Vertical Observer

The vertical-drama business, sourced
UPDATED 23 October 2026 217 REPORTS · 172 COMPANIES

United Kingdom

Online Safety Act 2023 (OSA)

By Vertical Observer Edited by Tobias Jaeger

Status In force. The children's safety duties have been enforceable since 25 July 2025 and the illegal-content duties since 17 March 2025. A power to require providers of specified internet services to prevent or restrict children's access was added on 29 April 2026; the government has said it will lay the first regulations under it, for social media services, before the end of 2026.

What it requires

The Act regulates user-to-user services, meaning internet services on which content generated, uploaded or shared by one user may be encountered by another (section 3(1)), and search services, where they have links with the UK, such as a significant number of UK users (section 4). A service on which users can only post comments or reviews on the provider's own content, share those comments elsewhere, react with likes, emoji, votes or ratings, and display identifying content is exempt (Schedule 1, paragraph 4). Providers must carry out children's access assessments (sections 35 and 36); a service likely to be accessed by children must meet the safety duties in section 12. Those duties require proportionate measures to mitigate risks of harm to children and apply across a service's design and operation, including its functionalities and algorithms (section 12(8)); unless the service prohibits it for all users, they also require age verification or age estimation that is highly effective to keep children from primary priority content: pornography and content encouraging suicide, self-injury or eating disorders (sections 12(4) to 12(6) and 61). For a user-to-user service, content harmful to children is limited to regulated user-generated content (section 60(6)), which excludes comments and reviews on provider content and further comments on them (section 55(2) and (6)); content outside the designated categories is not treated as harmful to children where the risk flows from its potential financial impact (section 60(3)). Penalties reach £18m or 10% of qualifying worldwide revenue, whichever is greater (Schedule 13, paragraph 4). Section 214A, inserted by the Children's Wellbeing and Schools Act 2026, lets the Secretary of State require providers of specified internet services to prevent or restrict children's access to services or features, including by daily time limits and limits on times of day.

Why it bears on this field

Whether a vertical-drama app is in scope turns on its features rather than its genre. Episodes published by the operator are provider content, not user-generated content. An app whose only user interaction is commenting on those episodes, liking or rating, and sharing comments to other services falls within the Schedule 1 exemption; a feature that lets users upload or share content that other users encounter brings it into the user-to-user regime. Even then, the operator's own episodes, and comments on them, are not content harmful to children within the Act's meaning, although the children's safety duties still extend to the design of the service's features and algorithms. A purely on-demand app with no user-to-user functionality is not a user-to-user service; on-demand programme services fall under Part 4A of the Communications Act 2003, which includes the Tier 1 regime for services above 500,000 average monthly UK users. Section 214A is framed around internet services rather than the regulated services defined in section 4; the government's stated first use is a ban on social media for under-16s, expected to take effect in spring 2027.

Open questions

  • Does a reply thread under an episode stay within the Schedule 1 exemption, whose paragraph 4 lists posting comments on provider content and reacting to comments but not replying to them, although section 55(6) counts further comments on such comments as comments and reviews on provider content?
  • How will the first regulations under section 214A define the social media services barred to under-16s, and will that definition capture video apps whose feeds carry only provider content?
  • Will the default restrictions on autoplay and personalised feeds for 16- and 17-year-olds, which the government has described for social media platforms, be extended to other video services?

Timeline

  • 2023-10-26The Online Safety Act 2023 receives Royal Assent. Source (opens in a new tab)
  • 2025-03-17Ofcom can enforce the illegal-content duties, after the deadline for illegal-content risk assessments passed on 16 March. Source (opens in a new tab)
  • 2025-07-04Ofcom issues the Protection of Children Code of Practice for user-to-user services under section 41. Source (opens in a new tab)
  • 2025-07-25The protections for under-18s become fully enforceable, including highly effective age assurance for services hosting pornography or content encouraging self-harm, suicide or eating disorders. Source (opens in a new tab)
  • 2025-07-25The video-sharing platform regime in Part 4B of the Communications Act 2003 is repealed; services formerly regulated under it fall wholly under the Online Safety Act (SI 2025/888). Source (opens in a new tab)
  • 2026-04-29Section 214A, the power to require internet services to prevent or restrict children's access, is inserted by the Children's Wellbeing and Schools Act 2026. Source (opens in a new tab)
  • 2026-06-15The government announces that social media companies will no longer be able to offer their services to under-16s. Source (opens in a new tab)

Sources

Last reviewed