Overview of the UK Online Safety Act 2023
The UK Online Safety Act 2023 (OSA) represents a comprehensive legislative framework designed to regulate online content and mitigate risks associated with digital platforms. Enacted on 26 October 2023, the act establishes a duty of care for online service providers, requiring them to address illegal content and content that may harm children. The legislation applies globally to platforms with a significant UK user base or those targeting UK audiences, where there is a material risk of significant harm. Non-compliance with these obligations can result in fines of up to £18 million or 10% of a company’s annual global revenue, whichever is higher. Ofcom, the UK’s communications regulator, is empowered to enforce these rules, including the ability to block access to non-compliant platforms or impose service restrictions on ancillary services such as payment processors, search engines, and ad networks.
The act introduces a phased implementation schedule, with key provisions rolling out through 2025. The OSA also mandates the preservation of journalistic and democratically important content, such as user comments on political issues, to safeguard freedom of expression. However, critics argue that certain provisions, particularly those requiring content scanning for child abuse material and terrorism-related content, may compromise user privacy without clear technical feasibility.
The OSA builds on earlier proposals, including the 2016 Thompson report and the 2019 work by Woods and Perrin, which advocated for a duty of care framework for internet intermediaries. The legislation explicitly defines a 'user-to-user service' as any platform where content generated by users can be encountered by others, encompassing a broad range of digital services, from social media to messaging apps and forums.
Key Provisions and Obligations
For all in-scope services, the act mandates an illegal content risk assessment duty, requiring platforms to evaluate and mitigate risks associated with illegal material, such as child sexual abuse content, terrorism promotion, and cyberflashing. Platforms must also adhere to illegal content duties, which include proactive measures to detect, remove, and report such content. Additionally, the act emphasizes the rights to freedom of expression and privacy, ensuring that content removals do not disproportionately restrict legitimate discourse or infringe on user privacy.
These obligations require platforms to implement age verification or age estimation technologies to prevent children from accessing harmful content, such as pornography, content promoting eating disorders, self-harm, or suicide.
The OSA also mandates the protection of democratically important content, such as user-generated posts related to political debates or social issues, to prevent arbitrary censorship. Platforms must preserve access to such content while still addressing illegal or harmful material, striking a balance between safety and free expression.
Enforcement and Controversial Measures
Ofcom plays a central role in enforcing the OSA, with powers to impose fines, issue service restriction orders, and block access to non-compliant platforms. The regulator can target ancillary services, such as payment processors or ad networks, that facilitate regulated platforms, ensuring a comprehensive approach to compliance. Section 44 of the act grants the Secretary of State the authority to direct Ofcom to modify draft codes of practice for public policy, national security, or public safety reasons. This provision allows for dynamic adjustments to the regulatory framework in response to emerging threats, though it has raised concerns about potential government overreach and lack of transparency.
One of the most contentious aspects of the OSA is the requirement for platforms to scan end-to-end encrypted messages for child sexual abuse material and terrorism content. Experts argue that this mandate is technically unfeasible without undermining encryption and user privacy. The UK government has stated that it will not enforce this provision until it becomes 'technically feasible,' acknowledging the challenges posed by encrypted communication. Critics, including human rights organizations and academics, warn that such measures could set a precedent for broader surveillance, eroding trust in digital privacy protections.
The act also introduces super-complaints, a mechanism allowing eligible entities to file complaints on behalf of consumers, streamlining the process for addressing systemic issues.
Criminal Offences and Additional Safeguards
The OSA expands the legal framework to criminalize several harmful online behaviors. It introduces two new offences under the Sexual Offences Act 2003: cyberflashing, defined as sending unsolicited images of genitals, and the sharing or threatening to share intimate images without consent. The first conviction for cyberflashing occurred in March 2024, signaling the act’s early impact on combating online harassment. Additionally, the OSA updates the false communications offence, replacing provisions from the Communications Act 2003. To prosecute under this offence, authorities must prove that the defendant knew the information was false and intended to cause non-trivial psychological or physical harm, a standard that legal experts suggest may be difficult to enforce in practice.
The act also addresses epilepsy trolling through Zach’s Law, named after a young epilepsy advocate. Section 183 criminalizes sending or showing flashing images electronically if it is reasonably foreseeable that an individual with epilepsy would view them, and the sender intends harm. Furthermore, the OSA makes encouraging or assisting serious self-harm a criminal offence, aligning with existing suicide-related laws. The first conviction under this section occurred in July 2025, demonstrating the act’s role in addressing emerging digital threats to mental health.
The OSA’s provisions on age verification require platforms to implement technologies that prevent children from accessing harmful content, such as pornography or material promoting self-harm. Section 12 of the act specifies that service providers must use age verification or estimation methods to restrict access to 'primary priority content' unless users are of legal age.
Scope and Limitations of the Act
The OSA’s scope extends to any 'user-to-user service,' broadly defined to include platforms where content generated by users can be encountered by others. This encompasses social media, messaging apps, forums, and even services facilitating transactions or advertising. The duty of care applies globally to platforms with a significant UK user base or those targeting UK audiences, ensuring that international services cannot evade regulatory oversight by operating outside the UK. However, the act explicitly excludes news publishers’ own websites and their reader comments from its intended scope, clarifying that the protections for journalistic content apply only to user-generated posts on third-party platforms.
Supporters of the act counter that these measures are necessary to protect children and vulnerable individuals from exploitation and harm.
Required actions
- Assess and mitigate illegal-content risks, including from generative AI features, and comply with Ofcom codes on proactive technology - Protect children from harmful content through highly effective age assurance and safer algorithmic feeds - Remove non-consensual intimate deepfakes; Ofcom treats generative AI chatbots as user-to-user or search services where they meet the definitions