United Kingdom - Online Safety Act (2023)

Overview

The Online Safety Act 2023 creates a statutory framework to improve online safety by imposing duties on providers of user-to-user and search services available to people in the United Kingdom. It introduces two principal strands of duties: (1) duties to address illegal content and criminal activity on regulated services; and (2) duties to reduce risks that legal content presents to children. The Act designates the communications regulator Ofcom to develop codes of practice, supervise compliance and enforce the regime with a range of tools including information notices, penalties and, in extreme cases, court-ordered service or access restrictions. For the enacted text and explanatory notes see Legislation.gov.uk - Online Safety Act 2023 (enacted). (legislation.gov.uk)

Definitions

The Act defines key regulated entities and concepts including "user-to-user services" (those that enable user interaction and content sharing), "search services" (that generate search results for user queries), and the categories of content captured by the illegal-content duties (explicitly enumerated types of criminal content). The Act also establishes duty-holders and service categories for proportional supervision (e.g., designations and categories of services). Many technical terms (for example, what constitutes a "service likely to be accessed by children") are clarified through Ofcom guidance and codes of practice. (legislation.gov.uk)

Governance and Institutional Framework

The Act places Ofcom at the centre of governance: Ofcom must consult the public and stakeholders when developing codes, may issue guidance to providers, and is empowered to require information, investigate services, and take enforcement action. The Secretary of State retains narrowly defined powers to direct Ofcom in exceptional circumstances (public policy, national security or public safety), and Parliament exercises oversight via the statutory laying procedure applied to Ofcom’s codes and guidance. Ofcom has also described its supervisory approach — combining targeted oversight of high-risk or large services with broader transparency duties — and has scaled up team capacity and expertise to implement the regime. For Ofcom’s implementation materials and timeline see Ofcom - Important dates for Online Safety compliance. (ofcom.org.uk)

Key Focus Areas

The Act’s substantive focus areas include: preventing and removing illegal content (such as child sexual exploitation and abuse material, terrorism-related content, fraud, and other enumerated offences); protecting children from exposure to harmful but lawful content through age assurance and children’s access assessments; promoting safer design and safer recommendation systems; ensuring transparent terms of service and public reporting about safety measures; and enabling effective reporting, redress and researcher access in appropriate circumstances. The illegal-harms duties are risk-based and require providers to carry out regular assessments, implement proportionate mitigation measures, and keep records. The Act also expands communications offences (e.g., intimate image abuse) and enables coroner information requests backed by Ofcom’s enforcement powers in defined circumstances. These provisions have been the subject of intense public debate over free expression, privacy and encryption. (gov.uk)

Implementation Framework

Implementation is phased and depends heavily on Ofcom’s codes and guidance. The Act requires Ofcom to consult, publish draft codes, lay them before Parliament and then issue final codes after any parliamentary consideration. Providers are required to complete illegal-harms risk assessments, children’s access assessments and, where applicable, implement highly effective age assurance measures. Ofcom’s codes also set recommended measures and baseline expectations according to risk-tiering (e.g., low/medium/high risk services), and services must designate an accountable individual or senior executive responsible for compliance. Ofcom has published enforcement guidance and templates to help providers comply and has initiated supervisory activities targeting services perceived as high-risk. See Ofcom’s explanatory materials at Ofcom - Countdown to a safer life online. (ofcom.org.uk)

Monitoring and Evaluation

Ofcom’s monitoring approach combines proactive supervision (targeted reviews of high-risk services), requests for information and records, periodic reviews of published transparency statements, and formal enforcement investigations where required. The Act creates statutory record-keeping and reporting duties and enables Ofcom to require disclosure of risk assessments and to publish findings where appropriate. Ofcom has signalled an ongoing enforcement programme and a rolling review of risk assessments and provider responses, and intends to publish transparency guidance and findings on compliance. Audits, follow-up inspections and escalation to civil or (in limited cases) criminal sanctions form part of the evaluation toolkit. (committees.parliament.uk)

Penalties, Liability, and Appeals

The Act equips Ofcom with a range of enforcement powers: monetary penalties of up to £18 million or 10% of qualifying worldwide revenue (whichever is greater); remedial or compliance orders; and the ability to seek court orders that may disrupt business models (for example, blocking access or requiring withdrawal of payment/advertising services). In specified child-safety circumstances, failure to comply with an Ofcom confirmation decision may create a criminal offence attracting penalties including imprisonment for individuals (senior managers) and fines for organisations, where consent, connivance or neglect is established. Providers may appeal Ofcom decisions through the courts; the Act preserves judicial review and specified appeal routes for enforcement decisions. (committees.parliament.uk)

Relationship to Other Instruments

The Online Safety Act interacts with a range of domestic and international instruments. It repeals parts of the Digital Economy Act 2017 (notably previous age verification provisions), updates and supplements communications offences under the Communications Act 2003 and Sexual Offences Act 2003, and operates alongside data protection law (including the UK GDPR and Data Protection Act). Internationally, it sits in the same policy space as the EU Digital Services Act (DSA) and other jurisdictions’ measures to govern platform safety, and providers operating across borders will often face parallel compliance obligations. For the enacted text and related explanatory notes see Legislation.gov.uk - Online Safety Act 2023 (enacted). (legislation.gov.uk)

International Alignment

Policymakers have emphasised the need to align outcomes with international frameworks while maintaining UK-specific priorities (notably child protection and criminal content enforcement). The OSA shares objectives with the EU’s DSA—risk assessments, transparency and enforcement tiers—but differs on some scopes and mechanisms. Global platforms must therefore reconcile multiple overlapping obligations; Ofcom has engaged internationally and notes cross-jurisdictional cooperation may be necessary for evidence-gathering, takedown and enforcement. The Act’s technical and human-rights implications (including encryption and freedom of expression issues) have prompted debate with international stakeholders and civil society. (ofcom.org.uk)

Implementation Timeline

Note: many obligations were phased in via Ofcom’s codes and guidance; providers should consult Ofcom’s official timeline for service-specific obligations and dates. (bills.parliament.uk)

Sources and References