UK Online Safety Act 2023

What the UK Online Safety Act Is

The Online Safety Act 2023 establishes a duty-of-care regime for online services, requiring platforms to take responsibility for the safety of their users. It exists in response to widespread concern about illegal content, child sexual abuse material, fraud, and content harmful to children. The Act gives the regulator, Ofcom, broad powers to set codes of practice, demand information, and enforce compliance.

The regime is risk-based and proportionate: platforms must assess the risks their services pose and put in place systems and processes to mitigate them, with heightened obligations where children can access the service.

Who It Applies To

The Act applies to user-to-user services and search services that have links to the UK, regardless of where the provider is based. This includes social media, messaging, forums, video sharing, search engines, and many other platforms. The strongest duties apply to the largest and highest-risk "categorized" services, and additional protections apply to any service likely to be accessed by children.

Key Requirements

• Illegal content duties — Assess and mitigate the risk of illegal content and act to remove it.
• Child safety duties — Protect children from harmful content, including through age assurance where appropriate.
• Risk assessments — Conduct and keep updated risk assessments covering illegal content and harms to children.
• Reporting and redress — Provide accessible reporting tools and complaint mechanisms.
• Transparency — Publish transparency reports for categorized services and cooperate with Ofcom.
• Codes of practice — Implement measures aligned with Ofcom's codes, or demonstrate equivalent outcomes.

Penalties for Non-Compliance

Ofcom can impose fines of up to 18 million pounds or 10 percent of qualifying worldwide revenue, whichever is greater. It can also require business disruption measures, and senior managers can face criminal liability for certain failures, including failing to comply with information requests. Service restrictions in the UK are possible for serious breaches.

How to Comply

Determine whether the service is in scope and whether it is likely to be accessed by children, then conduct thorough risk assessments. Build content moderation, reporting, and redress systems, and implement appropriate age assurance where children may access the service. Align with Ofcom's codes of practice, maintain records and transparency reporting, and ensure governance and information-handling processes can respond to Ofcom requests.