The Online Safety Act Enters Phase 2

The UK's Online Safety Act (the "Act") is a transformative piece of legislation and is introducing extensive online safety obligations for user-to-user services, search services and pornography platforms. The Act encompasses a new set of laws and codes which are being implemented in phases by Ofcom, the regulator appointed to manage the Act's implementation and enforcement. The penalties are large: fines of up to £18 million or 10% of global turnover (whichever is greater), as well as potential criminal liability for directors, and the possibility of restrictions on access to the UK market.

The rollout of the Act is taking effect in three phases, and each phase is accompanied by guidance and codes of practice:

1. Phase 1 (now in force): illegal harms – duties on user-to-user searches and search services to manage the risk of harm to users from illegal content and activity.
2. Phase 2 (phased implementation in 2025): child safety – duties on providers to assess whether content is likely to be accessed by children and to implement the relevant measures to protect children from harm.
3. Phase 3 (not in force earlier than 2026): categorised services – duties on a small number of categorised services, which will be designated by Ofcom.

Phase 2

25 July 2025 marked a pivotal date for the Act as key provisions, principally the child safety obligations, took practical effect. User-to-user services that are likely to be accessed by children must implement measures to prevent young people from coming across certain harmful material, including accessing "primary content" such as promoting self-harm, suicide and violence, as well as pornography. In-scope services are required to implement "highly effective" age assurance measures.

The implementation of these provisions of the Act followed on from Ofcom's publication of the Children’s Risk Assessment Guidance (the "CRA") and its Protection of Children Codes of Practice in April 2025. The CRA had to be completed by in-scope services by 24 July 2025 and is designed to evaluate the risks of harms to children posed by content on the relevant service.

Key Dates

Ofcom published a roadmap in October 2024, setting out its codes of practices and implementation dates. Major milestones include:

• December 2024: Ofcom published its first edition of Illegal Harms Codes and Guidance. Platforms had until 16 March 2025 to complete an illegal harms risk assessment.
• January 2025: Ofcom published Guidance on Children's Access Assessments and for Pornography Providers on Age Assurance. All in-scope user-to-user and search services were required to complete a children's access assessment by 16 April 2025. Pornography services were required to introduce age checks by July 2025.
• February 2025: Ofcom consulted on best practice guidance on protecting women and girls online, earlier than previously planned.
• March 2025: Platforms were required to complete their illegal harms risk assessments and implement appropriate safety measures.
• April 2025: Platforms were required to complete children’s access assessments. Ofcom published the CRA and its Protection of Children Codes of Practice.
• June/July 2025: Ofcom due to publish its register of categorised services. At the date of publication of this article, Ofcom are yet to publish the register.
• 25 July 2025: Platforms must have completed children’s risk assessments and made sure they have implemented appropriate safety measures.
• August - November 2025: Ofcom are expected to issue draft and final transparency notices to categorised services.
• October – December 2025: Fees regime to come into force. Providers should notify Ofcom of their liability to pay fees. Ofcom does not expect to issue invoices for the 2026/27 charging year until Q3 of 2026.

Comment

The Act sets a new standard for online safety and reflects a broader global trend toward regulating online platforms. It is apparent that children's safety online is a priority in the UK and one of the key pillars under the Act. Ofcom has clearly indicated that it is ready and willing to use its enforcement powers under the Act, including through investigations and substantial penalties for non-compliance. Online services that are likely to be accessed by children should ensure that they meet the Act’s requirements, which include robust age assurance measures and safeguards against harmful content. For more detailed commentary on the UK Online Safety Regime, see our article here.