UK Online Safety Act: A Guide to Children’s Access Assessments for Service Providers

The UK’s Online Safety Act (OSA) introduces new rules for online platforms that allow users to interact or provide search services. If your business offers online services in the UK, you need to understand these changes and how they affect you.

Starting in April 2025, online service providers in scope must assess whether their platforms can be accessed by children or attract a significant number of child users. Failure to do so could result in hefty fines or other legal consequences.

What is the Online Safety Act?

The UK Online Safety Act (2023) is a new law designed to improve online safety for both children and adults. It applies to companies that run user-to-user platforms or search engines and requires them to take steps to protect users from illegal content.

The law applies to services with a large number of UK users or those targeting the UK market, regardless of where the companies are located.

What is the children’s access assessment?

From April 2025, online platforms must check whether their services can be accessed by children or are likely to attract them. Under the OSA, ‘children’ refers to anyone under 18. This assessment helps determine further legal responsibilities. Here’s what you need to consider:

• Stage one: assess whether it is possible for children to normally access the service or part of it. You should only conclude that children cannot access your service if you use highly effective age assurance and access control measures that prevent underage users from accessing it. If your service doesn’t have strong age verification measures in place, Ofcom will assume that children can access it. In that case, you’ll need to move to the next part of the risk assessment, which looks at whether your service has a significant number of child users in the UK or is likely to attract them.
• Stage two: you need to assess whether a significant number of children use your service or if it is designed in a way that would appeal to them. While there’s no exact definition of “significant,” it’s based on the context, and even a small proportion of children using the service could be considered “significant.” The service provider must keep a written record of the children’s access assessment.

Providers must complete this assessment by April 16, 2025, and must document their findings, regardless of the outcome.

What happens after the assessment?

Once the assessment is done, if you determine that your service is likely to be used by children, you will need to carry out a children’s risk assessment. This includes identifying risks of harmful content for children and ensuring that you have measures in place to protect them. Providers will have until July 2025 to comply with these child safety duties.

If you fail to comply, Ofcom can start enforcement action, including imposing fines or requiring changes to your service.

What’s next?

If an investigation reveals that a service is not meeting its obligations, Ofcom has the power to impose significant fines — up to £18 million or 10% of annual global revenue, whichever is higher. Senior managers could also face criminal liability, including up to two years in prison.

To avoid penalties, businesses should start reviewing their platforms now. Key steps include:

1. Conduct the children’s access assessment by April 16, 2025.
2. If required, complete a children’s risk assessment.
3. Implement the relevant safety measures.

How can we help?

For further guidance or assistance with the OSA compliance process, book a free consultation with us and we will be happy to assist. We can help you assess your service’s risks and develop an effective strategy to meet the new regulatory requirements