The Online Safety Act is the rulebook UK platforms have spent two years preparing for, and in 2026 it stops being a paperwork exercise and starts being something you notice. The shift you feel as a user is the run of age-verification prompts, the quieter changes to what your feed surfaces, and the new reporting routes inside apps you already use. Ofcom’s roadmap to regulation sets out how the regulator is moving from writing codes to enforcing them, and that change of gear is the real story for anyone scrolling in Britain this year.
- Ofcom has opened investigations into nearly 100 services since the Act came into force in 2025, and has already issued fines for non-compliance.
- The register of categorised services and the consultation on their extra duties are due in July 2026, after a representations process running through early 2026.
- Final guidance on the super-complaints regime, which lets eligible bodies raise issues affecting many services at once, is set for February 2026.
- In March 2026 Ofcom wrote to six of the largest platforms, including Facebook, Instagram, TikTok, Snapchat, Roblox and YouTube, asking for evidence of further child-safety progress.
- Child-safety duties cover age limits, grooming risk and the algorithmic feeds that decide what under-18s see.
What the Online Safety Act actually changes for a UK user
Strip away the legal language and the law does three plain things. It makes platforms assess the risk that illegal material, such as child sexual abuse content and fraud, reaches you. It makes the largest services protect under-18s from a defined list of harmful content. And it gives Ofcom the power to investigate, demand information and fine companies that fall short. According to the House of Commons Library briefing CBP-10468, published in June 2026, the wider debate about children’s access to social media is now running alongside the Act rather than replacing it, which is why you are seeing both tighter platform duties and a separate policy argument about age limits.
The most visible single change is age assurance. Services that show pornography or other age-restricted content now have to check that users are adults using methods more robust than a self-declared birth date. Platforms hosting teen accounts are layering on their own checks too, which is why Meta’s teen safety tools and supervision settings have been expanding in step with the regulatory calendar. If you have been asked to confirm your age more often this year, that is the Act working through the apps rather than a glitch.
Age checks you will meet and how they work
Age assurance is not one method but a menu. You might be asked to upload a photo of ID, submit a selfie that an estimation model reads for likely age, confirm your age through your bank or mobile provider, or pass a credit-card check. Ofcom’s position is that the method must be technically accurate, robust, reliable and fair, and that a tick-box claiming you are over 18 no longer counts on its own. The trade-off you should weigh is privacy: some methods hand a third-party verifier a document or a face scan, and you are entitled to ask what happens to that data afterwards.
For teenagers the mechanism is different again. Rather than a one-off gate, platforms are placing accounts they believe belong to under-18s into more protective default settings, restricting who can contact them and what their feeds promote. That is the same logic behind the way WhatsApp’s advanced chat privacy controls have tightened, even on services that are encrypted, because the duty attaches to design and defaults, not only to content moderation after the fact.
Feeds, recommendations and the duties you cannot see
The quieter half of the law is about algorithms. The Act treats a recommendation system as part of a service’s safety design, so platforms have duties to stop their feeds pushing harmful content at children and to reduce the reach of illegal material for everyone. In practice that means changes you will rarely be told about: a topic that no longer autoplays into a teen account, a search that returns support resources instead of harmful results, a recommendation rail that has been retuned. Meta’s own moves on how its AI features surface across its apps sit inside this same compliance pressure.
This is where the law is hardest to evaluate as a user, because you cannot inspect a feed’s internals. The honest position is that the algorithmic duties are real but their effect is gradual and largely invisible, which makes Ofcom’s enforcement record the only reliable yardstick of whether they are biting. The regulator has the power to demand the data behind a recommendation system, and how forcefully it uses that power will decide whether feed safety is a genuine protection or a line in a compliance document.
The algorithmic duties are real, but their effect is gradual and largely invisible, so Ofcom’s enforcement record is the only reliable yardstick.
Grooming risk and the illegal-content baseline
Underneath the child-specific rules sits a floor that applies to almost every service: the illegal-content duties. These target more than 130 priority offences, with child sexual abuse material and grooming at the top of the list, alongside fraud, intimate-image abuse and content encouraging serious self-harm. Platforms have to design against these risks rather than wait for reports, which is why direct-message controls, contact restrictions for minors and friend-suggestion changes have all moved at once.
Fraud is the part of this baseline most likely to touch an ordinary user directly. The Act pushes large platforms to act against fraudulent content and scam advertising, and Ofcom has highlighted cross-industry work to disrupt the criminal networks behind it. If you report a scam message or a fake investment advert and the platform now responds rather than ignoring you, that is the illegal-content regime working as intended. The test is consistency, because a duty that is enforced unevenly protects no one reliably.
Ofcom’s own guidance for parents, summarised in the video above, is a reminder that the law leans on practical steps as much as enforcement. The platform duties set the floor, but the regulator still expects families and users to use the reporting and control tools the Act now requires services to provide.
How Ofcom is moving from rules to enforcement
The defining fact of 2026 is that Ofcom has shifted into enforcement mode. It has opened investigations into nearly 100 services since the Act came into force, has issued fines for non-compliance, and in March 2026 wrote directly to six of the largest platforms, including Facebook, Instagram, TikTok, Snapchat, Roblox and YouTube, asking for evidence of further child-safety improvements. We will not assert a specific penalty figure here without an individual Ofcom penalty notice to cite, because the headline numbers move and the detail matters more than the round figure.
Enforcement also gives the law its consumer-rights texture. If a platform mishandles your data during an age check, the route is the Information Commissioner’s Office, not Ofcom, so the two regimes overlap in practice. And the same regulator that polices feeds also sets the rules behind your mid-contract rights with UK networks, a reminder that Ofcom’s online-safety brief is one part of a much broader remit you already rely on.
What is still coming before the end of 2026
Two milestones are worth marking in your calendar. In July 2026 Ofcom is due to publish the register of categorised services and a consultation on the extra duties those services will carry, covering areas such as fraudulent advertising, terms of service, user empowerment tools and identity verification. The biggest platforms, the so-called Category 1 services, will pick up additional risk-assessment duties when that register lands. Earlier, in February 2026, the regulator is set to finalise guidance on the super-complaints regime, which lets approved bodies raise systemic problems on behalf of users rather than leaving every complaint to an individual.
The user-empowerment duties are the ones to watch if you are an adult who wants more control. They are meant to give you tools to filter out legal-but-unwanted content and to verify other users, which is the difference between a feed you endure and a feed you shape. Whether those controls arrive as genuine, easy-to-find settings or as buried toggles will tell you a great deal about how seriously the categorised platforms are taking the spirit of the law rather than its letter. The privacy settings worth checking now mirror the ones we walk through for Meta AI privacy on WhatsApp and the privacy checks for Meta’s AI glasses.
Our verdict
Our view is that the Online Safety Act makes UK users meaningfully safer at the floor and uncertain at the ceiling. The illegal-content baseline, the child-safety defaults and the age-assurance push are real and already visible, and Ofcom’s move into active enforcement, with nearly 100 investigations open, is the strongest signal that the duties have teeth. What we would not yet claim is that feeds are demonstrably safer, because the algorithmic duties are the hardest to verify from the outside and depend entirely on how hard Ofcom presses for the data. The things to watch are concrete: whether the July 2026 categorisation consultation produces user-empowerment tools you can actually find, whether the February super-complaints guidance gives advocacy groups real leverage, and whether the fines that follow investigations are large enough to change behaviour rather than be absorbed as a cost. If those three land well, this is a law that works. If they slip, it stays a strong framework that under-delivers, and that is the risk we would keep watching.
UK online safety: frequently asked questions
Related reading on MTW
- Meta teen safety tools: a UK parent’s guide to supervision and AI limits
- UK mid-contract price rises 2026 and your Ofcom rights
- WhatsApp private chat: how advanced chat privacy works for UK users
MMTW Editorial
Buyer action
Where to buy or check next
Use this as the final check before ordering a phone, changing network or trusting a headline monthly price.
Reader discussion
Leave a comment
Comments are moderated. Keep it useful, accurate, and on topic.