UK’s Online Safety Act: Big Tech Shake-Up with Child Safety in Focus

The UK’s Online Safety Act, which becomes enforceable from July 25, 2025, introduces sweeping new safety requirements for all digital platforms accessible by UK users, even those based overseas.

The law mandates rigorous risk assessments, robust age-verification systems, transparent content moderation, and proactive algorithm oversight. Non-compliance could result in severe consequences, including fines of up to £18 million or 10% of the global annual turnover, whichever is higher.

Regulated by Ofcom, the Act compels platforms to prioritize user protection, especially for children. Requirements include safe-by-design feeds, swift removal of harmful or illegal content, accessible reporting options, and clear assignment of senior executive accountability.

Platforms that are likely to be or commonly accessed by children must complete both illegal-harm and child-risk assessments before the deadline.

Smaller firms and startups, in particular, are sounding the alarm. Many warn that meeting the new rules, including the deployment of secure and privacy-sensitive age verification systems, is expensive and technically challenging. The ambiguity surrounding what constitutes “reasonable” measures further complicates compliance, potentially stifling innovation and prompting some firms to consider withdrawing from the UK market altogether.

Real-world examples now illustrate the law’s reach. Reddit, for instance, has begun verifying the ages of UK users via government-issued ID or selfies to restrict access to mature content, working with third-party services that delete images after a week.

As the Act rolls out, concerns about over-censorship and encryption intrusions persist. Critics, including Children’s Commissioner Rachel de Souza, argue that while the intentions are sound, some measures remain too cautious to protect children fully. Others warn that scanning encrypted messages for harmful content could undermine user privacy.