Platform Duties of Care: What the Online Safety Act Requires From User-to-User Services

Since March 2025, every user-to-user service operating in the UK — social media, forums, comment sections, messaging apps, gaming chat — has been legally required to carry out illegal content risk assessments and submit them to OFCOM. It is not best practice. It is not self-regulation. It is a legal duty.

Disclaimer: General information, not legal advice.

Who Has to Comply

Any service where users can encounter content generated by other users — and that has links to the UK. This includes platforms based outside the UK. Category 1 services (the largest, designated by OFCOM) face additional duties.

The Three Core Duties

Illegal Content Risk Assessment (s.9): Assess how likely users are to encounter priority illegal content — terrorism, child exploitation, threats to kill, and other serious categories. Must be documented, submitted to OFCOM, and kept up to date.

Safety Measures (s.10): Take proportionate measures to mitigate identified risks. What is proportionate depends on the size and nature of the platform.

Children Safety (ss.11-13): Platforms likely accessed by children must assess risks from content harmful to children — including suicide, self-harm, and eating-disorder content — even if not illegal. Age verification is contemplated.

OFCOM Enforcement

Five-step ladder: information request → enforcement notice → fine (up to 10% global turnover) → business disruption → platform blocking. Steps 1-3 are active. CPA 2026 s.250 expands corporate criminal liability for senior managers who obstruct OFCOM investigations.

Free Expression

Section 19 requires platforms to have particular regard to users Article 10 rights when implementing safety measures. Category 1 services must give users tools to control what they see — effectively an opt-in for more content.

Sources

• Online Safety Act 2023, Part 3 — legislation.gov.uk
• OFCOM Online Safety — ofcom.org.uk