Online Safety Act 2023 Explained: Duties, Fines and Who You Complain To

The Online Safety Act 2023 makes online platforms legally responsible for tackling illegal content and protecting children, backed by fines of up to £18 million or 10% of global revenue, but the duties did not all start on the same day, and if you have a problem with a specific post, message or account you complain to the platform itself first; you can then tell Ofcom, but Ofcom cannot investigate individual complaints, because it regulates platforms' systems rather than individual pieces of content.

What the Online Safety Act actually requires

The Online Safety Act 2023, cited as 2023 c. 50, puts legal duties on user to user services and search services, broadly, platforms where users post content and search engines, to assess and manage the risk of illegal content and, for services likely to be accessed by children, content that is harmful to children (legislation.gov.uk: Online Safety Act 2023). It is regulated by Ofcom, which is a different body from the ICO, which handles data protection under UK GDPR rather than online content.

The duties did not all start on the same day

The Act's duties phased in over roughly two years, and a page or forum post that treats the whole Act as switching on at once is describing it wrong:

Sources for the commencement dates: legislation.gov.uk: The Online Safety Act 2023 (Commencement No. 6) Regulations 2025; for 7 April 2026, legislation.gov.uk: Online Safety Act 2023, section 69 (in force for specified purposes by SI 2026/262). Ofcom separately set its own compliance deadlines through Codes of Practice made under the Act, requiring services to complete risk assessments and have safety measures in place. In practice, services had to complete illegal content risk assessments by 16 March 2025, with Ofcom able to enforce the illegal content duties from 17 March 2025, and complete children's risk assessments by 24 July 2025 (gov.uk: Online Safety Act explainer).

The fines: up to £18 million or 10% of global revenue

The Act's own Schedule 13 sets the maximum financial penalty Ofcom can impose on a provider that fails to comply with its duties or with an Ofcom notice, quoted directly: "the maximum amount of the penalty for which the person is liable is whichever is the greater of, (a) £18 million, and (b) 10% of the person's qualifying worldwide revenue for the person's most recent complete accounting period" (legislation.gov.uk: Online Safety Act 2023, Schedule 13). Where Ofcom makes other group companies jointly and severally liable for the penalty, the 10% is measured against the combined revenue of that group of entities.

New criminal offences under the Act

Alongside the duties on platforms, the Act created or restructured a set of communications offences, most commencing on 31 January 2024 (Crown Prosecution Service: communications offences guidance); see also our guide to malicious communications. These offences do not all cover the whole UK: false communications, threatening communications and flashing images apply in England, Wales and Northern Ireland; encouraging serious self harm applies UK-wide; cyberflashing and the intimate image offences apply in England and Wales only (legislation.gov.uk: Online Safety Act 2023, section 188). The offences are:

• False communications (section 179): sending a message the sender knows to be false, intended to cause non trivial psychological or physical harm.
• Threatening communications (section 181): an either way offence carrying up to 5 years.
• Epilepsy trolling, known as Zach's Law (section 183): sending or showing flashing images with intent to cause a seizure or other harm, up to 5 years.
• Encouraging serious self harm (section 184): up to 5 years.
• Cyberflashing (new section 66A, Sexual Offences Act 2003, inserted by section 187): up to 2 years, and can lead to notification requirements on the sex offenders register.
• Intimate image abuse (new sections 66B to 66D, Sexual Offences Act 2003, inserted by section 188): sharing an intimate image without consent, with aggravated either way versions where there was intent to distress, sexual gratification, or a threat to share. These replaced the previous "revenge porn" offence.
• False reporting of child sexual exploitation and abuse material (section 69): a narrower, provider facing offence, in force for specified purposes from 7 April 2026.

Sharing a deepfake intimate image is already covered, because the sharing offence applies to an image that "shows, or appears to show" someone; a separate offence of creating, or requesting the creation of, a deepfake intimate image of an adult was added by the Data (Use and Access) Act 2025, in force from 6 February 2026 (legislation.gov.uk: Data (Use and Access) Act 2025, section 138).

Who you actually complain to

If a specific post, message or account is the problem, the Act's own structure means you complain to the platform first. The government's own explainer confirms this: platforms, especially the largest ones, must have "effective reporting and redress mechanisms in place enabling users to raise concerns about companies' enforcement of their terms of service" (gov.uk: Online Safety Act explainer). If you have reported to the platform and remain concerned, you can tell Ofcom, but Ofcom says it "cannot respond to or investigate individual complaints"; it uses them to assess whether regulated services are doing enough to protect their users and whether it should take action (Ofcom: complain about harmful content on a website or app). Separately, the Act lets eligible bodies representing groups of users make "super-complaints" to Ofcom about systemic problems (legislation.gov.uk: Online Safety Act 2023, section 169).

In short: complain to the platform about a specific post or account; if the issue is actually a crime, such as a threat or child sexual abuse material, report it to the police, Report Fraud (formerly Action Fraud) or CEOP, the National Crime Agency's child protection command as appropriate, rather than to Ofcom; and Ofcom's role is judging whether a platform's overall systems are adequate, not ruling on your individual case.

For related UK data privacy topics, see the UK data privacy hub.

Frequently Asked Questions

Is the Online Safety Act 2023 in force?

Partly, in phases. The illegal content and children's safety duties legally commenced on 10 January 2024, but services had until 16 March 2025 to complete illegal content risk assessments, with Ofcom able to enforce from 17 March 2025, and until 24 July 2025 to complete children's risk assessments. Age checks for pornography services applied from 17 January 2025.

What are the fines under the Online Safety Act?

Up to whichever is greater of £18 million or 10% of the provider's qualifying worldwide revenue for its most recent complete accounting period, confirmed directly from the Act's Schedule 13.

Can I complain to Ofcom about a specific post or account?

You can tell Ofcom, but it will not resolve it for you. Complain to the platform first. If you have done that and remain concerned, you can tell Ofcom, but Ofcom says it cannot respond to or investigate individual complaints; it uses them to judge whether platforms are doing enough to protect users and whether to take action.

Does the Online Safety Act create new criminal offences?

Yes. Most commenced on 31 January 2024, including false communications, threatening communications, an epilepsy trolling offence known as Zach's Law, encouraging serious self harm, cyberflashing, and a set of intimate image abuse offences that replaced the previous revenge porn offence. Most of these offences do not apply in Scotland, and the cyberflashing and intimate image offences apply in England and Wales only.

Who regulates the Online Safety Act?

Ofcom, which is a different regulator from the ICO. The ICO handles data protection and UK GDPR; Ofcom handles online platform safety duties under this Act.