What the UK's Online Safety Act Means for Social Media Users: Beginner Explainer

If a site has recently asked you to confirm your birthday, or made you prove your age before showing you a page, you have already met the Online Safety Act in the wild. The law, passed in 2023, makes Ofcom responsible for how social media and search companies handle illegal content and protect children. It is not a ban on anything you personally post. It is a set of rules about the machinery behind the posts: risk assessments, removal processes, complaint routes and, in some cases, age checks.

Here is what has changed, what has not, and what you can actually do about it.

Who the Act covers

The Act applies to services that let people post, share, message or search. That obviously means the big names: Instagram, TikTok, Facebook, X, Snapchat, YouTube and the rest. It also reaches further down than most people expect. A hobby forum with a few thousand members, a dating app, a gaming service with in-game chat, and the comments section underneath a newspaper article can all count as user-to-user services.

Small services are not exempt. Many have lighter duties, and there are extra exemptions for recognised news publishers, but "we're too small to matter" is not a defence. If you run a busy Discord server or a local community board, it is worth checking Ofcom's guidance rather than assuming it does not apply.

The Act does not tell you what you may say. It tells platforms what they must do about what people say.

The core duties platforms now have

The Act is long and technical, but the practical obligations fall into a handful of buckets:

• Assess risk properly. Every in-scope service must carry out a risk assessment covering illegal content and, where children can use it, harm to children.
• Act on illegal content. Once a platform is aware of content that amounts to a criminal offence, it must have systems to deal with it quickly and consistently.
• Protect children. Services likely to be accessed by children must put measures in place so they do not encounter material that is harmful to them, such as content promoting suicide, self-harm or eating disorders.
• Provide real reporting and complaints routes. You should be able to report content easily and complain if you think a decision was wrong.
• Publish and enforce clear terms. Platforms have to set out what is allowed and apply those rules without quietly ignoring their own policies.
• Answer to Ofcom. The regulator can demand information, open investigations and fine companies. Penalties can reach £18 million or 10% of qualifying worldwide revenue, whichever is higher.

The duties have been arriving in stages. Illegal content duties took effect in March 2025, and the children's safety duties in July 2025. More detail is still being phased in, so expect further changes to what you see on screen over the next couple of years.

Age checks: the change you will notice first

Age assurance is the most visible part of the Act, and the most argued about. Where a service is likely to be used by children and hosts material that is harmful to them, it must use what Ofcom calls highly effective age assurance. In practice that means checking that you are old enough, not simply asking you to tick a box.

Methods include matching a photo of your face to photo ID, facial age estimation, confirming your age through your mobile network or a credit card check, or a verified account from another provider. Some sites apply checks to everyone. Others restrict certain features, such as messaging, to accounts they believe belong to adults.

If you are asked to prove your age

• Check who is doing the checking. Reputable services usually pass you to a specialist verification company rather than storing your passport scan themselves.
• Prefer methods that confirm a yes or no answer rather than ones that keep a copy of your ID.
• If the estimate is wrong, look for the appeal route. Platforms are expected to offer a way to challenge a failed check, so you are not simply locked out.
• Being 45 and asked for ID is not a glitch. The systems are deliberately cautious at first.

What the Act does not do

It does not make rudeness, sharp political argument or bad taste illegal. An early plan to force platforms to suppress "legal but harmful" material for adults was dropped before the Act passed, which means grown-ups can still encounter plenty of unpleasant content. What is criminal — threats, harassment, incitement, intimate image abuse and material showing child sexual abuse — is covered, but the line is drawn by existing criminal law, not by the Act inventing new offences for ordinary users.

It also does not turn Ofcom into a complaints desk for individual posts. The regulator supervises systems and companies, not arguments in comment threads. And the trickiest unresolved area is private messaging, particularly on encrypted services, where the duties and the technology are still being tested.

If something goes wrong

1. Report it inside the app first. That is the route the Act is built around, and it produces a record.
2. Keep evidence. Save the URL, a screenshot, the username and the date and time.
3. Use the formal complaints process. A report is not the same as a complaint. Ask for the decision to be reviewed.
4. Escalate to Ofcom if the process fails. Tell the regulator if a platform appears to be ignoring its own duties, even though it will not adjudicate on one post.
5. Go to the police for criminal material. Threats to life, credible violence and child sexual abuse imagery belong with law enforcement, and there are dedicated reporting routes for the last of these.

A few practical steps this week

Check the safety and privacy settings on the accounts you and your family actually use, rather than the ones you set up years ago and forgot. Parental supervision tools on the main platforms have become more capable, and it is worth ten minutes to see what is switched on.

Learn where the report and block buttons are before you need them. If you are being targeted, reporting each item builds a pattern that automated systems notice far better than a single complaint.

If you run any kind of online group — a forum, a server, a club page — read Ofcom's guidance for smaller services and write down how you handle reports. Being able to show a simple, followed process is most of what is asked of you.

Finally, treat your own posting as if it is permanent, because it usually is. Screenshots travel faster than deletions.

This is general information rather than legal advice. If you run a service and are unsure whether the Act applies to you, check Ofcom's published guidance or speak to a solicitor.

Photo: JÉSHOOTS / Pexels