UK Online Safety Act Children's Safety Duties

These duties apply to the provider of a regulated Part 3 user-to-user or search service with links to the United Kingdom, even if the provider is established elsewhere. Confirm the service type, responsible provider, UK links, exemptions, and child-accessible parts first. Categorisation can add duties, but it is not a condition for the baseline children's safety duties.

Start with the children's access assessment. Stage one asks whether children can normally access the service or part. A provider may conclude that access is not possible only where highly effective age assurance and access controls prevent people not identified as adults from entering. Otherwise, assess whether a significant number of children use the service or the service is likely to attract a significant number of children.

For every child-accessible part, assess each kind of primary priority content, priority content, and relevant non-designated content that may harm children. Use evidence about the user base, different age groups, design, algorithms, functionalities, business model, governance, incidents, complaints, and Ofcom's Children's Risk Profiles. Record likelihood and impact and assign the Ofcom risk level used in the assessment.

Primary priority content covers pornography and content that encourages, promotes, or instructs suicide, deliberate self-injury, or eating disorders. Priority content includes targeted abuse or incitement of hatred, bullying, serious violence, realistic serious violence or graphic injury, dangerous stunts and challenges, and self-administration of harmful substances. Non-designated content is other content presenting a material risk of significant harm to an appreciable number of UK children. Assess each relevant kind separately rather than treating these labels as one risk.

The user-to-user duties include proportionate systems and processes designed to prevent children encountering primary priority content and to protect children in age-appropriate ways from other harmful content. Search-service duties focus on minimizing the risk that child users encounter harmful search content. The exact controls must follow the service type, risk assessment, and applicable legal duty.

For a user-to-user service, primary priority content must be prevented from reaching children of any age. Other harmful content is controlled for the age groups judged to be at risk. Search services have minimisation duties rather than the user-to-user prevention formulation. Age assurance is not one universal control for every child-safety risk; use it where the Act or selected code measure requires it and design the processing to comply with data-protection law.

The provider should assign one accountable child-safety owner with authority across product, trust and safety, engineering, data, privacy, and legal teams. Control owners must be able to change recommender systems, moderation, search, access, reporting, or complaints where the assessment identifies risk.

Evidence should include the scope and access decisions, child-user and age-group data, risk profiles consulted, harm-by-harm analysis, control design, age-assurance evaluation, testing, incidents, complaints, terms, review approvals, and the written record required by sections 23 or 34.

The terms of service should explain the measures used to protect children in language users can understand, and the provider must apply those terms consistently. Reporting and complaints routes should let children and affected users report harmful content, challenge relevant decisions, and receive an appropriate response; retain evidence that the routes are accessible and work in practice.

An age gate based only on a self-declared birth date does not support a conclusion that children cannot normally access the service. If only one part is effectively restricted to adults, the remaining child-accessible parts still require assessment and controls.

The children's risk assessment is separate from the illegal-content risk assessment. The same content or feature can be relevant to both, but the provider must preserve the distinct statutory analysis.

Existing Part 3 services had to complete children's access assessments by 16 April 2025 and, where likely accessed by children, children's risk assessments by 24 July 2025; the child-safety duties became enforceable from 25 July 2025. Those dates are completed milestones, not deadlines for a new service.

A service that comes into scope later generally has three months from the relevant trigger to complete the required access or risk assessment under Ofcom's current guidance. Complete a children's risk assessment before a significant change and repeat an access assessment within 12 months after a conclusion that the service is not likely to be accessed by children, or sooner when a specified trigger applies.

The Act sets the binding risk-assessment, safety, terms, reporting, complaints, record-keeping, and review duties. Ofcom's Protection of Children Codes describe measures providers can use as a route to compliance, while Ofcom guidance explains its assessment and enforcement approach. A provider using an alternative measure should document how it satisfies the underlying duty and why it addresses the assessed risk.

Sections 35 to 37 control the access gateway, sections 11 to 13 the user-to-user duties, sections 28 to 30 the search duties, sections 60 to 62 the harmful-content categories, and sections 23 and 34 the written-record duties. Ofcom's protection-of-children pages and regulatory-document library explain the current operating sequence, risk levels, codes, and review expectations.

This page is a general implementation guide, not a conclusion about a specific service or control. Confirm the provider, UK links, exemptions, service type, child-accessible parts, affected age groups, current Ofcom publications, and the evidence for every harm before acting. Data-protection law continues to apply to age assurance, profiling, moderation, and other processing used for child safety.