Today, July 25th, 2025, key components of the UK Online Safety Act has now taken effect. The details of this law are provided by the government here:
tl;dr:
Included:
Not Included:
Some reports detailing this law have come out online with additional bits of information included, however at this time, the act does not do any of the following:
Timeline:
This law takes effect in 3 phases:
tl;dr:
Included:
- Mandatory age verification for porn sites, social media, search engines, forums, messaging apps, and gaming platforms
- Platforms must assess and reduce risks of exposure of the following to underage users:
- Pornography
- Self-harm encouragement
- Suicidal ideation
- Eating disorder promotion
- Dangerous challenges/stunts
- Harassment
- Abuse
- Hate speech
- Ofcom has the authority to issue fines up to £18,000,000 or 10% of global revenue, or block offending content or companies that do not comply
- Adult content providers must begin enforcing use of "highly effective age assurance" methods in order to verify users are of age
- At this time, there is no mandate for biometric or ID upload. The law only states that age checks must be effective, and cannot only consist of simple pop-ups and checkboxes
- Platforms must:
- Publish transparency reports
- Provide UK points of contact
- Report all child sexual abuse content (CSAM) to the NCA
- Encrypted services such as WhatsApp and Signal are included in scope, but message-scanning requirements are delayed until "technically feasible."
- There is no mandate at this time for backdoors in end-to-end encryption
- Platforms such as 4chan, seven different file-sharing services, and porn provider First Time Videos are currently under investigation as of June 10, 2025 for noncompliance
- Major platforms such as Reddit, Discord, PornHub, Grindr, and Bluesky are currently compliant with this requirement
Not Included:
Some reports detailing this law have come out online with additional bits of information included, however at this time, the act does not do any of the following:
- Limit screen time or enact curfews
- Note: There are separate proposals that include these stipulations that could come into effect as early as Autumn 2025, however these have not been decided, nor are they included in this act
- Require universal identity/biometric verification
- Create non-state-approved content lists
- Enact total bans on encrypted messaging
- Duties exist, but direct content monitoring is delayed
Timeline:
This law takes effect in 3 phases:
- Phase 1: Illegal content duties - Risk assessments, & removal processes for illegal content
- In effect as of March 2025
- Phase 2: Age verification, children's risk and access assessments, broader child-protection duties
- In effect as of July 25 2025 (You are here)
- Phase 3: Algorithm governance, mandatory transparency reports, protection of journalistic and politically significant content, and enforcement of protection regulations for adult users
- Awaiting codes in late 2025 / early 2026
