If you have been asked to prove your age before watching a video, or noticed a new report button hovering under a post you would rather not see, you have already met the Online Safety Act. The law has arrived in stages, and much of it is now live. It does not ban anything you would recognise as ordinary internet use, but it does change what platforms must do, and what they will ask of you.
What the Act is, and who it binds
The Online Safety Act became law in 2023. Its central idea is simple enough: rather than the government deciding post by post what is allowed, the companies running online services must assess the risks their services create and take reasonable steps to manage them. Ofcom writes the codes of practice and enforces them.
The duties land on two broad groups. First, user-to-user services: anything where people post or message each other, which covers social media, forums, comment sections, dating apps and some gaming services. Second, search services. A blog with no comments, or a shop with no user content, generally falls outside the main duties.
Smaller services are not let off entirely, but the rules scale with size and risk. A village forum does not carry the same load as a global platform.
The duties platforms now carry
In plain English, platforms must:
- Assess risk. Carry out risk assessments, and keep them current, covering illegal content and content that is harmful to children.
- Act on what they find. Put proportionate safety measures in place, from better moderation to safer default settings.
- Enforce their own rules. Follow the terms they advertise instead of quietly ignoring them.
- Make reporting obvious. Give users a clear way to flag illegal content or material that is harmful to children.
- Run a real complaints process. One that reaches a human decision and comes with an explanation.
- Answer to the regulator. Appoint a named contact for Ofcom and respond properly to information requests.
- Be transparent. Publish information about how complaints are handled. Larger, higher-risk platforms face extra duties on top.
Fail badly enough and Ofcom can fine a company up to £18 million or 10 per cent of qualifying worldwide revenue, whichever is higher. In extreme cases a court can require a service to be restricted in the UK. Senior managers can, in narrow circumstances, face personal criminal liability for failing to comply with information requests.
Age checks: where you will meet them
This is the part people notice. "Highly effective age assurance" is now expected where pornographic content is the main draw, and age assurance more broadly where children are likely to use a service and could encounter harmful material.
In practice you will be offered methods such as:
- A selfie checked by age-estimation software.
- Scanning a passport, driving licence or similar document.
- A credit card check.
- Confirmation through your mobile network operator.
- A digital identity wallet or certified age-verification app.
You should be given a choice of methods, and the platform should collect the minimum data needed to do the job. If a check fails because of poor lighting or a blurry photo, try a different option rather than handing over more than you need to. And remember that how your data is handled is a separate question from whether you got in: if you think a check was done badly, that is a data protection matter, and the Information Commissioner's Office takes complaints about it.
What changes for adults
Most adults will not lose access to anything they could previously see. What changes is friction, and control.
The biggest platforms must offer tools that let you reduce how much legal but harmful content you encounter. Think graphic violence, material promoting self-harm, or content encouraging eating disorders. These are settings you switch on, not bans imposed on you. On the largest services, verified adult users get access to these controls, which is one reason you may be nudged to confirm your age or identity.
Search engines must also take steps to stop people being pointed towards illegal material. That is why some searches now return a warning or a much blunter set of results instead of a long list of links.
Reporting and complaining: how to get somewhere
Start with the platform. Use the in-app report tool, then its formal complaints route. Keep a record as you go: screenshots, dates, times, and any reference number you are given. If the content is illegal, a threat, harassment, fraud, or sexual imagery shared without consent, you can report it to the police as well. Child sexual abuse imagery should also go to the Internet Watch Foundation.
If the platform fumbles your complaint, you can tell Ofcom. Be realistic about what that achieves. Ofcom supervises the system rather than investigating your individual post, but the reports it receives do shape where it looks next. For consumer problems or data misuse, Citizens Advice or the ICO may be a better fit.
What the Act does not do
- It is not a general ID requirement. Age assurance applies where children's safety or pornography is at stake, not to every account on every site.
- It does not make legal speech illegal. Nor does it put Ofcom in charge of deciding which individual posts come down.
- It is not a complete shield. Moderation is imperfect, mistakes happen, and no law removes every risk.
- It does not cover the whole web. Small and low-risk services carry lighter duties.
If you are dealing with harassment, defamation or a specific legal dispute, general guidance only stretches so far. Speak to a solicitor, or to Citizens Advice if cost is a concern.
A short checklist for the next few months
- Open the privacy and safety settings on the platforms you use most, especially any that children in your household use.
- Find the content controls and turn them on. They are usually buried a few taps deep, not on the home screen.
- Warn younger users about age-verification scams. Genuine checks happen inside the platform, not through a link in a direct message.
- Save evidence before you report anything serious. It is much harder to retrieve afterwards.
- Know your escalation route: the platform first, then Ofcom, the ICO or the police depending on what has happened.
The rules will keep rolling out, with more duties and more enforcement still to come. You do not need to follow every clause. Knowing where the buttons are, and who to tell when something goes wrong, is plenty.
Photo: Foundry / Pixabay
