The UK's Online Safety Act (the "Act") is a transformative piece of legislation and is introducing extensive online safety obligations for user-to-user services, search services and pornography platforms. The Act encompasses a new set of laws and codes which are being implemented in phases by Ofcom, the regulator appointed to manage the Act's implementation and enforcement. The penalties are large: fines of up to £18 million or 10% of global turnover (whichever is greater), as well as potential criminal liability for directors, and the possibility of restrictions on access to the UK market.
The rollout of the Act is taking effect in three phases, and each phase is accompanied by guidance and codes of practice:
- Phase 1 (now in force): illegal harms – duties on user-to-user searches and search services to manage the risk of harm to users from illegal content and activity.
- Phase 2 (phased implementation in 2025): child safety – duties on providers to assess whether content is likely to be accessed by children and to implement the relevant measures to protect children from harm.
- Phase 3 (not in force earlier than 2026): categorised services – duties on a small number of categorised services, which will be designated by Ofcom.
Phase 2
25 July 2025 marked a pivotal date for the Act as key provisions, principally the child safety obligations, took practical effect. User-to-user services that are likely to be accessed by children must implement measures to prevent young people from coming across certain harmful material, including accessing "primary content" such as promoting self-harm, suicide and violence, as well as pornography. In-scope services are required to implement "highly effective" age assurance measures.
The implementation of these provisions of the Act followed on from Ofcom's publication of the Children's Risk Assessment Guidance (the "CRA") and its Protection of Children Codes of Practice in April 2025. The CRA had to be completed by in-scope services by 24 July 2025 and is designedto evaluate the risks of harms to children posed by content on the relevant service.
Key Dates
Ofcom published a roadmap in October 2024, setting out its codes of practices and implementation dates. Major milestones include:
- December 2024: Ofcom published its first edition of Illegal Harms Codes and Guidance. Platforms had until 16 March 2025 to complete an illegal harms risk assessment.
- January 2025: Ofcom published Guidance on Children's Access Assessments and for Pornography Providers on Age Assurance. All in-scope user-to-user and search services were required to complete a children's access assessment by 16 April 2025. Pornography services were required to introduce age checks by July 2025.
- February 2025: Ofcom consulted on best practice guidance on protecting women and girls online, earlier than previously planned.
- March 2025: Platforms were required to complete their illegal harms risk assessments and implement appropriate safety measures.
- April 2025: Platforms were required to complete children's access assessments. Ofcom published the CRA and its Protection of Children Codes of Practice.
- June/July 2025: Ofcom due to publish its register of categorised services. At the date of publication of this article, Ofcom are yet to publish the register.
- 25 July 2025: Platforms must have completed children's risk assessments and made sure they have implemented appropriate safety measures.
- August - November 2025: Ofcom are expected to issue draft and final transparency notices to categorised services.
- October – December 2025: Fees regime to come into force. Providers should notify Ofcom of their liability to pay fees. Ofcom does not expect to issue invoices for the 2026/27 charging year until Q3 of 2026.
Comment
The Act sets a new standard for online safety and reflects a broader global trend toward regulating online platforms. It is apparent that children's safety online is a priority in the UK and one of the key pillars under the Act. Ofcom has clearly indicated that it is ready and willing to use its enforcement powers under the Act, including through investigations and substantial penalties for non-compliance. Online services that are likely to be accessed by children should ensure that they meet the Act's requirements, which include robust age assurance measures and safeguards against harmful content. For more detailed commentary on the UK Online Safety Regime, see our article here.
Visit us at mayerbrown.com
Mayer Brown is a global services provider comprising associated legal practices that are separate entities, including Mayer Brown LLP (Illinois, USA), Mayer Brown International LLP (England & Wales), Mayer Brown (a Hong Kong partnership) and Tauil & Chequer Advogados (a Brazilian law partnership) and non-legal service providers, which provide consultancy services (collectively, the "Mayer Brown Practices"). The Mayer Brown Practices are established in various jurisdictions and may be a legal person or a partnership. PK Wong & Nair LLC ("PKWN") is the constituent Singapore law practice of our licensed joint law venture in Singapore, Mayer Brown PK Wong & Nair Pte. Ltd. Details of the individual Mayer Brown Practices and PKWN can be found in the Legal Notices section of our website. "Mayer Brown" and the Mayer Brown logo are the trademarks of Mayer Brown.
© Copyright 2025. The Mayer Brown Practices. All rights reserved.
This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.
