Mo Tawfik Khalifa · Product leader and builder
All notes

"Online Safety Act: does it apply to your site, and what you must do"

7 min read · Mo Tawfik Khalifa
Try it below

If people in the UK use your site or app, and users can post, upload or message each other on it, or it has a search engine, or it publishes porn, the Online Safety Act applies to you, wherever you’re based. Most services in scope have owed a written illegal content risk assessment since March 2025, and the ones children use have had to protect them since 25 July 2025.

Ofcom is enforcing it. Its implementation update, last revised 28 July 2026, says it had opened investigations into nearly 100 services.

I’ve built identity products three times around one rule: prove the fact, not the person. This page covers the law from a builder’s side: who’s in, what you owe, what Ofcom has fined, and what to do this month. It isn’t legal advice; for a decision that matters, ask a lawyer who knows the Act.

Does the Online Safety Act apply to my website?

Yes, if your service is one of three kinds the Act covers and it has links with the UK.

  1. User-to-user services. Anything where content one user posts, uploads or shares can be seen by another: social apps, forums, marketplaces, dating apps, game chat, file sharing, group messaging. Section 3 says the feature only has to exist, however little it’s used.
  2. Search services. A search engine that searches more than one website or database. Search across just your own site doesn’t count, per section 229.
  3. Porn providers. Services that publish porn themselves, including porn made by their own AI tool, under Part 5.

The UK link. Section 4 counts a significant number of UK users, or the UK as a target market. It also catches any service people in the UK can use when it presents a material risk of significant harm to them. Ofcom fined an overseas suicide forum £950,000 in May 2026, noting it could still be reached from the UK without a VPN.

Who’s out. Schedule 1 exempts services where users can only share email, SMS or one-to-one voice calls, and services where users can only comment on, review, like or rate your own content. A blog with comments under your posts is usually out.

Describe your service below to get the duties that apply, their dates and a to-do list.

This checker needs JavaScript. In short: the Online Safety Act applies if people in the UK use your service and users can post, upload or message each other on it, or it has a search engine across more than one site, or it publishes porn. In scope services owe an illegal content risk assessment (due 16 March 2025, or three months after launch) and a children's access assessment (due 16 April 2025). If children are likely to use it, add a children's risk assessment (due 24 July 2025) and, if you allow porn or content encouraging suicide, self-harm or eating disorders, highly effective age checks. Porn publishers have needed highly effective age checks since 17 January 2025.

Ofcom runs its own Regulation Checker too. Use both and keep the answer in writing.

What does the Online Safety Act make you do?

Five duties carry most of the weight. Each assessment must be “suitable and sufficient”, with a written record.

  1. Illegal content risk assessment (section 9, or section 26 for search). How could your features be used for illegal content such as terrorism, child sexual abuse or fraud? Then reduce those risks, take illegal content down quickly once you know about it, and say in your terms how you protect people.
  2. Children’s access assessment (section 35). Can children get in, and do enough of them use it, or would it attract them? You may only answer “children can’t get in” if age verification or estimation means children are not normally able to. Repeat it at least yearly, under section 36.
  3. Children’s risk assessment (section 11). If children are likely to use it, assess the risk from content harmful to them, then protect them from it.
  4. Highly effective age assurance, where required. If children are likely to use it and you allow porn, or content encouraging suicide, self-harm or eating disorders, section 12 requires age checks. Porn providers must check every visitor, keep a written record and publish a summary of their checks, under section 81.
  5. Report child sexual abuse content to the National Crime Agency (section 66), for user-to-user services.

One rule runs through them all: assess again before any significant change to how the service works.

Which Online Safety Act dates are already in force?

From Ofcom’s important dates page and roadmap:

A service launched since then has three months from launch for its first illegal content risk assessment and children’s access assessment, per Schedule 3. Next: the government plans to stop social media services offering accounts to under-16s, with regulations laid by the end of 2026 and in force in spring 2027.

What has Ofcom fined so far?

Fines can reach £18 million or 10% of qualifying worldwide revenue, whichever is greater. Actual ones, from Ofcom’s announcements:

Open investigations show where it’s heading. TikTok, since 16 July 2026, over whether its age checks spot children. Aylo, Pornhub’s provider, since 23 September, over a check relying on signals from Apple: the provider stays responsible, wherever the check happens. Meta, since 6 October, over whether it risk assessed a new Instagram feature before launch.

What counts as highly effective age assurance?

Ofcom’s guidance of 16 January 2025 judges every check on four criteria: technically accurate, robust, reliable and fair. Seven kinds can meet them: open banking, photo ID matching, facial age estimation, mobile network checks, credit card checks, digital identity services and email-based age estimation.

Three can’t: users stating their age, payment methods that don’t require the user to be 18, such as debit cards, and terms saying children aren’t allowed. The check must come before any harmful content shows, and you mustn’t point children to ways round it, such as VPNs.

Which method to pick, what each gives away and what it costs is in my guide to proving age without ID.

What should you do this month?

  1. Write down whether you’re in scope, and why. Date it and keep it.
  2. Find your illegal content risk assessment. No record means no assessment, and 4chan paid £50,000 for that.
  3. Write your children’s access assessment. If it says children can’t get in, keep evidence your age check is highly effective.
  4. Gate your releases. No significant feature ships before both assessments are updated.
  5. Test your age check against the four criteria, including any check a third party runs for you.
  6. Name one person for Ofcom’s information requests. A missed deadline is a separate fine.
  7. If users can post, register with the NCA’s reporting portal.
  8. If you run anything like social media, plan for the under-16 rules.

How I’d build age checks into a product

The law asks one question, is this user a child, and most checks answer it by collecting a passport or a face. That builds the thing you least want to hold: a database of IDs.

I led a credential product where nurses and doctors prove their licences to employers: each licence is checked once at the source, sealed to the professional’s own key, and shared field by field. It’s one of the builds in my forward deployed engineer write-up. At PLAYERUNKNOWN Productions I designed a zero-knowledge ID: the game learns a player is real without learning who they are. The long version is How to prove who someone is without seeing who they are.

For an Online Safety Act build, the same rules: ask for one fact, keep the yes and delete the rest, record why you chose the method, and assess again before every change.

Questions people ask

Does the Online Safety Act apply to websites outside the UK?

Yes, if UK users are a significant number or a target market, or if people in the UK can use it and it presents a material risk of significant harm to them. Ofcom has fined providers based outside the UK.

Does the Online Safety Act apply to small websites?

Size doesn’t take you out: a small forum or app where users post or message each other is in scope. The government says duties are proportionate to risk and to each provider’s size and capacity.

Do I need age verification on my website?

If you publish porn, yes. If children are likely to use your service and you allow porn, or content encouraging suicide, self-harm or eating disorders, yes. Otherwise the assessments still apply, but age checks may not.

When did age verification start in the UK?

For sites that publish porn, 17 January 2025. For user-to-user and search services that must protect children, 25 July 2025.

What is the fine for breaking the Online Safety Act?

Up to £18 million or 10% of qualifying worldwide revenue, whichever is greater. Fines so far run from £20,000 to £1.35 million, plus daily penalties until a provider complies.

Can you help my company comply?

I design and build the product side: age checks that collect one fact, the records behind them and the release gates, as a fractional CPO or hands on. If you need this built, write to m@tawfik.tv.

Read next

See all notes