.
Write OSA-compliant terms of service
What your terms must include, how to ensure clarity and accessibility, and the additional requirements for Category 1 services around freedom of expression.
-
Implement age assurance (if children can access your service)
If your children's access assessment concluded that children are likely to access your service, you must implement age assurance. The method you choose must be proportionate and privacy-preserving, and pornography services require robust age verification.
Implement age assurance for your platform
Choosing between age verification and age estimation, evaluating providers, privacy requirements, and meeting Ofcom's guidance on highly effective age assurance.
-
Register with Ofcom and understand fees
Regulated services must register with Ofcom. Services above the qualifying worldwide revenue threshold must also notify Ofcom and pay annual fees. The registration portal is being phased in during 2025-2026.
Register with Ofcom under the Online Safety Act
How to determine if your service must register, the fee threshold and exemptions, and the notification process.
-
Verify your compliance and plan ongoing review
Use the compliance checklist to confirm you have addressed every major obligation. The OSA requires ongoing review: risk assessments must be updated annually, and terms of service must be applied consistently.
Online Safety Act compliance checklist
Verify your compliance across all major OSA obligations: scope, risk assessments, content moderation, terms of service, complaints, age assurance, registration, and record-keeping.