Illegal Content vs Harmful Content: A Critical Distinction
Understanding the difference between illegal content (which must be removed by law) and harmful-but-legal content (where duties depend on service type and user age).
One of the most important distinctions in the Online Safety Act is between content that is illegal and content that is harmful but legal. The obligations on platforms are very different for each category, and understanding this distinction helps you set realistic expectations when reporting content and deciding on next steps. This guide explains both categories clearly.
What is illegal content under the Act?
The Online Safety Act defines 'illegal content' as content that constitutes, or directly facilitates, a specific criminal offence. The Act schedules a list of 'priority illegal content' that platforms must take particular action against. This includes: child sexual abuse material (CSAM); content that facilitates child sexual exploitation and grooming; terrorism and terrorist financing content; intimate image abuse (including AI-generated deepfakes shared without consent); online fraud and scams; and hate crimes. Platforms must proactively seek out this content, not just respond to reports.
Key takeaway: Illegal content must be found and removed proactively — platforms cannot simply wait for reports.
What is harmful-but-legal content?
Harmful-but-legal content is material that is not a criminal offence for an adult to view or share, but that may cause significant harm — particularly to children or vulnerable users. Examples include: content promoting eating disorders or self-harm; graphic violence that does not meet the criminal threshold; harmful health misinformation; content that humiliates or bullies without meeting the legal definition of harassment; and adult pornography. The Act's approach is that adults have the right to access legal content, but children do not.
Key takeaway: Harmful-but-legal content is not required to be removed from adult services — the duty is to protect children from it.
How children's services are treated differently
For services likely to be accessed by children, the bar is significantly higher. Content that is legal for adults but harmful to children — such as material promoting eating disorders, self-harm, or age-inappropriate sexual content — must be prevented from reaching under-18 users. Children's services must apply age-appropriate defaults, use algorithmic controls to limit exposure to such content, and make it easy for children to report what they see. The same piece of content may be permissible on an adult platform and prohibited on a children's service.
Key takeaway: The same content may be allowed on adult platforms but must be blocked on children's services — age determines the duty.
Primary priority illegal content vs priority illegal content
The Act creates two tiers of illegal content for platform duties. 'Primary priority' illegal content (CSAM, grooming, terrorism) must be addressed by all regulated services, including small ones. 'Priority illegal content' (a broader list including fraud and hate crime) must be addressed proportionately, with more being expected of larger platforms. This tiered approach means that a small forum is not held to the same detailed compliance standard as a major social network.
Key takeaway: CSAM and grooming are the highest priority — every regulated platform must act on these, regardless of size.
Why this distinction matters for complaints
When making a complaint, knowing whether the content you are reporting is illegal or merely harmful helps you choose the right route. Illegal content — particularly CSAM — should be reported both to the platform and directly to the IWF or CEOP, as these organisations can act independently of platform decisions. Harmful-but-legal content complaints depend on whether the service is a children's service and whether the person complaining is acting on behalf of a child or adult user.
Key takeaway: Illegal content involving children should always be reported to IWF or CEOP as well as the platform — don't rely solely on the platform.
What the Act does
Defines categories of illegal content that all regulated platforms must proactively identify and remove.
Requires children's services to protect under-18s from content that is harmful to them even if legal for adults.
Creates a tiered system: primary priority illegal content must be addressed by all regulated platforms.
What the Act does not do
Understanding the limits of the Act helps you set realistic expectations when using complaint and reporting processes.
Require adult platforms to remove all harmful-but-legal content from adult users.
Make every piece of distressing content illegal — the threshold is based on criminal offences.
Prevent adults from accessing legal content, including adult pornography on compliant services.
Practical steps
When reporting content, identify first whether it is likely illegal (e.g., CSAM, explicit threats, fraud) or harmful-but-legal — this determines your escalation route.
Report suspected CSAM to the IWF at iwf.org.uk/report regardless of whether you have also reported it to the platform.
For content harming a child on a children's service, use the platform's complaint tool and reference the children's safety duties under the Online Safety Act.
If a platform refuses to remove content that you believe is illegal, report to Ofcom and, if criminal, to the police.
Frequently asked questions
Is graphic violence illegal content under the Act?
It depends on the nature and context. Content that incites violence or constitutes a criminal threat is illegal. Graphic violent imagery that does not meet a criminal threshold is not illegal content under the Act, though services accessible to children must still take steps to prevent children from encountering it. Report it using the platform's tool; on a children's platform, reference the children's safety duties.
Are platforms required to remove all pornography?
No. Legal adult pornography is not illegal content. Adult platforms can continue to host it, but they must use highly effective age assurance to prevent children from accessing it. Platforms accessible to children must ensure children cannot see age-inappropriate sexual content — that is a children's safety duty, not an illegal content removal duty.
Sources and further reading
Related guides
Last reviewed: 19 April 2026
This is practical educational content to support families. For case-specific concerns about a child's safety, contact the NSPCC helpline on 0808 800 5000 or your local safeguarding team.
Was this page helpful?