Privacy Map

United Kingdom. Children's privacy. Act

OSAOnline Safety Act 2023

Partially in force
Partly verifiedMedium confidence. Phased Ofcom implementation dates taken from general knowledge of Ofcom's roadmap and not re-verified this session.

§1Summary

Synopsis

Imposes duties of care on user-to-user and search services with UK links to assess and mitigate illegal content risks and, where children are likely to access the service, to protect them from harmful content, including through highly effective age assurance. Ofcom enforces through codes of practice, information notices and fines.

Key themes
  • children's risk assessment
  • age assurance
  • illegal content
  • transparency reporting
  • categorised services
  • Ofcom codes
Unique features

Turnover-based fines and potential business disruption (blocking) orders, and personal liability for senior managers in some cases; age assurance duties interact directly with UK GDPR data minimisation and the Children's Code.

SaaS relevance

Caught if the SaaS lets users share content with other users or provides search and has a significant number of UK users or targets the UK; pure B2B tools without user-to-user functionality are largely out of scope.

§2Obligations

Extraterritorial
Yes
Breach notification
None (not a data breach law)
DPO
No
Cross-border transfers
None
Maximum penalty
£18m or 10% of qualifying worldwide revenue (higher)

§3Dates

Key dates
  • Adopted
  • In force
  • Royal Assent 2023-10-26; illegal content duties from 2025-03-17; child safety duties and highly effective age assurance from 2025-07-25; categorised service duties and register phased later; amended by DUAA s.124 (2025-09-30)

§4Text and authority

Text
Authority
Ofcom

§5Where it applies

Domestic law of
United Kingdom

§6Sources and verification

Verification

Medium confidence.

Partly verifiedMedium confidence. Phased Ofcom implementation dates taken from general knowledge of Ofcom's roadmap and not re-verified this session.