Ofcom — the Online Safety Act
Duties on services that let users encounter each other's content: risk assessment, illegal content, children's safety.
Providers of user-to-user services. Crucially, that is usually the platform, not the brand running a page on it — but it can be you, if you host your own community.
6 rules · last verified 3 October 2026 · see changes
The rules
Whether running a brand group or page makes you a regulated provider
No. Ofcom's position is that responsibility for the safety duties lies with the provider of the regulated service — the platform, which controls who can use the user-to-user part.
Verified 22 Sept 2026 · Read the source
Whether a website comment or review section is in scope
Exempt. Schedule 1 paragraph 4 covers limited-functionality services — comments and reviews on the provider's own content, likes, emoji, voting and ratings.
Verified 22 Sept 2026 · Read the source
Date the children's safety duties became enforceable
25 July 2025, when the Protection of Children Codes came into force.
Verified 22 Sept 2026 · Read the source
Date the illegal content duties became enforceable
17 March 2025, when the Codes of Practice came into force.
Verified 22 Sept 2026 · Read the source
Whether the Act governs your paid social advertising
No. Paid-for advertising falls outside the illegal content and children's duties. Only the fraudulent advertising duties apply, and only to Category 1 and Category 2A services.
Verified 22 Sept 2026 · Read the source
Who actually carries the duties
Section 226: the entity that has control over who can use the user-to-user part of the service. Control of access, not ownership of the content, is the test.
Verified 3 Oct 2026 · Read the source
What people get wrong
Not hypotheticals — these are the three failure modes that recur, and what follows from them.
Compliance spend on duties you do not have, while the thing that might genuinely be in scope — your own hosted community — goes unassessed.
If you control who can use it, you are the provider. Risk assessment, children's access assessment, terms, reporting and takedown duties all apply, and Ofcom has already issued six-figure fines to small services.
Ad content risk sits with the ASA, the CMA, Trading Standards, the FCA, the MHRA and the Gambling Commission. Teams that consolidate it under the OSA miss the actual regulator.
The other four
Knowing the rule is not the same as having a process
Module 22 turns these into the things you actually need: the disclosure wording, the consent flow, the review policy, the sign-off step. Take the free assessment and see where it lands on your path.
Take the free assessmentNothing here is legal advice. Every rule links to the regulator’s own words so you can read them yourself.
