What Platforms Must Do Under the Online Safety Act
A clear breakdown of the legal duties the Online Safety Act 2023 places on social media companies, search engines, and other regulated services.
The Online Safety Act places a hierarchy of duties on regulated services. The specific requirements depend on the type of service and its scale — all regulated services have baseline illegal content duties, while services likely to be accessed by children have additional children's safety duties, and the largest platforms face the most stringent transparency and accountability requirements. This guide sets out what the law actually requires of platforms.
Tier 1: Illegal content duties (all regulated services)
Every service within scope of the Act must take proportionate measures to: identify illegal content on their service; remove illegal content swiftly once identified; prevent illegal content from being uploaded where possible; and have accessible reporting mechanisms for users. The categories of illegal content covered include child sexual abuse material (CSAM), grooming, terrorism, fraud, hate crime, and intimate image abuse. Platforms must refer CSAM they discover to the National Crime Agency.
Key takeaway: Every regulated platform must actively look for and remove illegal content — not wait to be told.
Tier 2: Children's safety duties (services accessible to children)
Any service likely to be accessed by children must carry out a children's risk assessment setting out the risks their service poses to users under 18. They must then implement safety measures proportionate to those risks. This includes: applying age-appropriate defaults (such as private accounts for new users under 18), not using algorithms to recommend harmful content to children, preventing children from seeing content that is harmful to them even if legal for adults (such as self-harm content), and making it easy for children to report concerns.
Key takeaway: Services accessible to children must risk-assess and put children's safety measures in place proactively.
Tier 3: Category 1 duties (largest platforms)
The largest platforms — designated as Category 1 by Ofcom — face additional duties, including: publishing annual transparency reports on how they handle harmful content; providing tools for users to filter the content they see; giving users the ability to turn off algorithmic content recommendations; and establishing user empowerment features so adults can make informed choices about the content they encounter. Category 1 includes platforms like Meta (Instagram, Facebook), TikTok, YouTube, and X (formerly Twitter).
Key takeaway: The biggest platforms must publish transparency reports and give users more control over algorithms.
Risk assessments: what they must cover
Platforms must carry out and document risk assessments covering: the likelihood that children will use the service; the nature and severity of harm children could encounter; how the platform's design features (such as recommendation algorithms and messaging) affect risk; and what existing safety measures are in place and their effectiveness. Ofcom can inspect these risk assessments and take enforcement action if they are inadequate.
Key takeaway: Risk assessments must be genuine, documented, and updated as the service and risk landscape change.
Complaints and enforcement
All regulated platforms must have accessible, responsive complaints processes. Users must be able to report content, appeal a platform's decision, and receive a timely response. Ofcom can investigate platforms for systemic failures and issue fines of up to £18 million or 10% of global annual turnover. For the most serious failures — such as refusing to co-operate with Ofcom — senior managers can be held personally liable.
Key takeaway: Ofcom can fine platforms heavily and hold senior managers personally accountable for the worst failures.
What the Act does
Requires all regulated services to identify and remove illegal content proactively.
Obligates services accessible to children to carry out and act on children's risk assessments.
Requires the largest platforms to publish annual transparency reports.
Gives Ofcom fining powers of up to £18 million or 10% of global turnover.
Creates personal liability for senior managers in cases of serious non-compliance.
What the Act does not do
Understanding the limits of the Act helps you set realistic expectations when using complaint and reporting processes.
Apply to every website — only 'regulated services' within the Act's definition are covered.
Require all harmful content to be removed — legal-but-harmful content for adults may remain on adult services.
Give users a direct right to take platforms to court under the Act.
Practical steps
Use each platform's reporting tool when you see content that may violate the Act's requirements — your reports are taken seriously as intelligence.
Check whether the platform has published a transparency report — Category 1 platforms are required to do so.
If a platform fails to respond to a complaint about illegal content within a reasonable time, document it for potential Ofcom escalation.
Review Ofcom's register of regulated services to understand which platforms are in scope.
Frequently asked questions
Does the Act apply to platforms based outside the UK?
Yes, if the platform is accessed by users in the UK. The Act applies to services with significant UK user bases regardless of where the company is headquartered. Ofcom has enforcement powers that can affect platforms globally — including the ability to require app stores to remove non-compliant apps from UK users.
What is the difference between a children's safety duty and an illegal content duty?
Illegal content duties apply to all regulated services and require removal of content that is criminal (such as CSAM, terrorism, or fraud). Children's safety duties apply specifically to services accessible by children and cover a wider range of content that may be harmful to minors even if not illegal for adults — for example, content promoting eating disorders or self-harm.
Sources and further reading
Related guides
Last reviewed: 19 April 2026
This is practical educational content to support families. For case-specific concerns about a child's safety, contact the NSPCC helpline on 0808 800 5000 or your local safeguarding team.
Was this page helpful?