As society's use of the internet, especially social media, has grown, it has become clear that harmful online content can lead to serious real-world consequences. These include the damage caused by online bullying and abuse, as well as the spread of misinformation and hate speech. The UK Government's legislative response, promising a "zero-tolerance approach to protecting children from online harm, while empowering adults with more choices over what they see online," passed into law in October 2023 as the Online Safety Act. The first duties took effect at the end of 2024 – see further below.
The Act targets three main categories of harmful content: illegal content (in relation to criminal as opposed to civil offences); content that is lawful but nevertheless "harmful to children"; and fraudulent advertising. There are also provisions targeting certain pornographic content.
Although the Act places the greatest obligations on service providers that are high-risk and high-reach, such as large social media platforms, the Government estimates that 25,000 businesses will be affected (including online marketplaces, dating apps, online games and forums), as well as those that have links to the UK, but operate outside. All companies in scope will owe their users a duty of care, and will be required to put in place systems and processes to protect their users. The Act places additional duties on services "likely to be accessed by children". Failure to comply with the Act and associated regulations, which will be enforced by OFCOM as the new internet regulator, may lead to penalties, including fines of up to £18 million or ten percent of global turnover, whichever is higher, as well as potential criminal sanctions for senior managers.
The Online Safety Act will revolutionise how we interact online and, it is hoped, afford significantly better protection to victims of online harms. There remain, however, huge questions as to how the scheme will operate in practice, its impact on businesses (including new businesses) and the implications for privacy rights and freedom of speech. We will monitor its impact closely.
Keeping up to date
This page provides links to key documents and commentary on the Act, the Bill as it was, and broader issues relating to online harms. We also set out the key implementation dates below.
If you have any questions about how the Act may affect you or your business, please contact a member of the team or send us an email. Our multi-disciplinary team includes lawyers and non-lawyers with expertise in reputation protection and crisis management, data protection, child safety, criminal law, regulatory compliance and disputes, and cyber security.
To receive further updates on the Act, please sign-up to our Online Safety Act mailing list.
Key dates
In line with its updated roadmap to regulation, Ofcom will deliver codes of practice on how in-scope companies can comply with their duties, in three phases:
Phase one: Illegal harms
Phase two: Child safety, pornography and the protection of women and girls
Phase three: Categorisation and additional duties for categorised services
Ofcom's key milestones include:
- December 2024: OFCOM published its illegal harms codes and guidance. Platforms have until 16 March 2025 to complete an illegal harms risk assessment.
- January 2025: OFCOM published guidance on children's access assessments and for pornography providers on age assurance. All in-scope user-to-user and search services must complete a children's access assessment by 16 April 2025. Pornography services must introduce age checks by July 2025.
- February 2025: OFCOM will consult on best practice guidance on protecting women and girls online, earlier than previously planned.
- March 2025: Platforms must complete their illegal harms risk assessments, and implement appropriate safety measures.
- April 2025: Platforms must complete children’s access assessments. OFCOM is due to publish its Protection of Children Codes and children’s risk assessment guidance.
- June/July 2025: OFCOM to publish its register of categorised services.
- July 2025: Platforms must complete children’s risk assessments, and make sure they implement appropriate safety measures.
Key documents