The Online Safety Act 2023 (OSA) (c. 50) is an act of the Parliament of the United Kingdom to regulate online content. It was passed on 26 October 2023 and gives the relevant secretary of state the power to designate, suppress, and record a wide range of online content that they deem illegal or harmful to children. The act creates a new duty of care for online platforms, requiring them to take action against illegal content, or legal content that could be harmful to children where children are likely to access it. Platforms failing this duty would be liable to fines of up to £18 million or 10% of their annual turnover, whichever is higher. It also empowers Ofcom to block access to particular websites. However, it obliges large social media platforms not to remove, and to preserve access to, journalistic or "democratically important" content such as user comments on political parties and issues. The act also requires platforms – including end-to-end encrypted message providers – to scan for child pornography and terrorism content, which experts say is not possible to implement without undermining users' privacy. The government has said it does not intend to enforce this provision of the act until it becomes "technically feasible" to do so. The act also obliges technology platforms to introduce systems that will allow users to better filter out the harmful content they do not want to see. The legislation has drawn criticism both within the UK and overseas from politicians, academics, journalists and human rights organisations, who say that it poses a threat to the right to privacy and freedom of speech and expression. Supporters of the act say it is necessary for child protection.
Provisions
Scope Within the scope of the act is any "user-to-user service". This is defined as an Internet service by means of which content that is generated by a user of the service, or uploaded to or shared on the service by a user of the service, may be read, viewed, heard or otherwise experienced ("encountered") by another user, or other users. Content includes written material or messages, oral communications, photographs, videos, visual images, music and data of any description. The duty of care applies globally to services with a significant number of United Kingdom users, or which target UK users, or those which are capable of being used in the United Kingdom where there are reasonable grounds to believe that there is a material risk of significant harm. The idea of a duty of care for Internet intermediaries was first proposed in Thompson (2016) and made popular in the UK by the work of Woods and Perrin (2019).
Duties The duty of care in the act refers to a number of specific duties to all services within scope:
The illegal content risk assessment duty The illegal content duties The duty about rights to freedom of expression and privacy The duties about reporting and redress The record-keeping and review duties For services "likely to be accessed by children", adopting the same scope as the Age Appropriate Design Code, two additional duties are imposed:
The children's risk assessment duties The duties to protect children's online safety For "category 1" services, which will be defined in secondary legislation but are limited to the largest global platforms, there are four further new duties:
The adults' risk assessment duties The duties to protect adults’ online safety The duties to protect content of democratic importance The duties to protect journalistic content
Enforcement powers The act empowers Ofcom, the national communications regulator, to block access to particular user-to-user services or search engines from the United Kingdom, including through interventions by internet access providers and app stores. The regulator can also impose, through "service restriction orders", requirements on ancillary services which facilitate the provision of the regulated services. The act lists in section 92 as examples (i) services which enable funds to be transferred, (ii) search engines which generate search results displaying or promoting content, and (iii) services which facilitate the display of advertising on a regulated service (for example, an ad server or an ad network). Ofcom must apply to a court for both Access Restriction and Service Restriction Orders. Section 44 of the act also gives the Secretary of State the power to direct Ofcom to modify a draft code of practice for online safety if deemed necessary for reasons of public policy, national security, or public safety. Ofcom must comply with the direction and submit a revised draft to the Secretary of State. The Secretary of State may give Ofcom further directions to modify the draft, and once satisfied, must lay the modified draft before Parliament. Additionally, the Secretary of State can remove or obscure information before laying the review statement before Parliament. The act contains provisions allowing eligible entities to bring super-complaints on behalf of consumers. The process for doing so was set out in regulations in July 2025.
Limitations The act has provisions to impose legal requirements ensuring that content removals do not arbitrarily remove or infringe access to what it defines as journalistic content. Large social networks are required to protect "democratically important" content, such as user-submitted posts supporting or opposing particular political parties or policies. The government stated that news publishers' own websites, as well as reader comments on such websites, are not within the intended scope of the law.
Age verification Section 12 of the act states that service providers have a duty to prevent children from seeing "primary priority content that is harmful to children". This includes pornographic images, and content that encourages, promotes, or provides instructions for eating disorders, self-harm, or suicide. The act says that service providers must use age verification or age estimation technology in order to prevent users from being able to access primary priority content unless they are appropriately-aged: the provision applies to all services that allow categories of primary priority content to be made available, including social networks and internet pornography services.
… excerpt ends here. Continue reading the full article.
