UK Online Safety Act FAQ

Search services and services that allow user interaction or user-generated content can be in scope. The analysis must be done service by service, with exemptions and special cases checked before the duty set is finalised.

Mixed products often need more than one scoped answer.

Government materials state that illegal content risk assessments were due by 16 March 2025, child access assessments by 16 April 2025, and children risk assessments by 24 July 2025. Section 81 also came into force on 17 January 2025 after January age assurance guidance for online pornography.

Those dates should already be reflected in the evidence file for any relevant service.

The Children's Code is a data protection code for information society services likely to be accessed by children. It does not replace UK OSA duties, but it strongly affects how a child-safe service should design privacy defaults, profiling, geolocation, transparency, and age assurance.

Treat the regimes as overlapping design constraints, especially on child-facing features.