Use this FAQ to identify the service, apply the right gateway tests, and move from legal scope to owned evidence and controls.
The answers distinguish baseline Part 3 and Part 5 duties from child-access, categorisation, transparency, privacy, and enforcement questions.
Start with the service, not the desired control. Decide whether it contains a regulated user-to-user part, search engine, combined-service part, or provider-pornography service and whether it has . Then apply the illegal-content, children's access, age-assurance, complaints, categorisation, reporting, and enforcement rules that fit that result.
These focused FAQ modules break this artifact into narrower answer sets so teams can move straight to the right source-backed guidance.
A practical scope test for user-to-user, search, and provider-pornography services under the UK Online Safety Act, including UK links and exemptions.
How the UK Online Safety Act, UK GDPR, Data Protection Act 2018, and Children's Code apply together to safety technologies and children's data.
Ofcom information notices, investigations, representations, confirmation decisions, penalties, remediation, and court-based service restrictions.
The two-stage UK Online Safety Act children's access assessment, evidence, timing, reassessment triggers, and next duties.
UK Online Safety Act illegal content risk assessment scope, required elements, deadlines, review triggers, records, and resulting safety measures.
Classify user-to-user, search, and combined services under the UK Online Safety Act, apply the UK-links and exemption tests, and identify the next duties.
Who receives Ofcom transparency notices, what Schedule 8 can require, the 2026 notice process, first-report timing, and evidence controls.
How UK Online Safety Act duties shape content moderation, user reporting, complaints, reinstatement, terms, records, and human oversight.
How Category 1, 2A, and 2B thresholds work, how Ofcom categorises services, and what the register updated in September 2026 means.
When section 110 can make a named senior manager liable for an Online Safety Act information offence, the available defences, and the controls to keep.
When UK Online Safety Act services need highly effective age assurance, what Ofcom expects, and how UK data protection law applies.
First map who provides the service, who generates content, who can encounter it, whether a search engine presents results, whether the provider publishes pornographic content, and which functions are distinct parts. Apply the UK-links test and every relevant Schedule 1 exemption. User count does not decide baseline scope.
For a regulated Part 3 service, complete and maintain the illegal content risk assessment and children's access assessment. If children are likely to access the service or part, complete the children's risk assessment and child-safety controls. Apply age assurance where the Act or Ofcom code requires it. Categorisation and transparency reporting are additional layers for services on Ofcom's register.
Sources (3)
Defines Part 3 user-to-user, search, and combined services.
Sets the UK-links test.
Current directory of Ofcom assessments, guidance, codes, and enforcement materials.
Existing Part 3 services had to complete their first illegal content risk assessment by 16 March 2025 and first children's access assessment by 16 April 2025. Services likely to be accessed by children had to complete their first children's risk assessment by 24 July 2025 and apply child-protection measures from 25 July 2025. Part 5 provider-pornography age-assurance duties took effect on 17 January 2025.
These dates are not a safe calendar for a new or changed service. New services generally have three months for the relevant initial assessments, while significant changes can require assessment before launch. Negative children's access conclusions must be repeated within 12 months or sooner when triggered, and risk assessments must be kept up to date.
Sources (2)
Official implementation dates and provider actions.
Current ongoing child-protection timing and review requirements.
Category 1, 2A, and 2B status adds duties but does not create baseline scope. Use Ofcom's register to identify the categorised service and registered part. Transparency reporting applies after an annual Ofcom notice to a categorised-service provider; Ofcom's current roadmap places first reports in 2027.
UK data-protection law applies alongside online-safety duties when safety systems process personal data. Age assurance, moderation, profiling, and recommender controls may require a lawful-basis analysis, data protection impact assessment, transparency, minimisation, security, retention, and rights handling. The Children's Code has its own scope test.
Sources (3)
Current category register, thresholds, and service-part qualifications.
Current joint explanation of Online Safety Act and data-protection overlap.
Current enforcement process guidance.
It applies to providers of regulated user-to-user and search services with and to providers of services displaying regulated provider pornographic content. A provider can be outside the UK. The result depends on the service's functions, UK links, and statutory exemptions, not its company label or category threshold.
Complete a suitable and sufficient illegal content risk assessment and a children's access assessment for the defined service or part. Use the results to apply proportionate illegal-content measures and, if children are likely to access it, a children's risk assessment and child-safety measures. Keep the records current and reassess before significant changes where required.
Yes, a small service can be in scope. Part 3 scope depends on user-to-user or search functionality, , and the statutory exemptions, not a minimum revenue or user threshold. Size and capacity can affect what measures are proportionate, while the Category 1, 2A, and 2B user thresholds determine additional categorised-service duties rather than baseline scope.
A Part 5 service publishing or displaying regulated provider pornographic content must use age verification, age estimation, or both so children are not normally able to encounter it. Part 3 services may need highly effective age assurance to support a conclusion that children cannot normally access a service or to prevent children from encountering specified harmful content under the protection-of-children duties and codes. The provider must test the complete process against technical accuracy, robustness, reliability, and fairness; self-declaration alone is not capable of meeting Ofcom's standard.
A provider can use the relevant recommended code measures as the statutory route to compliance or adopt different measures that meet the underlying duty. An alternative is not a waiver: the provider must record the measures it uses and explain how they comply. Teams should also distinguish an issued code in force from guidance, a draft code, or a consultation proposal.
Formal Category 1, 2A, or 2B status adds duties to the service part entered on Ofcom's register; it does not create baseline Part 3 scope or replace the core safety duties. Category 1 adds user-empowerment, identity-verification, terms, and specified content duties. Category 1 and 2A have fraudulent-advertising and additional risk-record duties, while all three categories have transparency obligations. Fee obligations arise separately under the revenue-based fees regime. Check the registered service boundary and current commencement position for each duty.
For many enforceable requirements, the statutory maximum is the greater of GBP18 million or 10% of qualifying worldwide revenue. That is a ceiling, not the expected penalty. The available power and actual amount depend on the contravention, statutory revenue calculation, facts, and Ofcom's guidance.
Record the scope, source, owner, evidence, decision, and review trigger for Online Safety Act duties.
Create scoped questions, evidence fields, owners, and review tasks for Online Safety Act duties.
Answer follow-up questions against cited legislation and regulator guidance.
Review the scope, evidence, controls, owners, and open decisions for Online Safety Act duties.
Decide whether children are likely to access a regulated service or part of it, document the evidence, and identify when a children's risk assessment follows.
Route and decide Online Safety Act complaints, record the required response, and distinguish an internal review from an Ofcom complaint or super-complaint.
Assess illegal-content risks by offence kind, likelihood, severity, affected users, service design, controls, evidence, and review triggers.
Decide whether an online service is a regulated user-to-user service, search service, combined service, or exempt service under the UK Online Safety Act.
Compare age verification and age estimation methods by assurance, privacy, accessibility, bias, evasion risk, and operational evidence.
When Online Safety Act services need age assurance, what highly effective age assurance means, and how safety duties interact with data protection.
Choose an age-assurance method for an Online Safety Act duty by testing effectiveness, privacy, accessibility, evasion risk, and the consequence of error.
Test whether a service is covered by the UK Online Safety Act by checking service functionality, UK links, exemptions, and the duties that follow.
Apply the UK Online Safety Act Category 1, 2A, and 2B thresholds, calculate active UK users, and use Ofcom's register first published in June 2026 and most recently updated in September.
Verify UK Online Safety Act scope, assessments, controls, reporting, complaints, records, child safety, and category-specific work.
Apply the UK Online Safety Act children's access, risk-assessment, safety, age-assurance, reporting, complaints, and record-keeping duties.
Build a UK Online Safety Act compliance program from service scope through assessments, controls, evidence, review, and Ofcom response.
Design UK Online Safety Act moderation, content-reporting, complaints, and review processes for illegal content and content harmful to children.
UK Online Safety Act compliance dates for risk assessments, child safety, categorised services, fees, and event-based deadlines.
How Ofcom investigates Online Safety Act breaches, issues decisions, requires remedies, imposes penalties, and seeks court orders.
Apply the Online Safety Act and UK data protection law together for age assurance, moderation, profiling, recommender systems, and safety-data sharing.
Understand the illegal-content risk assessment, safety, reporting, complaints, record-keeping, and review duties for regulated user-to-user and search services.
Build moderation, content-reporting, and complaints procedures for regulated services, and understand where the Online Safety Act does and does not require an appeal.
How Ofcom assesses Online Safety Act concerns, gathers information, investigates suspected breaches, and reaches enforcement decisions.
The Online Safety Act penalty ceiling, qualifying worldwide revenue, daily penalties, penalty factors, and payment consequences.
Understand which user-to-user, search, combined, and provider-pornography services the UK Online Safety Act regulates and which exemptions narrow scope.
See which UK Online Safety Act requirements apply to Part 3 services, child-accessible services, provider pornography, and categorised services.
A field-by-field template for recording service facts, statutory risks, evidence, controls, residual risk, approval, and reassessment triggers.
Run illegal-content and children's risk assessments in the right order, with evidence for risks, controls, governance, and reassessment triggers.
Organise recurring Online Safety Act risk assessments across product, safety, data, engineering, legal, and governance teams.
Understand when a named senior manager or corporate officer can face personal liability for Online Safety Act information offences and how to control the risk.
Decide whether a service is regulated, whether it is user-to-user or search, which exemptions apply, and whether Ofcom categorisation adds duties.
Move from UK Online Safety Act service scope to Category 1, 2A, or 2B threshold analysis without confusing categorisation with basic coverage.
Understand who must publish an Online Safety Act transparency report, what an Ofcom notice controls, and how to prepare traceable reporting data.
Compare UK Online Safety Act and EU DSA scope, service classes, child-safety and platform duties, dates, evidence, exemptions, and enforcement.