The Online Safety Act received royal assent in October 2023 after six years of drafting, renaming and political argument, and it has been arriving in force in stages ever since. It is also one of the most misdescribed pieces of British legislation in recent memory, variously reported as a ban on encryption, a mandatory age check for the entire internet, and a censorship regime. It is none of those things exactly, and understanding what it does require matters more than the headlines suggest.
What the Act is built on
The Act does not create a list of banned content and instruct platforms to remove it. It creates duties of care. Services that host user-generated content, and search services, must assess the risk that their design creates for users, then take proportionate steps to mitigate that risk. The obligation is procedural rather than editorial, which is why so much of the practical detail sits in codes of practice rather than in the statute.
Those codes are written and enforced by Ofcom, which became the internet regulator for the UK as a result. The Ofcom online safety hub publishes the register of categorised services and the successive codes as they come into force, and it is the only genuinely authoritative source on what is currently required of whom.
Illegal content comes first
The first tier of duty concerns illegal content: terrorism material, child sexual abuse material, fraud, incitement, the sale of controlled drugs and weapons, and a schedule of other priority offences. Every in-scope service, however small, must carry out an illegal content risk assessment and act on it. This is where enforcement began, and it applies to a forum with a few thousand users as much as to a global platform.
Children are the second tier
Services likely to be accessed by children carry additional duties around content that is legal but harmful to under-eighteens: suicide and self-harm material, eating disorder content, pornography, and a broader category of abusive or violent material. This is where age assurance enters. The Act does not require every website to verify identity. It requires services carrying pornography, and services whose risk assessment identifies significant child exposure, to use age checks that are what the legislation calls highly effective.
In practice that has produced a market in facial age estimation and third-party verification rather than the passport-upload regime many people expected. The Information Commissioner guidance on the Children’s Code sits alongside it and constrains how much data those checks may collect, which is the part of the debate that has received least attention.
The encryption question
Section 121 allows Ofcom to require a service to use accredited technology to identify child sexual abuse material, including in private messaging. Critics argued this was incompatible with end-to-end encryption, since scanning content requires access to it. During the Lords stages the government stated that the power would only be used where technically feasible, and no such notice has been issued. The clause remains on the statute book. Both descriptions of the situation, that encryption is threatened and that nothing has happened, are accurate at the same time.
What it does not do
The Act does not give the government power to order the removal of individual posts. It does not create a legal duty to remove lawful speech that adults choose to see; a proposed legal but harmful duty for adults was removed from the bill in 2022 and replaced with user empowerment tools and transparency requirements. It does not apply to email, SMS, or one-to-one voice calls. And it does not, despite widespread belief, require anonymity to end.
Enforcement and consequences
Ofcom can fine up to 18 million pounds or ten per cent of qualifying worldwide revenue, whichever is greater, and in extreme cases can seek business disruption measures that require payment providers and internet service providers to withdraw support from a service. Senior managers can face criminal liability for failing to comply with information notices. Those are serious numbers, and the compliance behaviour they have produced, particularly among smaller forums that concluded the cost of assessment exceeded the value of operating in the UK, is one of the Act’s more visible side effects.
Parliamentary scrutiny continues. Reports from the House of Commons select committees have repeatedly questioned whether Ofcom has the resource to supervise the number of services in scope, which is probably the most important open question about the regime.
What it means for an ordinary user
Concretely: more age checks on adult and gambling sites, more prominent reporting tools, more granular controls over what appears in feeds, and occasional friction on smaller sites that have decided compliance is easier if they geoblock Britain. It is a substantial change to how the internet is governed here, delivered mostly through paperwork obligations rather than visible censorship.
Also on our technology desk: securing your home router, buying a used smartphone without getting caught out, and the full technology section.
