UK

What is the status of the Online Safety Act?

Status

The Online Safety Act ("OSA") received Royal Assent on 26 October 2023, upon which pursuant to s.240(4) OSA certain (though not all) provisions came into force, and Ofcom's powers as an online safety regulator commenced.

Since Royal Assent, the following commencement regulations have been made by the Secretary of State bringing various other provisions into force:

• The Online Safety Act 2023 (Commencement No 1) Regulations 2023 – provisions relating to the cooperation of overseas regulators (in force 22 November 2023)
• The Online Safety Act 2023 (Commencement No 2) Regulations 2023 – a number of provisions, including Ofcom's power to issue information notices, and the transition period for the VSP regime (in force 10 January 2024); and information requests in connection with an investigation into the death of a child (in force 1 April 2024)
• The Online Safety Act 2023 (Commencement No 3) Regulations 2024 – new communications offences (in force 31 January 2024)
• The Online Safety Act 2023 (Commencement No 4) Regulations 2024 – obligations for providers of adult entertainment and various enforcement powers for Ofcom in relation to those providers (in force 17 January 2025)

Importantly, however, the key risk assessment and safety duties on in-scope services do not apply until relevant Ofcom guidance/codes of practice have been finalised on a phased basis.

Illegal harms - Ofcom has consulted on and published its Illegal Harms Statement, including its Risk Assessment Guidance and Risk Profiles for illegal harms, and its Illegal content Codes of Practice for user-to-user and search services. Businesses were required to finish their first illegal content risk assessments by 16 March 2025 and to start complying with their illegal content safety duties from 17 March 2025.

Providers of pornographic services - Ofcom has published guidance on age assurance for publishers of pornographic content. Age assurance duties for these providers became applicable from 17 January 2025.

Children’s safety – all user-to-user and search services were required to conduct a “children’s access assessment” by 16 April 2025 to determine whether the children’s safety duties apply to them. Ofcom has consulted on and published its Children’s Harms Statement, including its Children’s Risk Assessment Guidance and Children’s Risk Profiles, and its Protection of Children Codes of Practice for user-to-user and search services. The children’s risk assessment deadline is 24 July 2025, and the children’s safety duties are applicable from 25 July 2025.

Note: VSP regime in transition - In relation to UK-established VSPs already subject to direct Ofcom regulation (“UK VSPs”), The Online Safety Act 2023 (Pre-existing Part 4B Services Assessment Start Day) Regulations 2024 mean they also have to carry out OSA risk assessments on the same timeframes as other services caught by OSA. However, UK VSPs will not need to comply with the majority of other OSA duties until the existing UK VSP regime has been repealed, likely in Q3 2025.

A timeline for Ofcom’s publication and/or finalisation of other guidance and codes can be found here. Ofcom will also continue to review and iterate the guidance and codes it has already published.

What entity has been appointed as regulator for the purposes of the Online Safety Act?

Name: 
The Office of Communications ("Ofcom")

Website - Ofcom
National law dealing with powers and appointment