Online Safety Act 2023
What this means for your business
- Enforced by
- Ofcom
- Applies to
- United Kingdom
- On this page
- 36 compliance obligations, 19 practical guides across 2 topics
What you must do
36 compliance obligations under this legislation — 12 can result in imprisonment.
Appointments 2
Appoint and pay a skilled person for OFCOMārequested reports
If OFCOM asks you to provide a report about how you meet its onlineāsafety rules, you must either appoint a qualified expert yourself or let OFCOM appoint one. You must give that expert any help they need and pay their fees and expenses directly. Failure to do so can lead to court action to recover the costs.
Name a senior manager in response to an OFCOM notice
If OFCOM serves your business with an information notice and asks you to identify a senior manager, you must designate someone who can ensure you meet the noticeās requirements, tell that person about their role, and understand the consequences if the business fails to comply.
Risk assessment 6
Carry out and keep upātoādate childrenās risk assessments
If you run a regulated search service that children are likely to use, you must produce a detailed risk assessment of how the service could expose children to harmful content. The assessment has to be reviewed regularly and you must redo it before making any major change to the serviceās design or operation.
Carry out and keep upātoādate childrenās risk assessments and report harmful content
If you run an online service that lets users interact and is likely to be used by children, you must assess the risks that harmful content poses to them. Keep this assessment current, redo it whenever you make a big change or OFCOM updates the risk profile, and promptly tell OFCOM if you find nonādesignated harmful material, including what it is and how often it appears.
Carry out and keep upātoādate illegal content risk assessments
If you run a regulated search service you must assess how likely users are to encounter illegal content and the harm it could cause. Do a full risk assessment at the times set out in ScheduleāÆ3, update it whenever Ofcom changes the risk profile, and redo it before any major change to your serviceās design or operation. In practice this means reviewing your algorithms, indexing, and userāfacing features and keeping written evidence of the assessments.
Carry out and maintain illegalācontent risk assessments
If you run a regulated userātoāuser online service, you must produce a thorough risk assessment of illegal content and keep it up to date. You also need to redo the assessment before any major change to how the service works, and whenever OFCOM issues a significant update to the relevant risk profile.
Carry out and maintain userāempowerment assessments for CategoryāÆ1 services
If you run a large online platform (a CategoryāÆ1 service), you must produce a thorough assessment of how adult users might encounter harmful content, keep that assessment upātoādate, and redo it before any major change to your service. The assessment must consider your user base, algorithms, functionalities and how the design affects content exposure.
Carry out regular childrenās access assessments for your online service
If you run an online service that falls under PartāÆ3 of the Online Safety Act, you must assess whether children can access it. Do the first assessment when ScheduleāÆ3 says, repeat at least once a year, and redo it whenever you make a major design change, receive evidence that ageāverification is less effective, or see a big rise in child users. Keep a clear, written record of every assessment.
Management duties 10
Comply with all Online Safety duties for your userātoāuser service
If you run an online platform where users can interact (e.g., social media, forums, marketplace), you must meet a series of duties under the Online Safety Act ā riskāassess illegal content, handle illegal content, provide reporting and complaints mechanisms, protect freedom of expression and privacy, keep records and review them. Additional duties apply if children can use the service or if you are a CategoryāÆ1 service, so you need appropriate policies and documentation for each requirement.
Comply with all statutory duties for regulated search services
If your business runs a regulated search engine, you must meet every duty set out in the Online Safety Act ā from riskāassessing illegal content and handling it, to providing a reporting mechanism, dealing with complaints, protecting freedom of expression and privacy, and keeping appropriate records. Extra steps are required if your service is likely to be used by children or is a CategoryāÆ2A service.
Identify if your internet service is subject to regulated pornographicācontent duties
If you run an online service, you must check whether it shows regulated pornographic content, is not covered by an exemption, and has a UK audience or target market. If all three apply, you then have to follow the specific duties set out in sectionāÆ81 for that service.
Implement effective ageāverification and keep public records
If your internet service provides regulated pornographic content, you must put in place highlyāeffective ageāverification (or ageāestimation) to stop children from seeing it. You also have to keep a clear written record of the methods you use and publish a summary of that record for the public.
Implement online safety measures to meet OFCOM code of practice
If your business runs a PartāÆ3 online service ā for example a userātoāuser platform or a search engine ā you must design and run it so it complies with the onlineāsafety objectives set out by OFCOM. This means clear user terms, effective riskāmanagement, childāprotection controls, ageāverification where appropriate, and safeguards for freedom of expression and privacy. You must keep these measures under review and update them when the code changes.
Include clear terms and easy complaints/reporting for user content
If you run a regulated userātoāuser online service, you must write terms of service that plainly explain usersā right to claim if their content is wrongly taken down or they are suspended. Those terms must be clear, detailed and applied consistently, and you must provide simple ways for users to report content or users and to lodge complaints, with an accessible, transparent complaints handling process.
Protect children using proportionate design, operation and public statements
Fine up to Ā£18,000,000If you run a regulated search service that children are likely to use, you must put in place reasonable technical and organisational measures to stop them seeing harmful content. You also need to publish a clear, publiclyāavailable statement explaining how you protect children, what technology you use and the findings of your latest childrenās risk assessment.
Protect children using your online service
2 years imprisonmentIf you run a userātoāuser online service that children are likely to use, you must put in place proportionate design, operational and contentāmoderation measures to keep children safe. This includes doing a regular childrenās risk assessment, using effective ageāverification where required, and clearly setting out protective rules in your terms of service.
Provide userācontrol features and clear terms for adult users
If you run a CategoryāÆ1 online service you must give adult users easyātoāuse tools to limit or be warned about certain content, let them choose whether to keep the default setting, make those tools available to everyone, and spell them out in your terms of service together with a summary of your latest safety assessment.
Set up a clear process for parents to request deceased child data
If you run an online service that falls under the Online Safety Act (CategoryāÆ1, 2A or 2B), you must tell parents exactly how they can ask for information about a child who has died. You need a dedicated help line, clear steps in your terms of service, a quick response time and a simple complaints route, all of which must be easy for parents to find.
Other requirements 2
Cooperate fully with OFCOM investigations
If OFCOM starts an investigation to check whether your online service has breached any safety requirement (for example, dealing with terrorist or harmful content), you must fully cooperate. This means giving OFCOM any information, documents, or system access they ask for and responding promptly.
Keep OFCOMāprovided intelligence information confidential
If OFCOM shares information that originates from or relates to an intelligence service (MI5, MI6, GCHQ) with your business, you must not pass it on to anyone else unless the intelligence service gives permission. Treat such data as highly confidential and restrict its distribution.
Offences and prohibitions 14
Commit an information offence under the Online Safety Act
2 years imprisonmentIf your business fails to meet the information duties set out in sections 109ā112 of the Online Safety Act (for example, not providing required notices or mishandling userāgenerated content), you commit a criminal offence. On conviction you can be fined ā the fine is unlimited on indictment ā and you may also face up to two yearsā imprisonment. The offence can be tried either in a magistratesā court (summary) or in the Crown Court (indictable) depending on how serious the breach is.
Commit fraud or related financial offences
Unlimited fineIf your business carries out any activity that breaches the financialāservices or fraud legislation listed in this section ā for example carrying out unauthorised regulated activity, making false statements to obtain authorisation, false representations, abusing a position, or supplying items used for fraud ā you can be prosecuted under the Online Safety Act. The same applies if you attempt, conspire, assist, or aid anyone else in doing so. Conviction can lead to unlimited fines and, for many of the referenced offences, possible imprisonment.
Encourage or assist serious selfāharm
5 years imprisonmentIf you, or anyone acting on your behalf, do any act ā such as publishing, sharing, sending, or showing material ā that is intended to encourage or help another person to seriously harm themselves, you commit a criminal offence. The offence applies even if the selfāharm does not actually occur. On conviction you face up to five years in prison and an unlimited fine.
Fail to comply with an information notice
Unlimited fineIf your online service (e.g., a userātoāuser platform, search engine or a site hosting regulated pornographic content) receives an information notice from a regulator such as Ofcom, you must comply with its requirements. Providing false or deliberately hidden information, encrypting data to stop the regulator understanding it, or destroying/suppressing the information is also an offence. A conviction can result in the court ordering you to comply and may bring fines or imprisonment, even though the exact penalties are set elsewhere in the Act.
Fail to comply with audit notice
2 years imprisonmentIf your online service receives an audit notice under ScheduleāÆ12 of the Online Safety Act and you either ignore the notice, give false material information, or destroy/suppress the information the notice asks for, you commit a criminal offence. On conviction the court can impose an unlimited fine, may order you to comply with the notice and can also impose imprisonment, depending on the severity.
Fail to comply with OFCOM notice under the Online Safety Act
Unlimited fineIf OFCOM issues you a notice to deal with terrorist or extremist content on your online service and you do not comply (or you continue not to comply), OFCOM can issue a penalty notice requiring you to pay a fine. The amount is set by OFCOM and can be unlimited. The penalty is purely financial ā there is no prison term attached.
Obstruct, fail to comply or give false information to regulator
2 years imprisonmentIf your business deliberately blocks, delays or refuses to provide documents or other information that the ICO, HSE, FCA, Ofcom or another regulator lawfully requests under the Online Safety Act, or does not attend a required interview, or supplies information that is materially false, you commit a criminal offence. On conviction the court can impose a fine (potentially unlimited) and/or imprisonment and may order you to comply with the information request.
Officer liable for corporate onlineāsafety offences
Unlimited fineIf your company commits an onlineāsafety offence (sectionsāÆ179,āÆ181,āÆ183 orāÆ184) and it is proven that a director, manager or other officer either consented, turned a blind eye or was negligent, that officer is treated as having committed the offence themselves. They can be prosecuted and face the same fine and any possible prison term as the company.
Send false online message intending harm
51 weeks imprisonmentIf you send an online message that you know is false, with the intention of causing nonātrivial psychological or physical harm to people who are likely to see it, and you have no reasonable excuse, you commit an offence. On conviction in a magistrates' court you could be fined an unlimited amount and face up to 51 weeks in prison.
Send intimate genital image causing alarm or for sexual gratification
2 years imprisonmentIf you deliberately send, show, or leave a photograph or video of anyoneās genitals so that the recipient is alarmed, distressed or humiliated, or you do it to obtain sexual gratification and are reckless about causing distress, you commit a criminal offence. The rule covers any electronic or physical means and includes computerāgenerated or stored images. On conviction you can face up to two years in prison and an unlimited fine.
Send or display flashing images that could cause seizures
5 years imprisonmentIf you send, publish or show electronic images that flash and you know (or should know) they could be seen by someone with epilepsy, and you intend the images to cause them harm, you commit a criminal offence unless you have a reasonable excuse. Conviction can lead to an unlimited fine and up to five yearsā imprisonment (or a shorter term if dealt with in a magistratesā court). The offence applies to any person or business that sends or shows such content online.
Send threatening communications
5 years imprisonmentIf your business sends a message that threatens death, serious injury, rape, sexual assault or serious financial loss, and you intend or are reckless that the recipient will fear the threat will be carried out, you are committing an offence. Conviction can result in up to five years' imprisonment and an unlimited fine, whether the case is heard in a magistratesā court (summary) or in the Crown Court. The offence applies to any person, so companies and their staff must ensure no threatening messages are transmitted.
Senior manager fails to prevent information offences
2 years imprisonmentIf your company breaches an information notice ā for example by not complying with the notice, supplying false or encrypted information, or destroying/deleting data ā and you, as a senior manager named under the notice, did not take all reasonable steps to stop it, you can be prosecuted personally. Conviction can attract the same penalties as the underlying information offence (potentially unlimited fines and/or imprisonment).
Share or threaten to share intimate image without consent
2 years imprisonmentIf you (or anyone acting for you) intentionally share, or threaten to share, a photograph or video showing another person in an intimate state without that person's consent, you commit a criminal offence. On conviction you can be fined an unlimited amount and face up to two years in prison (or a shorter term on summary conviction). The offence applies to any person, including businesses and their staff.
Reporting and filing 2
Produce annual transparency reports for relevant online services
If your business runs a CategoryāÆ1, 2A or 2B online service, OFCOM will each year send you a notice asking for a transparency report. You must gather the data the notice asks for, prepare the report in the prescribed format, submit it by the deadline and publish it as instructed, making sure the information is complete and accurate.
Report all CSEA content to the NCA
2 years imprisonmentIf your business runs a regulated userātoāuser platform, a regulated search engine or a combined service, you must have systems that detect child sexualāabuseārelated (CSEA) material and send a report of every piece ā whether previously reported or not ā to the National Crime Agency. The report must be made in the format, within the timeāframes and by the method set out in the detailed regulations.
Penalties for non-compliance
17 penalties under this legislation. 12 can result in imprisonment. 16 carry an unlimited fine.
Protect children using proportionate design, operation and public statements
Fine up to Ā£18,000,000
Fail to comply with confirmation decision on childrenās online safety
Unlimited fine and/or 2 years imprisonment
Commit an information offence under the Online Safety Act
Unlimited fine and/or 2 years imprisonment
Encourage or assist serious selfāharm
Unlimited fine and/or 5 years imprisonment
Fail to comply with audit notice
Unlimited fine and/or 2 years imprisonment
Obstruct, fail to comply or give false information to regulator
Unlimited fine and/or 2 years imprisonment
Send false online message intending harm
Unlimited fine and/or 51 weeks imprisonment
Send intimate genital image causing alarm or for sexual gratification
Unlimited fine and/or 2 years imprisonment
Send or display flashing images that could cause seizures
Unlimited fine and/or 5 years imprisonment
Send threatening communications
Unlimited fine and/or 5 years imprisonment
Senior manager fails to prevent information offences
Unlimited fine and/or 2 years imprisonment
Share or threaten to share intimate image without consent
Unlimited fine and/or 2 years imprisonment
Submit false material information to CSEA
Unlimited fine and/or 2 years imprisonment
Commit fraud or related financial offences
Unlimited fine
Fail to comply with an information notice
Unlimited fine
Fail to comply with OFCOM notice under the Online Safety Act
Unlimited fine
Officer liable for corporate onlineāsafety offences
Unlimited fine
Practical guidance
Our guides explain how to comply with the requirements above.
Digital & Technology 16
Tech Sector Compliance Overview
Comprehensive guide to regulatory compliance for technology businesses - UK GDPR, data protection, online safety, cybersecurity, and sector-specific ā¦
Tech Sector Licensing and Authorisations
Comprehensive guide to licences and regulatory authorisations required for technology businesses - telecommunications, financial services, intellectual property, export ā¦
Computer Misuse Act Compliance
How to comply with the Computer Misuse Act 1990 when conducting security testing, developing security tools, or running ā¦
Online Safety Act: duties for online services
How to comply with the Online Safety Act 2023 if you operate a user-to-user service or search service. ā¦
App store and digital platform regulation
How the Digital Markets Act and CMA regulation affects large digital platforms and app store operators. Covers Strategic ā¦
Age verification for online services
How to implement age verification to comply with the Online Safety Act and ICO Children's Code. Covers verification ā¦
Set up content moderation to meet Online Safety Act requirements
How to build a content moderation system that meets Online Safety Act 2023 duties. Covers automated detection tools, ā¦
Write terms of service that meet Online Safety Act requirements
How to draft or update your platform's terms of service to comply with Online Safety Act 2023 duties. ā¦
Register with Ofcom for Online Safety Act compliance
How to register with Ofcom as a regulated online service and understand fee requirements under the Online Safety ā¦
Online Safety Act penalties and enforcement powers
Quick reference to Ofcom's enforcement powers, penalty calculations, and senior manager criminal liability under the Online Safety Act ā¦
Understanding the Online Safety Act
A strategic overview of the Online Safety Act 2023, explaining what it is, who it affects, how the ā¦
Conduct an illegal content risk assessment
Step-by-step guide to conducting the mandatory illegal content risk assessment under the Online Safety Act 2023. Covers how ā¦
Conduct a children's access assessment
Step-by-step guide to assessing whether children are likely to access your online service under the Online Safety Act ā¦
Children's safety duties under the Online Safety Act
Comprehensive guide to the children's safety duties under the Online Safety Act 2023. Covers what triggers the duties, ā¦
Implement age assurance on your platform
Practical guide to implementing age assurance on your online platform. Covers choosing between age verification and estimation, evaluating ā¦
Online Safety Act compliance checklist
Quick-check verification of your Online Safety Act compliance status. Covers scope assessment, risk assessments, content moderation, terms of ā¦
Compliance & Legal 3
UK AI regulation: how it works
Comprehensive overview of UK AI regulation. The UK has no single AI law. Instead, existing sector regulators apply ā¦
Which regulator covers your AI system
Decision-tree reference guide mapping AI use cases to the UK regulators responsible for oversight. Covers the ICO, FCA, ā¦
AI regulation timeline and key dates
Quick reference for all key AI regulation dates and upcoming milestones. Covers the EU AI Act implementation timeline, ā¦
Sections and provisions
259 classified provisions from this legislation.
Duties 54
- Schedule 4 Codes of practice under section 41: principles, objectives, content amendments are needed
- s.7 Providers of user-to-user services: duties of care
- s.9 Illegal content risk assessment duties significant change
- s.11 Childrenās risk assessment duties significant change
- s.12 Safety duties protecting children
- s.14 Assessment duties: user empowerment significant change
- s.15 User empowerment duties
- s.24 Providers of search services: duties of care
- s.26 Illegal content risk assessment duties significant change
- s.28 Childrenās risk assessment duties significant change
- s.29 Safety duties protecting children
- s.36 Duties about childrenās access assessments
- s.41 Codes of practice about duties
- s.46 Publication of codes of practice
- s.50 Effects of codes of practice
- s.52 OFCOMās guidance about certain duties in Part 3
- s.53 OFCOMās guidance: content that is harmful to children and user empowerment
- s.63 Content harmful to children: OFCOMās review and report report
- s.65 OFCOMās guidance about user identity verification
- s.66 Requirement to report CSEA content to the NCA
- ... and 34 more duties
Offences and penalties 34
- s.40 Fraud etc offences
- s.59 āIllegal contentā etc
- s.69 Offence in relation to CSEA reporting
- s.109 Offences in connection with information notices
- s.110 Senior managersā liability: information offences
- s.111 Offences in connection with notices under Schedule 12
- s.112 Other information offences
- s.113 Penalties for information offences
- s.138 Confirmation decisions: offences
- s.139 Penalty for failure to comply with confirmation decision
- s.140 Penalty for failure to comply with notice under section 121 (1)
- s.143 Amount of penalties etc
- s.148 Interaction with other action by OFCOM
- s.150 Publication by providers of details of enforcement action
- s.168 Appeals against OFCOM notices
- s.179 False communications offence
- s.180 Exemptions from offence under section 179
- s.181 Threatening communications offence
- s.182 Interpretation of sections 179 to 181
- s.183 Offences of sending or showing flashing images electronically
- ... and 14 more offences and penalties
Powers 31
- Schedule 12 OFCOMās powers of entry, inspection and audit
- s.47 Review of codes of practice
- s.92 Duties in relation to strategic priorities
- s.100 Power to require information
- s.101 Information in connection with an investigation into the death of a child
- s.114 Co-operation and disclosure of information: overseas regulators
- s.121 Notices to deal with terrorism content or CSEA content (or both)
- s.126 Review and further notice under section 121 (1)
- s.130 Provisional notice of contravention
- s.141 Non-payment of fee
- s.145 Interim service restriction orders
- s.147 Interim access restriction orders
- s.154A Information for research about online safety matters
- s.157 OFCOMās reports about use of age assurance
- s.164 OFCOMās reports
- s.169 Power to make super-complaints
- s.172 Statement of strategic priorities
- s.173 Consultation and parliamentary procedure
- s.174 Directions about advisory committees
- s.175 Directions in special circumstances
- ... and 11 more powers
Definitions 87
- Schedule 1 Exempt user-to-user and search services provider content public search engine the rest of the service
- s.2 Overview of Act
- Schedule 2 User-to-user services and search services that include regulated provider pornographic content the internal business service conditions public search engine the rest of the service
- Schedule 3 Timing of providersā assessments pre-existing Part 4B service
- s.3 āUser-to-user serviceā and āsearch serviceā user-to-user service search service
- s.4 āRegulated serviceā, āPart 3 serviceā etc Part 3 service Regulated service Public search engine
- s.6 Overview of Part 3
- Schedule 8 Transparency reports by providers of Category 1 services, Category 2A services and Category 2B services illegal search content users
- Schedule 10 Recovery of OFCOMās initial costs initial costs WTA receipts additional fees
- s.10 Safety duties about illegal content illegal content risk assessment
- s.13 Safety duties protecting children: interpretation childrenās risk assessment
- Schedule 15 Liability of parent entities etc the Companies Act penalty notice relevant decision or notice
- s.16 User empowerment duties: interpretation disability non-verified user
- Schedule 17 Video-sharing platform services: transitional provision etc pre-existing Part 4B service safety duties the rest of the service
- s.17 Duties to protect content of democratic importance
- s.18 Duties to protect news publisher content relevant term of service
- s.19 Duties to protect journalistic content
- s.20 Duty about content reporting affected person
- s.21 Duties about complaints procedures affected person
- s.22 Duties about freedom of expression and privacy impact assessment safety measures and policies
- ... and 67 more definitions
Exemptions 11
- s.5 Disapplication of Act to certain parts of services
- s.8 Scope of duties of care
- Schedule 14 Amendments consequential on offences in Part 10 of this Act
- s.44 Secretary of Stateās powers of direction
- s.48 Minor amendments of codes of practice
- s.60 āContent that is harmful to childrenā
- s.71 Duty not to act against users except in accordance with terms of service
- s.83 Duty to notify OFCOM
- s.86 Threshold figure
- s.201 Defences
- s.224 Regulations: general