First test whether and access controls prevent normal child access. If children can access the service or part, assess actual child use and whether it is likely to attract significant numbers of children.
A stated minimum age does not settle the test if children can still access the service. Assess each materially different part and retain the evidence.
A under sections 35 to 37 decides whether a Part 3 user-to-user or search service, or a materially different part of it, is likely to be accessed by under-18s. Existing services had to complete the first assessment by 16 April 2025. If the answer is yes, the provider must complete the applicable children's risk assessment and follow the child-safety duty route. If the answer is no, keep the evidence and repeat the assessment within 12 months or sooner when a statutory or Ofcom trigger applies.
The duty applies to the provider of every regulated with links to the United Kingdom, including a provider established elsewhere. Confirm that the product is a regulated user-to-user service, search service, or combined service and test the Schedule 1 exemptions before applying the access assessment. Category status does not decide whether this gateway duty applies.
Stage 1 asks whether means children are not normally able to access the service or part. If not, Stage 2 applies the : children are likely to access the service when a significant number of children use it, or the service is of a kind likely to attract a significant number of child users. Significant is contextual and does not require children to form a majority of users.
Use evidence about actual and expected access: reliable age data, registration and usage data, audience research, app-store and marketing choices, content and feature appeal, complaints, support contacts, search queries, school or parent reports, and evidence of circumvention. Do not rely on terms that set a minimum age when the access control is not effective.
A provider can end the assessment at Stage 1 only when the resulting access control is highly effective so that children are not normally able to access the service. A minimum-age term, self-declaration, or weak gate is not enough. Analyse logged-out views, embedded content, alternate clients, account sharing, recovery paths, and each separable service part.
If children are likely to access the service or a part of it, record that result and open the applicable children's risk assessment and safety duties.
Ofcom's quick guide describes a three-month children's risk-assessment period after launch. Its detailed Children's Risk Assessment Guidance, paragraph 2.21, measures that period from the positive children's access-assessment conclusion, including for a new service.
Record both dates, plan to the earlier deadline where they differ, and seek Ofcom clarification before relying on the later one.
Complete a new risk assessment before making a significant change. If children are not likely to access the service, keep the Stage 1 or Stage 2 evidence and the events that trigger a fresh assessment.
Sources (6)
Binding source for the duty to carry out children's access assessments and the initial and event-driven assessment periods.
Primary legislation for the meaning of a Part 3 service being likely to be accessed by children.
Meaning of ‘likely to be accessed by children’
Supports the two-stage process, 16 April 2025 first-assessment deadline, highly effective age-assurance branch, next steps, and 12-month reassessment rule.
Supports the Children's Access Assessment workflow by tying the page to official UK Online Safety Act child-safety and age-assurance materials.
The OSA places requirements for age assurance on organisations that fall in scope.
Published 24 April 2025. Measures three months from a children's access assessment concluding that the new or reassessed service is likely to be accessed by children.
Quick guide updated 1 April 2026 gives the launch-based summary; compare detailed guidance paragraph 2.21.
Record the provider, service and part assessed, user and feature map, assessment date, actual child-use evidence, attraction evidence, stated age, access-control design and test, circumvention evidence, data limitations, result, reviewer, approval, linked children's risk-assessment action, and review triggers.
Sources (2)
Template field support for Children's Access Assessment.
The OSA places requirements for age assurance on organisations that fall in scope.
Template field support for Children's Access Assessment.
The Online Safety Act 2023 (the Act) is a new set of laws that protects children and adults online.
Review the assessment when there is reason to suspect it is no longer accurate and after changes that could affect child use or access prevention. Relevant events include new content or social functions, marketing or audience changes, logged-out access, a new market, an age-assurance change, bypass evidence, complaints, or a material change in child-user data.
Treat the Act as the binding source for who must assess, the likely-access test, and the reassessment triggers. Ofcom's guidance explains the regulator's two-stage method and evidence expectations; it does not replace the statutory test. Record which conclusion comes from the Act, which method comes from guidance, and any judgment the provider made where the evidence was incomplete.
Sources (3)
Review support for Children's Access Assessment.
Online Safety Act
Review support for Children's Access Assessment.
The OSA places requirements for age assurance on organisations that fall in scope.
Review support for Children's Access Assessment.
The Online Safety Act 2023 (the Act) is a new set of laws that protects children and adults online.
Sections 35 to 37 of the Online Safety Act control the scope, test, timing, and reassessment duties. Ofcom's guidance explains the operating sequence and evidence expectations. UK Government and ICO material provides policy and data-protection context but does not replace the Act or Ofcom's statutory guidance.
This page gives a general decision method, not a service-specific legal conclusion. Confirm the provider, UK links, exemptions, service parts, current Ofcom publications, and the deployed age-assurance evidence before relying on a negative assessment. Keep the source version and review date with the assessment record.
Sources (2)
Binding law for children's access assessments, the assessment periods, provider duties, and the meaning of likely access.
Official regulator guidance for the two-stage assessment, evidence, deadlines, reassessment, and next steps.
Assign the access-control tests, child-use and attraction evidence, approval and children's risk-assessment handoff for each assessed service part.
Turn Children's Access Assessment into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
"The OSA places requirements for age assurance on organisations that fall in scope."
"The Online Safety Act 2023 (the Act) is a new set of laws that protects children and adults online."
"Online Safety Act"
"Meaning of ‘likely to be accessed by children’"
"Providers must use risk and evidence-based approaches to ensure there is no room for illegal content and activity on their platforms."
Route and decide Online Safety Act complaints, record the required response, and distinguish an internal review from an Ofcom complaint or super-complaint.
Assess illegal-content risks by offence kind, likelihood, severity, affected users, service design, controls, evidence, and review triggers.
Decide whether an online service is a regulated user-to-user service, search service, combined service, or exempt service under the UK Online Safety Act.
Compare age verification and age estimation methods by assurance, privacy, accessibility, bias, evasion risk, and operational evidence.
When Online Safety Act services need age assurance, what highly effective age assurance means, and how safety duties interact with data protection.
Choose an age-assurance method for an Online Safety Act duty by testing effectiveness, privacy, accessibility, evasion risk, and the consequence of error.
Test whether a service is covered by the UK Online Safety Act by checking service functionality, UK links, exemptions, and the duties that follow.
Apply the UK Online Safety Act Category 1, 2A, and 2B thresholds, calculate active UK users, and use Ofcom's register first published in June 2026 and most recently updated in September.
Verify UK Online Safety Act scope, assessments, controls, reporting, complaints, records, child safety, and category-specific work.
Apply the UK Online Safety Act children's access, risk-assessment, safety, age-assurance, reporting, complaints, and record-keeping duties.
Build a UK Online Safety Act compliance program from service scope through assessments, controls, evidence, review, and Ofcom response.
Design UK Online Safety Act moderation, content-reporting, complaints, and review processes for illegal content and content harmful to children.
UK Online Safety Act compliance dates for risk assessments, child safety, categorised services, fees, and event-based deadlines.
How Ofcom investigates Online Safety Act breaches, issues decisions, requires remedies, imposes penalties, and seeks court orders.
Standalone answers and decision paths for UK Online Safety Act scope, risk assessments, child protection, age assurance, categories, reporting, and enforcement.
Apply the Online Safety Act and UK data protection law together for age assurance, moderation, profiling, recommender systems, and safety-data sharing.
Understand the illegal-content risk assessment, safety, reporting, complaints, record-keeping, and review duties for regulated user-to-user and search services.
Build moderation, content-reporting, and complaints procedures for regulated services, and understand where the Online Safety Act does and does not require an appeal.
How Ofcom assesses Online Safety Act concerns, gathers information, investigates suspected breaches, and reaches enforcement decisions.
The Online Safety Act penalty ceiling, qualifying worldwide revenue, daily penalties, penalty factors, and payment consequences.
Understand which user-to-user, search, combined, and provider-pornography services the UK Online Safety Act regulates and which exemptions narrow scope.
See which UK Online Safety Act requirements apply to Part 3 services, child-accessible services, provider pornography, and categorised services.
A field-by-field template for recording service facts, statutory risks, evidence, controls, residual risk, approval, and reassessment triggers.
Run illegal-content and children's risk assessments in the right order, with evidence for risks, controls, governance, and reassessment triggers.
Organise recurring Online Safety Act risk assessments across product, safety, data, engineering, legal, and governance teams.
Understand when a named senior manager or corporate officer can face personal liability for Online Safety Act information offences and how to control the risk.
Decide whether a service is regulated, whether it is user-to-user or search, which exemptions apply, and whether Ofcom categorisation adds duties.
Move from UK Online Safety Act service scope to Category 1, 2A, or 2B threshold analysis without confusing categorisation with basic coverage.
Understand who must publish an Online Safety Act transparency report, what an Ofcom notice controls, and how to prepare traceable reporting data.
Compare UK Online Safety Act and EU DSA scope, service classes, child-safety and platform duties, dates, evidence, exemptions, and enforcement.
A practical scope test for user-to-user, search, and provider-pornography services under the UK Online Safety Act, including UK links and exemptions.
How the UK Online Safety Act, UK GDPR, Data Protection Act 2018, and Children's Code apply together to safety technologies and children's data.
Ofcom information notices, investigations, representations, confirmation decisions, penalties, remediation, and court-based service restrictions.
The two-stage UK Online Safety Act children's access assessment, evidence, timing, reassessment triggers, and next duties.
UK Online Safety Act illegal content risk assessment scope, required elements, deadlines, review triggers, records, and resulting safety measures.
Classify user-to-user, search, and combined services under the UK Online Safety Act, apply the UK-links and exemption tests, and identify the next duties.
Who receives Ofcom transparency notices, what Schedule 8 can require, the 2026 notice process, first-report timing, and evidence controls.
How UK Online Safety Act duties shape content moderation, user reporting, complaints, reinstatement, terms, records, and human oversight.
How Category 1, 2A, and 2B thresholds work, how Ofcom categorises services, and what the register updated in September 2026 means.
When section 110 can make a named senior manager liable for an Online Safety Act information offence, the available defences, and the controls to keep.
When UK Online Safety Act services need highly effective age assurance, what Ofcom expects, and how UK data protection law applies.