UK Online Safety Act Children's Access Assessment

Stage one asks whether children can normally access the service or a particular part of it. A provider can conclude they cannot only where highly effective age assurance and access controls prevent users who have not been identified as adults from entering. Self-declared age, an age statement in terms, or a weak gate does not support that conclusion.

If children can access the service, stage two asks whether the child user condition is met: there is a significant number of child users, or the service is of a kind likely to attract a significant number of children. Assess actual and foreseeable use, not only the intended audience. A conclusion can differ between distinct parts of one service.

The initial deadline for services already in scope was 16 April 2025. A user-to-user or search service that later comes into scope must complete the assessment within three months of the first day it becomes available to UK users.

If the provider concludes that the service is not likely to be accessed by children, it must repeat the assessment within 12 months, and sooner where the Act or Ofcom guidance requires. Reassess before or after relevant changes as required, including changes to design, operation, target market, age controls, or evidence of child use.

The provider must complete a suitable and sufficient children's risk assessment for the affected service or part and comply with the applicable child-safety, record-keeping, and review duties. For existing services, the first children's risk assessment deadline was 24 July 2025 and child-protection measures applied from 25 July 2025.

A negative access conclusion does not remove the baseline illegal-content duties. It also does not settle whether the Children's Code applies, because the data-protection and Online Safety Act tests have different legal sources and should be assessed separately.