The Online Safety Act in 2026: What Platforms Now Have to Do

The Online Safety Act in 2026: What Platforms Now Have to Do

The Online Safety Act 2023 received Royal Assent in October 2023, but its duties have come into force in stages, with Ofcom phasing in codes of practice and compliance deadlines across 2024, 2025 and into 2026. The Act places statutory duties on providers of user-to-user services, search services, and certain pornography services with links to the UK. Ofcom is the appointed regulator. This article sets out the main obligations now in force, how they are enforced, and what a UK user can realistically do when harmful content stays online.

If harmful content about you remains online despite reporting it to the platform, you can describe what happened using our free Rights Situation Checker.

Who the Act applies to

The Act has extraterritorial reach. It applies to any regulated service with links to the United Kingdom, meaning a significant number of UK users, the UK as a target market, or content presenting a material risk of significant harm to UK users. Providers based overseas are not outside its scope.

Services are divided into three regulatory tiers, with thresholds set by secondary legislation under Schedule 11 of the Act:

• Category 1: the largest user-to-user services, assessed against thresholds relating to user numbers and functionalities. Services in this category are subject to additional duties beyond those applying to all regulated services.
• Category 2A: the largest search services.
• Category 2B: other high-reach user-to-user services that do not meet Category 1 thresholds.

Ofcom publishes and maintains the register of categorised services under section 96. All regulated services, whether categorised or not, are subject to the core illegal content and, where relevant, children's safety duties.

Illegal content duties

All user-to-user and search services must comply with illegal content duties, with the main safety duties in sections 10 (user-to-user) and 27 (search) and the related risk assessment duties in sections 9 and 26. They must carry out a suitable and sufficient illegal content risk assessment, take proportionate measures to prevent users encountering priority illegal content, and minimise the length of time such content is present.

Priority offences are listed in Schedule 7 and cross-referenced Acts. They include:

• Terrorism offences under the Terrorism Act 2000 and the Terrorism Act 2006.
• Child sexual exploitation and abuse offences under the Protection of Children Act 1978 and the Sexual Offences Act 2003.
• Offences relating to encouraging or assisting suicide under the Suicide Act 1961.
• Controlling or coercive behaviour under section 76 of the Serious Crime Act 2015.
• Drugs, firearms and human trafficking offences.
• Fraud offences under the Fraud Act 2006.
• Offences introduced or amended by the Act itself, including cyberflashing (inserted as section 66A of the Sexual Offences Act 2003), threatening communications (contained in the Online Safety Act itself), and sharing or threatening to share intimate images without consent (inserted as sections 66A to 66D of the Sexual Offences Act 2003 by the Online Safety Act).

Providers must use proportionate systems and processes. The duty is about design and governance, not a guarantee that no illegal content will ever appear. Ofcom's Illegal Harms Codes of Practice, finalised in late 2024 and entering enforcement in 2025, set out the steps Ofcom considers adequate, including measures such as hash-matching for known child sexual abuse material, default settings for children's accounts, and clear reporting routes.

Rights Situation Checker

Describe what has happened and find out which UK human rights protections apply and what you can do.

Try our Rights Situation Checker free, here on this site →

Children's safety duties and age assurance

Services likely to be accessed by children, assessed under section 36, must carry out a children's access assessment and, if in scope, a separate children's risk assessment under section 11. They must protect children from primary priority content, including pornography and content promoting suicide, self-harm, or eating disorders, and from priority content such as bullying, serious violence, and dangerous stunts.

Part 5 of the Act imposes a separate duty on providers of pornography services to ensure children are not normally able to encounter such content. Ofcom's guidance on highly effective age assurance identifies methods such as photo ID matching, facial age estimation, or credit card checks. Self-declaration is not treated as sufficient. These duties took effect for in-scope pornography services in July 2025, with wider application to user-to-user services carrying adult content progressing alongside.

Your situation may be slightly different. ask a question below ↓ and our editorial team will reply with our advice.

User empowerment and transparency duties

Section 14 requires Category 1 providers to give adult users tools to control their experience. These include:

• Features allowing users to reduce the likelihood of encountering specified categories of content, including content that abuses on the basis of race, religion, sex, sexual orientation, disability or gender reassignment, and content encouraging suicide, self-harm or eating disorders, where that content is not itself illegal.
• Features to verify identity and to filter out non-verified users.
• Clear terms of service that are consistently applied.

Category 1 services also have duties relating to content of democratic importance, news publisher content, and journalistic content under sections 17 to 19.

Risk assessments must be kept up to date and produced on request. Categorised services must publish annual transparency reports under section 77, responding to Ofcom notices that specify the information required. Providers must also keep records of compliance steps and cooperate with information notices under section 100. Senior managers can face personal criminal liability under section 109 for failing to comply with certain information notices.

Ofcom's enforcement powers

Ofcom has a graduated enforcement toolkit under Chapter 6 of Part 7:

• Provisional and confirmation notices of contravention.
• Financial penalties up to the greater of £18 million or 10 per cent of qualifying worldwide revenue.
• Business disruption measures via the courts, including service restriction orders and access restriction orders requiring payment providers, advertisers or internet access providers to withdraw services from a non-compliant platform.
• Criminal offences for named senior managers in defined circumstances.

Current penalty figures, enforcement decisions and procedural guidance are published on Ofcom's website at ofcom.org.uk, which should be consulted for the most up-to-date position before taking action.

What a UK user can do

The Act reshapes the regulatory landscape but does not give individuals a direct right to demand removal of a particular post. A user concerned about harmful content should:

• Check the platform's own procedures first. Most regulated services publish a help centre, safety centre or contact route for complaints. Regulated services must also provide easy-to-find reporting and complaints tools under section 21. Use the specific reporting route provided and keep screenshots, URLs and any reference numbers generated.
• Escalate to Ofcom where the concern is systemic. Ofcom accepts complaints that indicate a provider is failing in its duties, for example inadequate reporting tools, ineffective moderation of priority illegal content, or weak age assurance. Ofcom uses this intelligence to inform supervision and investigations, and its website sets out the current complaints process.
• Use other legal routes for individual content. Ofcom will not order a single post removed. For defamation, the Defamation Act 2013 and the operators of websites regime in section 5 may assist. For misuse of private information, the tort recognised in Campbell v MGN Ltd [2004] UKHL 22 applies. For harassment, the Protection from Harassment Act 1997 is available. Intimate image offences under the Sexual Offences Act 2003 as amended, and support from the Revenge Porn Helpline, may be relevant. Data protection rights under the UK GDPR and Data Protection Act 2018, including the right to erasure, can also be exercised. These routes can be procedurally complex, and taking advice from a solicitor is advisable before issuing correspondence or proceedings.
• Report criminal conduct to the police, using 101 or 999 in an emergency, or through the True Vision portal for hate crime.

The Act is designed to change how platforms are run rather than to adjudicate individual disputes. Users who understand that distinction are better placed to choose the right route, whether that is a platform report, an Ofcom complaint about systemic failure, or a civil or criminal remedy directed at the specific content or conduct concerned.

The Next Step

Now that you have read through the advice above, you might want to put it into practice. Our Rights Situation Checker lets you describe what has happened and find out which UK human rights protections apply and what you can do. Try it now →