The Online Safety Act 2023 (OSA) is controversial landmark UK legislation aimed at making the internet safer. It applies to platforms where users share content (social media, messaging apps, forums) and to search engines. It requires platforms to prevent harmful content reaching users and to be more open about how they operate.

Key Areas of the Online Safety Act

• Illegal Content: Platforms must prevent users from encountering illegal material, including terrorism content, child sexual abuse imagery and fraud. Providers must implement systems to detect and remove such content quickly.
• Child Safety: Platforms likely to be accessed by children must conduct risk assessments and put in place safety measures. Those hosting adult content must use effective age verification.
• User Empowerment: Adult users must be given tools to filter out legal but potentially harmful content, such as material promoting self-harm or hate speech.
• Transparency: Larger platforms must report how they handle harmful content and how their algorithms work.

Recent Developments

The debate continues as to whether to ban under 16-year-olds from social media. In its March 2026 Online Safety Industry Bulletin, Ofcom highlighted its first formal information requests to major social media platforms about their safety systems and published updated guidance on age assurance. The ICO also has children’s code guidance.

Key compliance challenges include:

• Age verification: platforms struggle to implement effective checks without compromising user privacy-balancing verification with data minimisation is a key challenge.
• Content moderation: large platforms face rising moderation costs; smaller services question economic viability, with some niche forums closing rather than comply.
• Encrypted services: content scanning requirements may undermine privacy-focused messaging platforms’ core service model.
• Algorithm transparency: uncertainty remains about disclosure requirements for proprietary recommendation systems.

Ofcom and the ICO have issued fines for failing to protect children: Reddit (£14.47m), 8579 LLC (£1.35m), Kick Online (£800,000), 4Chan (£520,000) and MediaLab/Imgur (£247,590). Most companies are appealing or ignoring the fines whereas MediaLab has withdrawn from the UK market rather than comply.

Impact on Users and Businesses

The OSA will significantly affect both users and businesses.

For Users:

• Enhanced protection from harmful content, particularly for children.
• Greater control through mandatory content filtering tools.
• Potential friction from age verification and content restrictions.

For Businesses:

• Significant compliance costs for moderation systems, risk assessments, and specialist personnel.
• Strategic decisions about UK market presence if compliance costs outweigh revenue.
• Reputational benefits for platforms demonstrating strong safety practices.

The Wider Regulatory Landscape

The OSA operates alongside several other regulatory frameworks. The OSA targets platform content and safety; DORA (EU Digital Operational Resilience Act) and NIS Regulations address operational resilience; the EU Cybersecurity Act covers product certification; UK Product Security and Telecommunications Infrastructure Act target connected devices.

What Should You Do Now?

1. Check whether your service falls within scope of the OSA.
2. Complete your risk assessments if you have not already done so.
3. Implement effective safety measures and reporting tools.
4. Review age verification systems if hosting adult content.
5. Appoint a named individual responsible for compliance.
6. Update terms of service to reflect your safety approach.
7. Consider how other regulations apply, particularly if operating internationally.
8. Stay informed about Ofcom guidance and be ready to respond to information requests.

We can help you navigate these requirements, from risk assessments to regulatory preparation.

If you need advice, contact me at +44 20 3824 9748 or fjennings@hcrlaw.com.