United KingdomOnline Safety Act 2023, Part 3 (children's risk assessment and safety duties)
Online Safety Act 2023, c. 50, ss. 11-12 (Part 3)
In force since .
A social media and minors rule binding private bodies.
- Penalties
- Fines up to the greater of GBP 18,000,000 or 10 percent of qualifying worldwide revenue.
- Audit expectation
- none
What it requires
- Applies to regulated user-to-user services likely to be accessed by children in the UK; Category 1 (large) platforms carry additional duties.
- Carry out a children's risk assessment.NIST Privacy FrameworkID.RA-P4
- Use proportionate measures, including age verification or age estimation where appropriate, to prevent children encountering primary priority content harmful to children, such as pornography, self harm, suicide and eating disorder content.no control in the NIST Privacy Framework
- Do not rely on a photo upload age check that lacks liveness detection: Ofcom found one that children could circumvent to be in breach of section 12.no control in the NIST Privacy Framework
These lines are LexLint's reading of the law's text. Also read by: Ofcom, the regulator that enforces the duty (Protection of Children Code of Practice for user-to-user services) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Ofcom
Litigation
- Matter
- Ofcom confirmation decision against AVS Group Ltd
- Posture
- Ofcom found AVS Group's photo upload age check lacked liveness detection and could be circumvented by children, in breach of section 12, and imposed a GBP 1,000,000 fine plus a GBP 50,000 fine for failing to respond to a statutory information request, with a running penalty of GBP 1,000 per day for continuing non-compliance. Confirmation decision dated .
- Source link
- https://www.ofcom.org.uk/online-safety/protecting-children/ofcom-fines-porn-company-1million-for-not-having-robust-age-checks
Settledness
- As of
- Guidance link
- https://assets.publishing.service.gov.uk/media/680a04f7532adcaaab3a2718/FINAL_-_Protection_of_Children_Code_of_Practice_for_user-to-user_services__2025_Parli_AC.pdf
- Guidance body
- Ofcom, the regulator that enforces the duty (Protection of Children Code of Practice for user-to-user services)
- Open questions
- Under section 35(3) and (4)(a) of the Online Safety Act 2023, how many of a service's United Kingdom users must be children before there is a "significant number" of them for the child user condition, when the Act sets no absolute figure and requires the test to rest on evidence of who actually uses the service?
What it reaches
Age threshold
18
Covered services
Regulated user-to-user services likely to be accessed by children in the UK, with additional duties on Category 1 (large) platforms.
Verification methods
Facial estimation, Gov ID, Third party service, Self declaration
What it makes you log
Logging duty
Sections 11 and 12 require a children's risk assessment and proportionate safety measures, including age verification or age estimation to keep children from primary priority content, but neither section requires the provider to keep a record of an age check or of the assessment. Section 11(8) points to section 23(2) and (10), which carry the record-keeping duty for risk assessments; section 23 is not cited by this row and is not part of it.
- Kind
- None
- As of
What this law does
Requires providers of regulated user-to-user services likely to be accessed by children in the UK to carry out children's risk assessments and to use proportionate measures, including age verification or age estimation where appropriate, to prevent children encountering primary priority content harmful to children such as pornography, self harm, suicide, and eating disorder content. Sections 11 and 12 came into force on .
When LexLint raises it
When your app profile says your app operates a social platform.
Back to the example · Lint your app
Page updated .