The Online Safety Act Explained: What New Rules Mean for UK Social Media Users

The Online Safety Act Explained: What New Rules Mean for UK Social Media Users

Try to open a video feed on an app you rarely use and there is a fair chance you will be asked to prove your age before anything loads. That prompt is one of the most visible signs of the Online Safety Act, the UK law that sets rules for how online services handle harmful content. It has arrived in stages, and the parts that affect everyday users are now largely in force.

The short version: it does not ban apps, and it does not put Ofcom in charge of individual posts. It makes platforms responsible for understanding the risks their services create, publishing clear rules, enforcing them consistently, and giving users a proper route to complain and appeal.

That distinction matters. The Act is not a single switch that makes the internet safe. It is a framework that asks services to show their work: identify risks, design against them, and be answerable when things go wrong. For users, the result is likely to be a mix of more age prompts, stricter default settings for younger users, clearer reporting tools, and more explanations when content is removed.

Which services are covered

The Act applies to two broad groups. The first is user-to-user services: anything where people post, upload, share or message. That takes in social networks, video apps, comment sections, forums, dating apps, gaming platforms and messaging services. The second is search services.

Size changes the workload, not the principle. A small forum does not face the same burden as a global network, and the smallest services have the lightest duties. But if a service has UK users, it is in scope even when the company is based abroad — which is why a UK user can be asked for age verification by a platform headquartered in California, Singapore or anywhere else. The location of the company does not decide whether the law applies; the presence of UK users does.

There are some practical limits. A plain website with no user comments and no search function is not the target. Nor is a private phone call. But once a service lets people publish, share or search, it is likely to fall somewhere within the Act's reach.

What the Act actually requires

The duties are detailed, but they rest on a few core ideas.

• Understand the risk. Services must carry out risk assessments. A platform aimed at children has to think about how grooming, bullying, self-harm content or pornography could reach them. A general social network has to consider illegal content such as threats, fraud, hate crimes and child sexual abuse material.
• Put systems in place. Risk assessments are not meant to sit in a drawer. Platforms must design and operate systems that reduce the risk of illegal content and, for children, harmful content. That can mean better moderation, safer recommendation systems, age checks, reporting routes and staff training.
• Publish clear terms. The rules about what is allowed must be understandable and applied consistently. A vague promise to remove "bad content" is not enough.
• Give users a voice. Users need a way to report content, complain about a decision and appeal. Platforms must explain what happened and not leave people guessing.
• Be accountable. Ofcom can demand information, investigate failures and impose penalties. Fines can reach £18 million or 10% of global turnover, whichever is higher, for the most serious breaches.

For search services, the duties look a little different. They include safer search settings, especially for children, and action against illegal search results such as child sexual abuse material. In practice, that means a search engine may blur or filter results, disable harmful autocomplete suggestions, or require age assurance for certain queries.

What it means for everyday users

The most obvious change is age assurance. Not every social media account will need a passport or a face scan. The Act does not require ID for all social media. But services that host pornography or other content that is harmful to children must use highly effective age assurance. That could be facial age estimation, a digital ID, a credit card check, a mobile network operator check or another method that meets Ofcom's expectations.

For children and teenagers

The second change is safer defaults. For children and teenagers, platforms may default accounts to stricter privacy settings, limit direct messages from strangers, reduce personalised recommendations or turn off features that increase risk. A teenager opening a new account might find that their profile is not public by default, or that they cannot be messaged by adults they do not know.

The third change is more visible moderation. Comments may be hidden or removed faster. Livestreams may be interrupted. Accounts that repeatedly break the rules may face restrictions. Platforms may also show more explanations, such as "this post was removed because it contained a threat" or "this account has been restricted while we review a report."

For adults

For adults, the Act is less about locking things down and more about giving control. User-to-user services must offer tools to reduce the amount of content harmful to adults that users see. That category can include abuse, harassment, violence, hatred and content encouraging suicide or self-harm. Adults should be able to filter some of this material, report it and appeal decisions. It does not mean lawful political speech is banned, and it does not mean every offensive post disappears.

The Act regulates systems and processes, not individual posts. Ofcom is not a national moderator deciding what every UK user may say or see.

What the Act does not do

It is worth being clear about the limits, because the debate around the Act often runs ahead of the law.

• It does not ban social media apps, messaging services or video platforms.
• It does not require every user to hand over a passport or driving licence to use a social network.
• It does not put Ofcom in charge of individual posts, accounts or takedown decisions.
• It does not remove the need for platforms to protect journalism and content of democratic importance. Recognised news publisher content and political debate get special consideration, though illegal content can still be acted on.
• It does not guarantee that harmful content will never appear. It sets standards for how services manage the risk.

There are also unresolved tensions. Age checks can be intrusive, and privacy campaigners worry about data collection. Free speech groups worry about over-moderation. Child safety groups argue the rules do not go far enough, especially in private messaging. The Act creates a framework, but it does not settle every argument about how the internet should work.

Complaints, appeals and what to do if something goes wrong

If you see harmful content, the first step is still the platform. Use its report button or complaints process. Under the Act, larger services must have clear and accessible complaints procedures. They must respond to complaints within a reasonable time, and they must offer an appeal route when they remove content or restrict an account.

If you are unhappy with how a platform handled a report, you can usually escalate through its internal appeal process. Ofcom does not investigate every individual complaint or tell a platform to put a specific post back up. Its role is to check whether the service is meeting its legal duties. If a platform's systems are failing systematically — for example, if it ignores reports of illegal content or exposes children to pornography — Ofcom can investigate and, if necessary, fine the company or require changes.

There are also routes for organisations. The Act allows for super-complaints, where designated bodies can raise broad concerns with Ofcom on behalf of users. That is designed to catch patterns that individual reports might miss.

What happens next

The Act is being implemented in phases. Ofcom has published codes of practice and guidance, and platforms have been updating their systems to comply. More duties, including additional transparency and categorisation rules for the largest services, will continue to come into force. Users should expect further prompts, settings changes and policy updates over the next few years.

The practical takeaway is simple. The Online Safety Act is not a ban on the internet, and it is not a magic fix. It is a new accountability regime. Platforms must take meaningful steps to reduce harm, explain their rules and give users a fair process. For UK social media users, that means more age checks in some places, stronger protections for children, more control over what adults see, and a clearer route to complain when something goes wrong.

Photo: LoboStudioHamburg / Pixabay