UK Act of Parliament 2023 United Kingdom

Online Safety Act 2023

At a glance

Enforced by

Ofcom, BBFC

What's here

124 compliance obligations, 21 practical guides across 2 topics · 7 journeys

Penalty landscape

18 of 124 obligations carry an unlimited fine. 26 carry different penalties and 80 have no criminal penalty — flagged in the list below.

Who this Act binds

Business-side actors with duties under this Act, ranked by how often they appear.

  • Any Person 78
  • Director or Officer 6
  • Data Controller 1

Plus 39 non-business duties on Crown ministers, regulators, local authorities or tribunals — shown collapsed under each section below.

Step-by-step journeys using this legislation

Walkthroughs that take you from a real business situation to compliance.

Relevant guidance

Practical guides for businesses affected by this Act, ordered by how closely they engage with it.

Other Acts binding the same actors

For each actor bound by this Act, the other UK Acts that bind them most often. Useful for understanding the full compliance landscape facing each role.

What this Act requires

Sections that create concrete duties on businesses or carry penalties. Procedural and definitional sections are folded into the “Browse other sections” expander at the bottom of each group. Click any section title to read the source text on legislation.gov.uk.

Part 1 — Introduction

Browse 2 other sections in this Part — procedural / definitional / commencement

Part 2 — Key definitions

Browse 3 other sections in this Part — procedural / definitional / commencement

Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care

s.040

Fraud etc offences

Unlimited fine
  • Commit fraud or related financial offences Any Person
s.041

Codes of practice about duties

Other duties (1) — Crown / regulator
  • Ofcom must issue codes of practice for online safety duties Statutory regulator
s.046

Publication of codes of practice

Other duties (1) — Crown / regulator
  • Ofcom must publish and update Online Safety codes of practice Statutory regulator
s.050

Effects of codes of practice

Other duties (1) — Crown / regulator
  • Ofcom and courts must consider codes of practice in legal proceedings Statutory regulator
Browse 39 other sections in this Part — procedural / definitional / commencement

Part 4 — Other duties of providers of regulated user-to-user services and regulated search services

Browse 7 other sections in this Part — procedural / definitional / commencement

Part 5 — Duties of providers of regulated services: certain pornographic content

Browse 1 other section in this Part — procedural / definitional / commencement

Part 6 — Duties of providers of regulated services: fees

Browse 7 other sections in this Part — procedural / definitional / commencement

Part 7 — OFCOM's powers and duties in relation to regulated services

s.096

Duty to maintain register

Other duties (1) — Crown / regulator
  • Ofcom must maintain and update the register of regulated online services Statutory regulator
s.123

Warning notices

Amended 2 times
Other duties (1) — Crown / regulator
  • Ofcom must issue a warning notice before ordering content technology use Statutory regulator
s.154

Information for research about online safety matters

Amended 2 times
Browse 4 other sections in this Part — procedural / definitional / commencement

Part 8 — Appeals and super-complaints

Part 10 — Communications offences

Part 11 — Supplementary and general

s.207

Publication by OFCOM

Amended 1 time
Other duties (1) — Crown / regulator
  • Ofcom must publish information in a way that reaches affected parties Statutory regulator
s.214

Power to require providers of internet services to prevent or restrict access by children to internet services

Amended 1 time
s.216

Power to amend Act in relation to illegal AI-generated content etc

Amended 2 times
s.217

Power to impose duties about pornographic content

Amended 4 times

Schedules

s.sch003

Part 3 services already in operation at the outset of the regime provided for by this Act

  • Complete first illegal content and children's access risk assessments on time Any Person
s.sch003

Section 15(2) assessments

  • Complete Section 15(2) risk assessment within 3 months of guidance Any Person
s.sch003

Illegal content risk assessments and children’s access assessments of Part 4B part

  • Complete first illegal content risk assessment and children's access assessment within deadlines Any Person
s.sch003

If, on the assessment start day, illegal content risk assessment...

  • Complete illegal content risk assessment and CAA within 3 months Any Person
s.sch003

Section 15(2) assessments of Part 4B part

  • Complete Part 4B risk assessment within 3 months of guidance Any Person
s.sch003

New Part 3 services which start up, and existing services which become Part 3 services, between publication of the first illegal content risk assessment guidance and the first CAA guidance

  • Complete illegal content risk assessment and CAA within deadlines Any Person
s.sch003

New Part 3 services which start up when illegal content risk assessment guidance and CAA guidance are both available

  • Complete first illegal content risk assessment and CAA within 3 months of launch Any Person
s.sch003

Existing services which become Part 3 services when illegal content risk assessment guidance and CAA guidance are both available

  • Complete illegal content risk assessment and CAA within 3 months of becoming a Part 3 service Any Person
s.sch003

Children’s risk assessments

  • Complete children's risk assessment within 3 months Any Person
s.sch003

Section 15(2) assessments

  • Complete section 15(2) risk assessment within 3 months of becoming Category 1 Data Controller
s.sch004

Online safety objectives

Other duties (1) — Crown / regulator
  • Ofcom: ensure code measures align with online safety objectives Statutory regulator
s.sch006

An offence under section 2 of the Obscene Publications Act...

  • Publish obscene material encouraging specified serious offences Any Person
s.sch006

An offence under either of the following provisions of the...

Unlimited fine
  • Possess or distribute indecent images of children Any Person
s.sch006

Inchoate offences

  • Attempt or conspire to commit a listed offence under the Online Safety Act Any Person
s.sch006

An offence under section 160 of the Criminal Justice Act...

Unlimited fine
  • Possess indecent images of a child Any Person
s.sch006

An offence under any of the following provisions of the...

Unlimited fine
  • Commit serious child sexual offences Any Person
s.sch006

Inchoate offences

  • Attempt or conspire to commit an online safety offence Any Person
s.sch007

An offence under any of the following provisions of the...

Unlimited fine
  • Engage in threatening or abusive behaviour or stalking online Any Person
s.sch007

An offence under section 5 of the Psychoactive Substances Act...

  • Supply or offer to supply a psychoactive substance Any Person
s.sch007

An offence under any of the following provisions of the...

Unlimited fine
  • Breach firearms licence and trading rules Any Person
s.sch007

An offence under any of the following provisions of the...

Unlimited fine
  • Sell offensive weapons or knives to under-18s Any Person
s.sch007

An offence under any of the following provisions of the...

  • Use or sell air weapons without a certificate (Scotland) Any Person
s.sch007

An offence under section 1 of the Human Trafficking and...

Unlimited fine
  • Engage in human trafficking (Scotland) Any Person
s.sch007

An offence under section 2 of the Human Trafficking and...

Unlimited fine
  • Engage in human trafficking Any Person
s.sch007

An offence under any of the following provisions of the...

  • Make misleading statements or create misleading impressions Any Person
s.sch007

Inchoate offences

  • Attempt, conspire, or assist a Schedule 7 offence Any Person
s.sch008

When determining which information to require in a notice under...

Other duties (1) — Crown / regulator
  • Ofcom must consider service characteristics when deciding what information to require in a notice Statutory regulator
s.sch011

Regulations specifying threshold conditions for categories of Part 3 services

Other duties (1) — Crown / regulator
  • Secretary of State must set threshold conditions for online service categories Crown / Minister / Government department
s.sch011

Procedure for amending or replacing regulations under paragraph 1

Other duties (1) — Crown / regulator
  • OFCOM must research and publish advice before threshold regulations are changed Statutory regulator
s.sch012

Offences

Unlimited fine
  • Obstruct Ofcom officers or provide false information Any Person
s.sch015

Liability of controlling individuals for failures by entities

Unlimited fine
  • Fail to comply with regulatory notice as controlling individual Any Person
s.sch017

(1) This paragraph applies in relation to a person who...

  • Include qualifying revenue breakdown for Part 4B services in OFCOM notification Any Person
Browse 309 other Schedules — structural / supplementary
s.sch001

Email services

s.sch001

Services provided by persons providing education or childcare

s.sch001

Interpretation

s.sch001

England

s.sch001

Early years provision by a person registered under Chapter 2...

s.sch001

Later years childminding by a later years childminder registered under...

s.sch001

Later years provision by a person registered under Chapter 3...

s.sch001

Education or childcare in a maintained nursery school within the...

s.sch001

Education or childcare in— (a) an Academy school, within the...

s.sch001

Education in— (a) an institution in England within the further...

s.sch001

Education provided by an independent training provider.

s.sch001

SMS and MMS services

s.sch001

Further education for persons under 19 provided by a local...

s.sch001

In paragraphs 12 to 15, “early years childminding”, “early years...

s.sch001

In paragraph 19, “independent training provider” means a provider—

s.sch001

In paragraphs 20 and 22, “local authority in England” has...

s.sch001

In paragraph 22— “combined authority” means a combined authority established...

s.sch001

Scotland

s.sch001

Child minding, within the meaning of Part 5 of the...

s.sch001

Day care of children, within the meaning of Part 5...

s.sch001

Primary education, secondary education or childcare in—

s.sch001

Further education provided by a body listed under the heading...

s.sch001

Services offering only one-to-one live aural communications

s.sch001

Further education provided by a college of further education which...

s.sch001

Wales

s.sch001

Day care for children by a person who is registered...

s.sch001

Primary education, secondary education or childcare in a school in...

s.sch001

Education provided in accordance with section 19A of the Education...

s.sch001

Further education in an institution in Wales within the further...

s.sch001

(1) Any further education or training in Wales that is—...

s.sch001

In paragraphs 31 and 32, “child minding” and “day care...

s.sch001

Northern Ireland

s.sch001

Pre-school education, within the meaning of Part 5 of the...

s.sch001

Limited functionality services

s.sch001

Education in a nursery school, within the meaning of the...

s.sch001

Education or childcare in a school, within the meaning of...

s.sch001

Education which is suitable education otherwise than at school provided...

s.sch001

Education in an institution of further education, within the meaning...

s.sch001

Education in agriculture and related subjects.

s.sch001

The following definitions apply for the purposes of this Schedule....

s.sch001

“Childcare”— (a) in relation to provision in England, has same...

s.sch001

“Education”— (a) in relation to provision in England, Wales and...

s.sch001

“Education in agriculture and related subjects”, in relation to provision...

s.sch001

“Further education”— (a) in relation to provision in England and...

s.sch001

Services which enable combinations of user-generated content

s.sch001

“Higher education”— (a) in relation to provision in England and...

s.sch001

“Primary education” and “secondary education”— (a) in relation to provision...

s.sch001

Exception to exemptions in paragraphs 1 to 5

s.sch001

Internal business services (entire user-to-user service or search service)

s.sch001

Internal business services (part of user-to-user service or search service)

s.sch001

Services provided by public bodies

s.sch002

A user-to-user service described in any of paragraphs 1 to...

s.sch002

(1) A user-to-user service within sub-paragraph (2) or (3).

s.sch002

(1) A search service within sub-paragraph (2).

s.sch002

For the purposes of this Schedule, a service “has links...

s.sch002

In this Schedule— “the internal business service conditions” means the...

s.sch003

Any reference in this Part to the effect of Part...

s.sch003

Application of paragraphs 12 to 14

s.sch003

Illegal content risk assessments and children’s access assessments

s.sch003

If, on the assessment start day, illegal content risk assessment...

s.sch003

Application of paragraphs 16 to 20

s.sch003

Application of Part 1 and paragraph 6

s.sch003

Application of paragraph 5

s.sch003

Interpretation of this Schedule

s.sch003

For the meaning of “likely to be accessed by children”,...

s.sch003

In relation to regulated user-to-user services (or in the case...

s.sch003

In relation to regulated search services and the search engine...

s.sch003

In relation to regulated user-to-user services (or in the case...

s.sch003

In relation to regulated search services and the search engine...

s.sch003

For the purposes of this Schedule, guidance of a particular...

s.sch003

Extension of three-month periods

s.sch003

Interpretation of this Part

s.sch003

(1) In this Part, “assessment start day”, in relation to...

s.sch003

In this Part “video-sharing platform service” has the same meaning...

s.sch004

General principles

s.sch004

(1) Measures described in a code of practice which are...

s.sch004

Measures described in a code of practice may relate only...

s.sch004

Content of codes of practice: age assurance

s.sch004

Content of codes of practice: proactive technology

s.sch004

General

s.sch004

A code of practice may apply in relation to a...

s.sch004

Interpretation

s.sch004

The principles are as follows— (a) providers of Part 3...

s.sch004

The online safety objectives for regulated user-to-user services are as...

s.sch004

The online safety objectives for regulated search services are as...

s.sch004

In the case of a combined service—

s.sch004

The Secretary of State may by regulations amend paragraph 4...

s.sch004

If regulations are made amending the online safety objectives, OFCOM...

s.sch004

Content of codes of practice

s.sch005

An offence under any of the following provisions of the...

s.sch005

An offence under section 113 of the Anti-terrorism, Crime and...

s.sch005

An offence under any of the following provisions of the...

s.sch005

Inchoate offences

s.sch006

An offence under any of the following provisions of the...

s.sch006

An offence under any of the following provisions of the...

s.sch006

An offence under section 1 of the Protection of Children...

s.sch006

An offence under Article 3 of the Protection of Children...

s.sch006

An offence under any of the following provisions of the...

s.sch006

An offence under section 62 of the Coroners and Justice...

s.sch006

An offence under section 69 of the Serious Crime Act...

s.sch007

Assisting suicide

s.sch007

An offence under section 76 of the Serious Crime Act...

s.sch007

Drugs and psychoactive substances

s.sch007

Firearms and other weapons

s.sch007

An offence under any of the following provisions of the...

s.sch007

An offence under any of the following provisions of the...

s.sch007

An offence under any of the following provisions of the...

s.sch007

An offence under section 13 of the Criminal Justice Act...

s.sch007

An offence under any of the following provisions of the...

s.sch007

An offence under section 36(1)(c) or (d) of the Violent...

s.sch007

Assisting illegal immigration

s.sch007

Human trafficking

s.sch007

Sexual exploitation

s.sch007

An offence under any of the following provisions of the...

s.sch007

An offence under any of the following provisions of the...

s.sch007

An offence under section 63 of the Criminal Justice and...

s.sch007

Encouraging or assisting serious self-harm

s.sch007

Threats to kill

s.sch007

An offence under section 33 of the Criminal Justice and...

s.sch007

An offence under section 2 of the Abusive Behaviour and...

s.sch007

Proceeds of crime

s.sch007

Fraud

s.sch007

An offence under section 49(3) of the Criminal Justice and...

s.sch007

Financial services

s.sch007

Foreign interference

s.sch007

Animal welfare

s.sch007

Public order offences, harassment, stalking and fear or provocation of violence

s.sch007

An offence under any of the following provisions of the...

s.sch007

An offence under section 50A of the Criminal Law (Consolidation)...

s.sch007

An offence under any of the following provisions of the...

s.sch007

An offence under any of the following provisions of the...

s.sch007

An offence under any of the following provisions of the...

s.sch008

The incidence of illegal content, content that is harmful to...

s.sch008

Measures taken or in use by a provider to comply...

s.sch008

Measures taken or in use by a provider to comply...

s.sch008

Arrangements that a provider has in place for the reporting...

s.sch008

Measures taken or in use by a provider to comply...

s.sch008

Measures taken or in use by a provider to comply...

s.sch008

The systems and processes by which a provider assesses the...

s.sch008

The systems and processes that a provider operates—

s.sch008

Co-operation by a provider with government, regulatory or other public...

s.sch008

Measures taken or in use by a provider to provide...

s.sch008

Measures taken or in use by a provider to improve...

s.sch008

The dissemination of illegal content, content that is harmful to...

s.sch008

Any other measures taken or in use by a provider...

s.sch008

The incidence of illegal search content and search content that...

s.sch008

The number of users who are assumed to have encountered...

s.sch008

The formulation, development, scope and application of the statements of...

s.sch008

The systems and processes for users to report search content...

s.sch008

The systems and processes that a provider operates to deal...

s.sch008

Functionalities designed to help users manage risks relating to search...

s.sch008

The design and operation of algorithms which affect the display,...

s.sch008

Measures taken or in use by a provider to comply...

s.sch008

Arrangements that a provider has in place for the reporting...

s.sch008

The number of users who are assumed to have encountered...

s.sch008

Measures taken or in use by a provider to comply...

s.sch008

The systems and processes by which a provider assesses the...

s.sch008

The systems and processes that a provider operates—

s.sch008

Co-operation by a provider with government, regulatory or other public...

s.sch008

Measures taken or in use by a provider to provide...

s.sch008

Measures taken or in use by a provider to improve...

s.sch008

Any other measures taken or in use by a provider...

s.sch008

The Secretary of State may by regulations—

s.sch008

The Secretary of State must consult OFCOM before making regulations...

s.sch008

The formulation, development, scope and application of the terms of...

s.sch008

In the application of Part 2 of this Schedule to...

s.sch008

(1) For the purposes of this Schedule, content of a...

s.sch008

In this Schedule— “consumer content” has the same meaning as...

s.sch008

The systems and processes for users to report content which...

s.sch008

The systems and processes that a provider operates to deal...

s.sch008

Functionalities designed to help users manage risks relating to content...

s.sch008

Features, including functionalities, that a provider considers may contribute to...

s.sch008

The design and operation of algorithms which affect the display,...

s.sch009

Internal business services (entire internet service)

s.sch009

Internal business services (part of internet service)

s.sch009

Services provided by public bodies

s.sch009

Services provided by persons providing education or childcare

s.sch009

On-demand programme services and non-UK on-demand programme services that are Tier 1 services (entire internet service)

s.sch009

On-demand programme services and non-UK on-demand programme services that are Tier 1 services (part of internet service)

s.sch009

Interpretation

s.sch010

Recovery of initial costs

s.sch010

Recovery of initial costs: first phase

s.sch010

Further recovery of initial costs

s.sch010

End of the recovery process

s.sch010

Providers for part of a year only

s.sch010

Calculation of the recoverable amount

s.sch010

Regulations about recovery of initial costs

s.sch010

Interpretation

s.sch011

Procedure for first regulations under paragraph 1

s.sch011

Publication of OFCOM’s advice under paragraphs 2 and 3

s.sch011

Interpretation

s.sch011

In this Schedule the “characteristics” of a user-to-user part of...

s.sch011

In this Schedule— “content that is harmful to children” has...

s.sch012

Authorised persons

s.sch012

Entry and search under a warrant must be within the...

s.sch012

An authorised person executing a warrant may take such other...

s.sch012

A person taken on to the premises under paragraph 11...

s.sch012

An authorised person may use reasonable force, if necessary, for...

s.sch012

A warrant authorises entry on one occasion only, unless it...

s.sch012

If the premises are unoccupied or the occupier is temporarily...

s.sch012

Return of warrants

s.sch012

Restrictions on powers

s.sch012

Interpretation

s.sch012

Power of entry and inspection without a warrant

s.sch012

References in this Schedule to a person “acting under this...

s.sch012

In this Schedule “enforceable requirement” has the same meaning as...

s.sch012

In paragraphs 6 to 17 and 20 “warrant” means a...

s.sch012

In the application of paragraph 5(1) to Scotland, the reference...

s.sch012

In the application of paragraph 5(1) to Northern Ireland, the...

s.sch012

Notice requiring information, documents or tests at inspection

s.sch012

Audit

s.sch012

Conditions for issue of a warrant

s.sch012

Evidence of authority

s.sch012

Powers exercisable by warrant

s.sch012

Powers of seizure: supplementary

s.sch012

Further provision about executing warrants

s.sch013

Meaning of “penalty” in this Schedule

s.sch013

Amount of penalties: principles

s.sch013

Limitation to type and amount of penalties previously proposed

s.sch013

Maximum amount of penalties

s.sch013

Maximum amount of penalties: group of entities

s.sch013

Recovery of penalties

s.sch014

Football Spectators Act 1989

s.sch014

Criminal Attempts and Conspiracy (Northern Ireland) Order 1983 (S.I. 1983/1120 (N.I. 13))

s.sch014

Armed Forces Act 2006

s.sch014

Serious Crime Act 2007

s.sch014

Children and Young Persons Act 1933

s.sch014

Police and Criminal Evidence Act 1984

s.sch014

Sexual Offences (Amendment) Act 1992

s.sch014

Sexual Offences Act 2003

s.sch014

Criminal Justice Act 2003

s.sch014

Anti-social Behaviour, Crime and Policing Act 2014

s.sch014

Modern Slavery Act 2015

s.sch014

Sexual Offences Act 2003

s.sch014

Sentencing Act 2020

s.sch014

Elections Act 2022

s.sch014

Criminal Justice and Courts Act 2015

s.sch014

Domestic Abuse Act 2021

s.sch014

Overseas Operations (Service Personnel and Veterans) Act 2021

s.sch014

Criminal Justice (Electronic Commerce) (Amendment) (EU Exit) Regulations 2021 (S.I. 2021/835)

s.sch014

In Schedule 5 to the Sexual Offences Act 2003, in...

s.sch014

Regulatory Enforcement and Sanctions Act 2008

s.sch014

Elections Act 2022

s.sch014

Children and Young Persons Act 1933

s.sch014

Visiting Forces Act 1952

s.sch014

Children and Young Persons Act (Northern Ireland) 1968 (c. 34 (N.I.))

s.sch014

Criminal Attempts Act 1981

s.sch015

Joint provisional notices of contravention

s.sch015

Liability of parent entities for failures by subsidiary entities

s.sch015

Liability of subsidiary entities for failures by parent entities

s.sch015

Liability of fellow subsidiary entities for failures by subsidiary entities

s.sch015

OFCOM’s guidance

s.sch015

Interpretation

s.sch015

In its application for the purposes of this Schedule, paragraph...

s.sch015

For the purposes of this Schedule, sections 1161(4) and 1162...

s.sch016

Part 4B of the Communications Act (video-sharing platform services) is...

s.sch016

In section 368U (maintenance of list of providers)—

s.sch016

In section 368V(4) (meaning of “significant differences”), for the words...

s.sch016

In section 368Y(2)(d) (information to be provided by providers of...

s.sch016

In section 368Z1(3) (duty to take appropriate measures), for the...

s.sch016

In section 368Z10(3)(a) (power to demand information), for the words...

s.sch016

For section 368Z12 (co-operation with member States and the European...

s.sch017

(1) In this Schedule, “pre-existing Part 4B service” means—

s.sch017

Operation of section 368U of the Communications Act

s.sch017

Video-sharing platform services which start up, or start up again, during the transitional period

s.sch017

(1) Sub-paragraph (2) applies in relation to a pre-existing Part...

s.sch017

Paragraphs 11 and 12 apply regardless of whether, or when,...

s.sch017

Introduction

s.sch017

In this Part “relevant regulated service” means—

s.sch017

Application of section 83

s.sch017

Application of section 84: transitional charging year

s.sch017

(1) If a person who is the provider of a...

s.sch017

In this Schedule— “the relevant day”, in relation to a...

s.sch017

Application of section 84: non-transitional charging year

s.sch017

Amounts wholly referable to relevant Part 4B service

s.sch017

Interpretation of this Part

s.sch017

For the purposes of this Part a charging year is...

s.sch017

(1) In this Part “exempt provider” means a person within...

s.sch017

In this Part the following terms have the same meaning...

s.sch017

Interpretation of this Part

s.sch017

For the purposes of this Part an investigation relating to...

s.sch017

OFCOM as appropriate regulatory authority

s.sch017

Duties of service providers to co-operate with investigations

s.sch017

Pre-existing Part 4B services which are regulated user-to-user services

s.sch017

Demands for information, and enforcement of such demands

s.sch017

Enforcement notifications, financial penalties etc

s.sch017

Suspension or restriction of service for contraventions or failures

s.sch017

Regulated user-to-user services that include regulated provider pornographic content

s.sch017

Pre-existing Part 4B services which form part of regulated user-to-user services

s.sch017

Regulated user-to-user services with a Part 4B part and another user-to-user part

s.sch017

Regulated user-to-user services with a Part 4B part and a search engine

s.sch017

Regulated user-to-user services with a Part 4B part but no other user-to-user part or search engine

s.sch017

Assessments of pre-existing Part 4B services or of services which include a pre-existing Part 4B service

Official guidance

Authoritative sources published by regulators or government explaining this legislation.

Enforcement and responsible bodies

The regulators that administer or enforce this legislation.

Ofcom

Primary

Office of Communications

Regulates telecoms, TV, radio, video-on-demand, postal services, and online safety. Issues licences for telecoms providers, manages spectrum. Now enforces Online Safety Act …

British Board of Film Classification

Classifies films, videos, and some video games for age rating. Statutory authority for classifying cinema releases and video works under the Video …

Explore more

Browse legislation

Find other UK business legislation with related guidance.

Regulators

Learn more about the bodies that enforce this legislation.