UK Online Safety Act – Summary, Encryption & Child Safety

The UK Online Safety Act 2023 is a landmark piece of legislation that imposes new duties on social media platforms, search engines, and other user-to-user services to tackle illegal content and protect children online. With Ofcom as the main regulator, the Act has sparked intense debate over encryption, privacy, and free speech. This explainer covers what the Act does, when its duties take effect, and where the biggest controversies lie.

Receiving Royal Assent on 26 October 2023, the Online Safety Act created a regulatory framework that shifts responsibility from individual users to the platforms that host content. Its central requirement is that in‑scope services must assess risks, put proportionate safety systems in place, and remove or mitigate unlawful material when it appears. The law also specifically addresses content harmful to children, making age assurance a key feature.

Supporters see the Act as a necessary step to hold platforms accountable and protect vulnerable users. Critics, including civil liberties groups and encrypted‑messaging providers, argue that some provisions threaten privacy, weaken encryption, and could lead to over‑censorship of lawful speech. As enforcement begins in 2025, the Act remains one of the most contested internet laws in Europe.

What is the UK Online Safety Act 2023 in simple terms?

Key insights

• The Act introduces a three‑tier duty system: illegal content, child safety, and adult user safety (legal but harmful).
• Ofcom has the power to issue fines of up to 10% of global turnover for non‑compliance.
• Encryption scanning provisions remain the most controversial element, with privacy advocates calling them a backdoor mandate.
• The Act does not apply to the entire internet – it focuses only on user‑to‑user services and search engines with a UK link.
• Services must assess risks and implement proportionate safety systems, not just react after harm occurs.
• Search engines also have duties to reduce the risk of users encountering illegal content through search results.

Key Facts: UK Online Safety Act

For the full legislative text, see the Online Safety Act 2023 on legislation.gov.uk. The official government explainer provides a simplified overview at gov.uk/online-safety-act-explainer.

Does the Online Safety Act affect end‑to‑end encryption?

Yes, and this is arguably the most disputed aspect of the Act. Some provisions would require providers of end‑to‑end encrypted messaging services – such as WhatsApp and Signal – to scan for child sexual abuse material (CSAM) and terrorism content. Critics argue that true end‑to‑end encryption cannot be maintained if a platform is compelled to inspect message content.

Ofcom’s powers versus encryption technology

Ofcom can require platforms to use “accredited technology” to detect illegal content. The government has stated that it does not intend to enforce this until it becomes “technically feasible” to do so without breaking encryption. Privacy experts, including the Electronic Frontier Foundation (EFF), contend that no such technology exists and that the requirement effectively mandates a backdoor.

The debate: child safety vs. universal privacy

Supporters of the Act say scanning for CSAM is a proportionate measure to protect children. Opponents, including encrypted‑messaging companies, warn that weakening encryption would expose all users to greater security risks, including surveillance and hacking. The EFF has described the Act as “a massive threat to online privacy, security, and speech.”

What Signal and WhatsApp have said about the Act

Both Signal and WhatsApp have publicly stated that they would rather leave the UK market than break encryption. Signal’s president has called the scanning provisions “the most dangerous piece of internet legislation ever proposed in the West.” WhatsApp has warned that it cannot comply without undermining the security of all its users.

How does the Online Safety Act protect children online?

Age verification requirements for adult content

Services that host pornographic material or other content restricted to adults must use age‑assurance methods – such as age estimation or formal age verification – to prevent children from accessing it. This duty applies regardless of where the service is based, as long as it has a UK link.

Duty to protect children from legal but harmful content

Beyond illegal material, the Act requires platforms to assess and mitigate the risk that children will encounter content that is legal but harmful, including material promoting self‑harm, eating disorders, or suicide. This “child safety duty” is one of the most expansive parts of the law.

Reporting mechanisms for child sexual abuse material (CSAM)

Platforms must have clear and accessible reporting tools for users to flag CSAM. The Internet Watch Foundation (IWF), which works closely with Ofcom, explains that the Act creates a legal obligation to remove and report such material promptly.

Online Safety Act vs. GDPR / Data Protection Act: What is the difference?

The Online Safety Act is a content‑moderation and platform‑safety law, not a privacy law. By contrast, the UK GDPR and the Data Protection Act 2018 regulate how personal data is collected, stored, and processed. The two regimes intersect primarily around age verification and scanning systems, which must comply with data‑protection principles.

Any age‑verification system used under the Online Safety Act must still be designed in a way that complies with data‑protection law. The Information Commissioner’s Office (ICO) has published guidance on how to balance the two regimes.

Compared with the EU Digital Services Act (DSA), the UK Act is more explicitly focused on child safety and age assurance, while the DSA centres on systemic platform governance and illegal content controls. The encryption controversy is also far more pronounced under the OSA.

What is the timeline for the Online Safety Act (2023‑2026)?

1. 2021 – Online Safety Bill introduced to Parliament.
2. 2022 – Bill undergoes significant amendments, including removal of the “legal but harmful” clause for adults.
3. 26 October 2023 – Bill receives Royal Assent, becomes Online Safety Act 2023.
4. 31 January 2024 – Criminal offences introduced by the Act come into effect.
5. December 2024 – Ofcom publishes its first codes of practice and guidance for illegal‑content duties.
6. 17 March 2025 – Ofcom can enforce the illegal content regime.
7. 25 July 2025 – Children’s safety duties come into force.
8. Late 2025 – Risk‑assessment and implementation deadlines continue; first enforcement actions begin.
9. 2026 (projected) – Full enforcement of all duties, including safety duties for legal but harmful content.

Ofcom’s online safety hub provides up‑to‑date guidance for platforms on each milestone.

What We Know vs. What Is Still Uncertain

Will the Online Safety Act be repealed?

A petition to repeal the Act, largely driven by privacy advocates and free‑speech groups, gained over 100,000 signatures, triggering a parliamentary consideration. The government has so far defended the Act, stating it is necessary for child protection. A full repeal appears unlikely in the near term, but amendments – particularly around encryption – remain possible as legal challenges proceed.

Analysis: Why the Online Safety Act Matters

A global benchmark or a warning?

The UK Online Safety Act is one of the most ambitious attempts to regulate online platforms. It shifts responsibility from users to platforms, requiring proactive moderation. However, it also raises significant concerns about free expression and encrypted communications. The EFF and other privacy advocates argue the Act could weaken security for everyone.

Comparison with the EU Digital Services Act

While both aim to make online platforms safer, the DSA is part of a broader digital governance framework and includes strong procedural safeguards. The OSA focuses more narrowly on content harm and gives Ofcom more direct enforcement power, but lacks the DSA’s systemic risk analysis framework. The UK law has also generated more direct controversy over encryption and private messaging scanning.

For readers interested in UK regulatory compliance more broadly, see our detailed guide on HMRC Wage Raid Payroll Checks – What UK Employers Need 2025‑26 and the warning about Amazon Account Attackers Warning – Spot Scams and Protect Account.

Quotes and Sources

“The Online Safety Act 2023 (the Act) is a new set of laws that protects children and adults online. It puts a range of new duties on social media companies and search engines.”

– gov.uk (Official Explainer)

“The Online Safety Act is a threat to the privacy of users, restricts free expression by arbitrating speech online, exposes users to algorithmic content moderation.”

– EFF (August 2025)

“The Online Safety Act 2023 (OSA) (c. 50) is an act of the Parliament of the United Kingdom to regulate online content. It was passed on 26 October 2023.”

– Wikipedia

“The UK Online Safety Act (2023) is a new law that introduces measures to protect children and adults online.”

– Internet Watch Foundation

What to Watch for Next

• Legal challenges regarding encryption scanning (Signal/WhatsApp)
• Ofcom enforcement actions against major platforms (2025‑2026)
• Potential amendments or repeal attempts in the next Parliament
• Implementation of age verification technology standards
• Impact assessment reports on freedom of speech and privacy

The Act is still in its early enforcement phase. How Ofcom wields its powers and how platforms respond will shape the future of online safety regulation not only in the UK but as a potential model for other countries.

Frequently Asked Questions