UK Online Safety Act Illegal Content Duties Explained

Section 10 requires proportionate measures in the design or operation of a regulated user-to-user service to prevent people from encountering priority illegal content, mitigate and manage the risk that the service is used to commit or facilitate a priority offence, and mitigate and manage the risks of harm identified in the latest assessment.

The provider must also use proportionate systems and processes designed to minimise how long priority illegal content remains on the service and to take down any illegal content swiftly after becoming aware of it. Awareness of non-priority illegal content therefore matters, but the Act does not turn every breach of platform rules into illegal content.

The measures can concern governance, service design, algorithms, user access, content moderation, user support, and staff policies. The provider's terms of service must explain how users are protected from illegal content, describe relevant proactive technology, remain clear and accessible, and be applied consistently.

Section 27 does not impose the user-to-user service's duty to take down hosted content. A regulated search service must take proportionate steps to mitigate and manage the risks of harm identified in its latest assessment and use proportionate systems and processes to minimise the risk that users encounter priority illegal content or other illegal content the provider knows about.

Controls may include removing or down-ranking results, changing predictive-search or ranking behaviour, stopping monetisation, and directing users to support. The exact control depends on risk and technical control over the search engine. The provider must publish a clear, accessible statement explaining its illegal-content policies and relevant proactive technology, and it must apply those policies consistently.

A combined service needs separate analysis. Its user-generated-content functions follow the user-to-user duties, while its search engine follows the search duties.

The assessment is the control baseline, not a one-off filing. For an existing in-scope service, the first illegal-content assessment was due by 16 March 2025 and the safety duties applied from 17 March 2025. A service that later enters scope must follow the statutory timing rules. Every provider must keep the assessment current, review it when Ofcom changes a relevant risk profile, and assess a significant design or operational change before launch.

Sections 23 and 34 require providers to keep a written record of each assessment and of measures taken or used to comply with specified duties. If the provider does not follow a measure recommended in an applicable Ofcom code, the record must explain what alternative measure it uses and how that measure complies.

Following an applicable code's recommended measures gives the statutory treatment described in section 49. A provider may use alternative measures, but it remains responsible for meeting the underlying duty and must give particular regard to freedom of expression and privacy.

Start with a documented scope decision. Then complete the assessment using the current Ofcom risk profiles, approve a control plan, update user-facing terms or statements, and test reporting and complaints from the perspective of both users and affected persons. Assign legal interpretation of offence elements separately from operational moderation ownership.

Do not close the work because content was removed in one case. The Act regulates systems and processes: governance, prevention, detection, ranking, moderation, reporting, complaints, records, and review must work together and remain proportionate to the current risk.