The Online Safety Act 2025: What It Means for Your Family and How to Use the New Protections
The Online Safety Act is the UK's most significant overhaul of internet regulation in decades. This guide explains what platforms must now do differently, what parents can do right now, and what the new children's safety codes mean in practice.
Why the Online Safety Act Matters
The Online Safety Act 2023 received Royal Assent in October 2023 and, as Ofcom's implementation schedule rolled out through 2024–2025, began to impose new legal duties on social media platforms, search engines, and online services operating in the UK. For parents, the Act represents the most significant legal shift in how the internet is regulated since the internet became mainstream — and creates real, enforceable obligations on the platforms their children use every day.
Before the Act, platforms could largely self-regulate. A platform could, for example, theoretically allow a 10-year-old to access an account, see pornography, or be groomed — and face little legal consequence. The Online Safety Act changes this fundamentally. Ofcom now has the power to fine companies up to 10% of their global annual turnover or £18 million (whichever is higher) for non-compliance, and can block platforms entirely in the UK.[1]
The Scale of the Problem the Act Is Designed to Address
- 79% of children aged 5–15 go online daily (Ofcom, 2024)[2]
- 49% of children aged 13–17 report encountering online pornography (NSPCC, 2023)[3]
- 72% of children have encountered harmful content online (NSPCC, 2023)[3]
- The Internet Watch Foundation found 275,655 URLs containing child sexual abuse material in 2023 — a 6% increase on 2022[4]
- 50% of online grooming crimes are committed by perpetrators who initially contact children through gaming platforms (CEOP, 2023)[5]
What Platforms Must Now Do
Under the Children's Safety Code published by Ofcom in January 2025, large online platforms must implement the following by default for users under 18 (or where age cannot be verified):
- Age assurance: Platforms must implement "robust" age verification — meaning they cannot rely solely on a self-declared date of birth. Effective age assurance methods include credit card checks, open banking, digital identity services, and photo ID verification.
- Safer algorithmic feeds: Recommendation algorithms must not push harmful content — including content about self-harm, suicide, eating disorders, or extreme violence — to users under 18. Platforms must be able to demonstrate their algorithms apply age-appropriate content settings.
- Privacy by default: Children's accounts must be set to the highest privacy setting by default. Direct messaging must be restricted for children under certain ages, and strangers should not be able to contact children without the child opting in.
- Content removal: Platforms must proactively detect and remove illegal content (including child sexual abuse material and content facilitating grooming), and have rapid removal processes for content that is harmful to children.
- Parental controls: Platforms must provide accessible, effective parental supervision tools so parents can monitor and limit their child's account activity.
What This Means for Your Family Right Now
The Online Safety Act creates new rights and expectations, but parents should not assume platforms are automatically safe as a result. Implementation is ongoing, and enforcement depends on Ofcom's resources and reporting. Here is what you should do as a parent in 2025/26:
- Check age settings on your child's accounts. Review every platform your child uses and ensure that where age-appropriate settings exist, they are enabled. On Instagram and TikTok, for example, "Teen Accounts" and "Restricted Mode" respectively apply additional content filters.
- Understand the reporting mechanism. All major platforms now have a legal duty to make reporting of harmful content simple and visible. Show your child how to report content that makes them uncomfortable — and make clear that reporting is always the right thing to do.
- Use Ofcom's "Online Nation" resources. Ofcom publishes free, accessible guidance at ofcom.org.uk on how to set up parental controls on major devices and platforms. This is updated regularly as platforms change their interfaces.
- Talk about AI-generated content. Deepfakes — AI-generated images and videos, including "nudification" of real people — are a rapidly growing risk. The Online Safety Act specifically criminalises the sharing of intimate deepfake images without consent. Have an age-appropriate conversation with your child about this.
- Know the CEOP button. The Child Exploitation and Online Protection command (CEOP) provides a direct reporting mechanism at ceop.police.uk. Every child who uses the internet should know this exists and how to use it.
The ICO's Children's Code — Already in Force
The Information Commissioner's Office (ICO) Age Appropriate Design Code (the Children's Code) has been in force since September 2021 and works alongside the Online Safety Act. It requires any online service "likely to be accessed by children" to build privacy-protective features by default. This code covers apps, games, websites, and connected toys. The ICO has powers to enforce it with fines of up to £17.5 million or 4% of global turnover. Major tech companies have made significant changes to their products as a result — including restricting data profiling of children for advertising purposes.
Sources: [1] HM Government (2023). Online Safety Act 2023. legislation.gov.uk. [2] Ofcom (2024). Children and Parents: Media Use and Attitudes Report 2024. ofcom.org.uk. [3] NSPCC (2023). How safe are our children? 2023. nspcc.org.uk. [4] Internet Watch Foundation (2024). IWF Annual Report 2023. iwf.org.uk. [5] CEOP (2023). Threat Assessment of Child Sexual Exploitation and Abuse 2023. ceop.police.uk. [6] Ofcom (2025). Children's Safety Code: Guidance for online services. ofcom.org.uk. [7] ICO (2021). Age Appropriate Design Code. ico.org.uk.