UK ONLINE SAFETY ACT

OLYMPUS opened an institutional file on a statute. A law has no Big Five and no Dark Triad, and the unit does not invent them; what a law has is a text, an enforcement arm, and a funding structure. The Online Safety Act is catalogued here as the gate — the first statute in the English-speaking world to make proving who you are a precondition for reaching lawful content at national scale. The finding is the shape of the machinery, not the intent of its drafters: a child-protection mandate whose compliance methods are identity checks, and whose first measurable public verdict arrived within twenty-four hours of enforcement. The numbers in the front matter are reach, entrenchment, and durability — an Act of Parliament outlives every minister who defended it.

Institutional Archetype

THE GATE — The archetype is the statute that converts access into an identity event. The Act does not remove a single post itself. It imposes statutory duties on user-to-user and search services — illegal-content duties, children’s-safety duties, and “highly effective age assurance” for services carrying pornography and other age-restricted content — and attaches fines of up to £18 million or ten percent of qualifying worldwide revenue, whichever is greater, to the obligation. Ofcom’s approved routes to “highly effective” are the tell: government-issued ID checks, biometric facial age estimation, credit card verification, and digital identity wallets. Every route runs through demonstrated identity or a biometric proxy for it. That is the structural power: not authorship of any single takedown, but conversion of an anonymous open network into one where the default question at the door is who are you — asked by law, answered to a private verification vendor, on behalf of the state.

Mandate & Origin

The Online Safety Bill received Royal Assent on 26 October 2023 after six years of drafts, carve-outs, and renamings, becoming the Online Safety Act 2023. Its duties phased in on Ofcom’s schedule: illegal-content duties became enforceable on 17 March 2025, requiring in-scope services to complete illegal-harms risk assessments and implement mitigation measures; the “highly effective age assurance” duties took effect on 25 July 2025 for services carrying pornography and other content deemed harmful to children. Beyond fines, the statute gives Ofcom court-backed business disruption measures — orders against payment providers, advertisers, and ISPs — and criminal liability for senior managers in defined circumstances. Section 121 empowers Ofcom to require a service to use “accredited technology” to identify terrorism and child-sexual-abuse content — a clause that, applied to end-to-end-encrypted services, can compel scanning of private messages. The power sits in the text, in reserve.

Origin, structurally: the Act is what a sovereign parliament can do. As this drawer’s legal-traditions analysis lays out, the UK has no higher law against which a speech statute can be struck down — the same act that is impossible in Washington is routine in Westminster. The Act needed no constitutional amendment, no supermajority, and no referendum. It needed a majority and an afternoon.

The text, in its own words. Section 121 opens on a condition and a verb: “If OFCOM consider that it is necessary and proportionate to do so, they may give a notice” to the provider of a regulated user-to-user or search service. For a user-to-user service the notice may require the provider to “use accredited technology to identify CSEA content, whether communicated publicly or privately by means of the service,” or “to use the provider’s best endeavours to develop or source technology for use on or in relation to the service,” and the requirement can be met by the technology alone or “by means of the technology together with the use of human moderators” (Online Safety Act 2023, section 121). The word “privately” is in the clause for child sexual exploitation and abuse content; the clause’s terrorism-content limb is confined to content “communicated publicly.” The ceiling is in Schedule 13, paragraph 4: the greater of “£18 million” and “10% of the person’s qualifying worldwide revenue for the person’s most recent complete accounting period” (Schedule 13). Who carries the heaviest duties is decided by regulation. Schedule 11 requires the Secretary of State to make regulations specifying “Category 1 threshold conditions” by user numbers and functionalities (Schedule 11), and the 2025 regulations, made on 26 February 2025 and in force the next day, set Category 1 at “an average number of monthly active United Kingdom users that exceeds 34 million” with a content recommender system, or “exceeds 7 million” with a recommender system and “a functionality for users to forward or share regulated user-generated content”; Category 2A (search) is a 7 million user test, and Category 2B is “exceeds 3 million” users with a direct-messaging functionality (The Online Safety Act 2023 (Category 1, Category 2A and Category 2B Threshold Conditions) Regulations 2025, regulation 3; regulation 4; regulation 5).

Funding & Backers

The enforcement is funded by the enforced — the same finding as the EU Digital Services Act’s Article 43, in sterling. The Act requires that Ofcom’s operating costs for the online-safety regime be recovered from the providers it regulates: services whose qualifying worldwide revenue meets or exceeds £250 million (and with at least £10 million in UK-referable revenue) pay annual fees, set at roughly 0.02–0.03 percent of qualifying worldwide revenue. The fee regime went live on 11 December 2025, with notification due by 11 April 2026. The platforms pay for the regulator that fines them, and the age-check duty underwrites a private verification industry — the vendors of facial age estimation and ID-wallet checks are the statute’s commercial beneficiaries, paid per verification by the services the statute compels.

The fee threshold, in the statutory instrument. The Online Safety Act 2023 (Fees) (Threshold Figure) Regulations 2025 say “the threshold figure is £250 million” for the purposes of sections 83 and 84; they were made on 18 November 2025, laid on 20 November and in force on 11 December 2025, take effect from the charging year starting 1 April 2026, and are described in their explanatory note as the first regulations made under section 86 (SI 2025/1204). Section 83 puts the duty to notify Ofcom on a provider of a regulated service whose worldwide revenue “is equal to or greater than the threshold figure,” with notice for later years due at least six months before the charging year begins (section 83). A provider below the figure is outside the fee and the notification duty; it is not outside the Act’s other duties. The cost of the regulator is therefore carried by the largest providers and spared to every smaller one. On the age-check side, Ofcom’s own report finds that “the direct costs of age assurance are not prohibitively high and are in line with Ofcom’s original estimates,” while “Many porn sites that have introduced age checks have experienced sharp declines in user traffic” and for those that depend on advertising to large audiences the traffic loss “has impacted revenue” (Ofcom, Report on the use of age assurance, prepared under section 157, 16 July 2026).

Institutional Voice & Intent

The voice is the child-protection register — the grammar of “keeping children safe online,” of risk assessments, codes of practice, and “highly effective age assurance.” The register is not cynical on its face: the harms the Act answers are documented and real, and the duty structure produces genuine deliverables — risk assessments that exist where none did, takedown obligations with deadlines, an appeals-capable enforcement process run by a statutory regulator rather than a platform’s discretion.

Stated intent: Protect children from pornography and content promoting self-harm; make platforms legally responsible for illegal content; give a statutory regulator the tools to enforce both.

Observed intent: Normalize presenting verified identity — or a biometric estimate of it — as the price of reaching lawful content. This drawer’s digital-ID dossier tracks the same pattern across three jurisdictions: age assurance is the politically palatable wedge, and in the UK it landed alongside a government digital-ID push whose mandatory element was dropped only after a 2.9-million-signature petition — while the underlying identity layer kept being built.

Gap: The public measured it first. On 25 July 2025, the day age verification was enforced, VPN sign-ups in the UK surged 1,400 percent — circumvention adopted faster than compliance, within twenty-four hours. The gap between stated and observed intent is the gap between the users the gate was built for and the users it actually sorted: the compliant were enrolled, the non-compliant were trained to tunnel, and the children the statute names were left with whichever category their parents fell into. ITIF’s verdict — a “cautionary tale” of predictable consequences — is the attributed critique; the sign-up number is just arithmetic.

The regulator has since published its own series. Ofcom’s report under section 157, laid in July 2026, says “the estimated number of daily UK VPN users being 2.2 million compared with 1.2 million daily users prior to 25 July 2025,” a sustained rise after the initial spike, and that the evidence “does not currently show that this increase is due to children motivated by a desire to bypass age checks on online services.” Its headline finding is that “Circumvention appears low, although some activity may not be captured due to reporting bias”; its March 2026 survey of children aged 11 to 17 “found a quarter of children had used a VPN in the previous six months.” The same report records scale: “over 69 million age checks were completed across a sample of 32 services operating in the UK,” and it quotes the trade body of the verification providers calling the rollout “the largest coordinated deployment of age checks ever seen at a national scale.” Where the gate leaks, Ofcom locates the leak in the services: “almost half of the pornography services visited by children have no age checks in place,” and it restates “our long-standing, serious doubts about the efficacy of some age inference models” used by social media services (Ofcom, Report on the use of age assurance, 16 July 2026). The two measurements are different instruments, one provider’s sign-ups on one day against daily users across the market, and they agree on direction.

Interest: What each position pays, documented, with its own best case. The positions are the statute’s and Ofcom’s, the Government’s, the petitioners’, and the US executive’s; the regulator’s own file is Ofcom.

• Highly effective age assurance for pornography and age-restricted content. Position: Ofcom’s report says “Highly effective age assurance is helping to prevent children from accessing pornography online” and “All of the UK’s top 10 and the majority of the top 100 porn sites now have age checks in place” (Ofcom, 16 July 2026). What it pays: every completed check is a transaction between a regulated service and a third-party provider, and the report records that the providers’ pricing includes “fixed fees, subscriptions, and volume-tiered pricing,” with costs that “may decrease as the number of checks increases”; 69 million checks in six months is that volume. Digital ID checks are “generally reported to be available free of charge,” and the report charts per-check costs for the other methods. The report names no vendor; the Age Verification Providers Association is cited as a respondent to Ofcom’s call for evidence. Best case, Ofcom’s: children are deterred, and “in many cases the presence of age assurance appears to deter them.” Convergence: services that complied lost traffic and “some sites without age assurance have gained in popularity,” so the sites that ignore the rule gain from the sites that obey it, which is Ofcom’s own finding and the argument for enforcement against the non-compliant.
• Section 121, accredited technology in private messaging. Position: the clause’s text, above, with its “necessary and proportionate” condition and its two target categories. What it pays: a notice can require a provider “to develop or source technology,” which is a procurement duty on the provider and a market for whoever holds the accredited technology. No notice, accreditation or vendor is documented in the sources read. Best case, the statute’s: the power is confined to terrorism content communicated publicly and child sexual exploitation and abuse content, and it is conditional on necessity and proportionality. Convergence: none documented.
• Fee-funded regulator with a £250 million threshold. Position: SI 2025/1204 fixes the figure, and its explanatory note says “The cost to OFCOM of exercising its online safety functions will be met by fees charged to providers of regulated services who meet the charging criteria,” with the amount fixed “by reference to the provider’s qualifying worldwide revenue for the qualifying period, and any other factors that OFCOM consider appropriate” (SI 2025/1204, explanatory note). What it pays: Ofcom’s budget scales with the revenue of the providers at or above the figure, and providers below it pay nothing. Best case, the note’s: the cost of the regulator’s online-safety functions is met by fees charged to the providers it regulates. Convergence: every provider below the figure gains from the same threshold, and those are the providers with the least reason to want it lowered.
• Category thresholds, defended in the High Court. Position: the Secretary of State made regulation 3 and defended it. What it pays: the regulations decide which services can be categorised, and the judgment records that “Ofcom has not yet determined whether Wikipedia is a Category 1 service.” No payment to any party is documented. Best case, the claimants’: Wikipedia’s content “is entirely self-regulated by users,” so a regime built for recommender-driven platforms fits it badly; the court accepted that it was for Ofcom to decide and “dismiss[ed] the claim” while stressing the ruling “does not give Ofcom and the Secretary of State a green light.” Convergence: none documented.
• The petitioners: repeal. Position: the petition says “We want the Government to repeal the Online Safety act,” on the ground that its definitions cover “online hobby forums” that “do not have the resource to comply with the act and so are shutting down instead” (550,136 signatures, 22 April to 22 October 2025) (UK Parliament petition 722903). What it pays: repeal would remove the compliance cost from small forum operators, who are the petition’s stated beneficiaries; the government’s reply of 28 July 2025 says “Proportionality is a core principle of the Act and is in-built into its duties” and that “Ofcom will take a sensible approach to enforcement with smaller services that present low risk to UK users.” Convergence: none documented; the petition names no organization.
• The US executive’s position. Position: the State Department’s 2024 human rights report on the United Kingdom, published August 2025, says the Act “expressly expanded Ofcom’s authority to include American media and technology firms with a substantial number of British users, regardless of whether they had a corporate presence in the UK,” and that “Experts warned that one effect of the bill could be government regulation to reduce or eliminate effective encryption (and therefore user privacy) on platforms” (State Department). What it pays: a limit on Ofcom’s reach over American services protects those services from the Schedule 13 ceiling; the report does not name a service. Best case, the executive’s: speech rules for American platforms should not be set by a foreign regulator’s penalty schedule. Best case, Ofcom’s, as the Government and Ofcom put it in the record above: duties follow the UK user. Convergence: none documented.

Interest is a documented fact about each position, not a claim about motive, and not a verdict that the argument is wrong. Each best case is stated at the strength its author states it.

Position in the Apparatus

The Act is the British wing’s load-bearing statute, and it is read against the EU Digital Services Act — the two statutes are the democratic world’s parallel experiments in fine-backed content law, one aimed at platform process, one aimed at the user’s front door. Its enforcement arm, Ofcom, has its own file: the Act’s duties are only as real as the converged regulator that holds them. In The Ratchet’s cross-country convergence table, the UK’s internet-control entry reads simply “Online Safety Act + Ofcom” — statute and enforcer, one line item. The distinction the record supports: this is statutory regulation, with consultation, published codes, and appealable decisions — a different mechanism from the informal government-to-platform jawboning the American wing ran, and an honest analysis prices that difference in. The same honesty prices in what statute buys that jawboning never could: permanence, fee funding, and a penalty ceiling denominated in global revenue.

Actions & Leadership Choices

Founding purpose, judged on evidence. The Act answered real failures — children’s routine exposure to pornography and self-harm content, and a decade of platform self-regulation that produced neither risk assessments nor accountable takedown. As a duty-of-care statute it is genuine: obligations exist where none did, and a statutory appeal-capable process replaced pure platform discretion. This file records that as the strongest available defense.

The enforcement record, where the conduct shows. Enforcement runs through Ofcom, and the first-year ledger is specific: an age-assurance enforcement programme opened with the 25 July 2025 deadline; 76 sites under investigation by November 2025; a first confirmation decision on 13 October 2025 fining 4chan £20,000 for failing to provide an illegal-content risk assessment when requested — a paperwork offense, prosecuted first; a £50,000 fine against a “nudification” site; and a £1 million fine against AVS Group Limited with a £1,000-per-day penalty for continued non-compliance. The pattern in the ledger: the first targets were the marginal and the odious — a nudification service, an imageboard, an adult-site operator — which is where every new content statute builds its precedents before the categories travel upmarket. That trajectory is this drawer’s recurring observation about such machinery, recorded here as the thing to watch, not as an accusation against the enforcer.

The day-one verdict. The statute’s most consequential recorded event was not an enforcement action. It was the public’s: a 1,400 percent VPN surge on enforcement day, the largest documented act of mass technical non-compliance in the Act’s history, executed politely, legally, and immediately. The gate opened on schedule. The country walked around it.

The one court test, in the judgment. On 11 August 2025 the High Court (Administrative Court) decided Wikimedia Foundation and BLN v Secretary of State for Science, Innovation and Technology, [2025] EWHC 2086 (Admin), a challenge to regulation 3 of the categorisation regulations. The judgment records that on Wikipedia “the content is entirely self-regulated by users,” that “Ofcom has not yet determined whether Wikipedia is a Category 1 service,” and that “If regulation 3 (thus interpreted) covers Wikipedia, then it is a Category 1 service.” The disposition: “I grant permission to claim judicial review on grounds (1) and (2), but I dismiss the claim,” with permission refused on the human-rights grounds because “the claimants do not have standing to bring a claim under the Human Rights Act 1998.” The judge then added a warning that is part of the record: “I stress that this does not give Ofcom and the Secretary of State a green light” “to implement a regime that would significantly impede Wikipedia’s operations,” that a categorisation decision by Ofcom “is potentially amenable to the court’s review on grounds of public law error,” and that “the Secretary of State may be obliged to consider whether to amend the regulations” or exempt categories of service (National Archives caselaw, judgment of 11 August 2025). The statute’s only judicial test so far therefore went the Government’s way on the regulation and left the question of who is categorised to the regulator, open to review.

The Government’s reply to repeal, and the next extension. The petition “Repeal the Online Safety Act” closed on 22 October 2025 with 550,136 signatures; the Government’s response of 28 July 2025 says “The Government has no plans to repeal the Online Safety Act, and is working closely with Ofcom” (petition 722903). The direction since is outward. The Secretary of State’s letter to Ofcom’s chair and chief executive of 15 June 2026 says “robust, effective and timely enforcement of the Act is a priority,” records “I have already asked Sir Ian to conduct an urgent view of whether Ofcom has the right capabilities in place” (sic), and asks Ofcom to “submit to Parliament and make publicly available an update on enforcement strategy and outcomes” (DSIT letter, 15 June 2026). The Government’s July 2026 response says “social media companies will no longer be able to offer their services to under-16s,” names Ofcom as enforcer, puts regulations before Parliament “by the end of this year” with the restrictions taking effect in spring 2027, says “We will not ban or age-gate VPNs,” and says “The majority of chatbots most used by children are already within scope of the Online Safety Act” (DSIT, Growing up in the online world: government response, July 2026). The age-assurance machinery Ofcom built for 18 is the machinery the under-16 rule will be measured on: Ofcom’s own report commits it to deliver “by the end of October a rapid assessment of what highly effective age assurance looks like for determining whether someone is over 16.” The statute is being used to build the next gate, not to retire the first.

The American record, in the State Department’s own report. The Department’s 2024 human rights report on the United Kingdom, published August 2025, opens “The human rights situation worsened in the United Kingdom during the year,” lists restrictions on expression among the significant issues, and says of the Act that it “expressly expanded Ofcom’s authority to include American media and technology firms with a substantial number of British users, regardless of whether they had a corporate presence in the UK” (U.S. Department of State, 2024 Country Reports on Human Rights Practices: United Kingdom). That is the executive’s characterization and is attributed; the statute’s text shows the reach it describes, and the Government’s reply above shows the answer that proportionality is “a core principle.”

CONDUCT verdict: STATUTE-INSTRUMENT — CHILD-PROTECTION MANDATE, IDENTITY-ENROLLMENT MACHINERY. A real duty-of-care statute answering documented harms, whose approved compliance methods all run through verified identity or biometric estimation, whose costs fund its own regulator, whose Section 121 holds an encrypted-scanning power in reserve, and whose first day of age enforcement enrolled the compliant while training everyone else to tunnel.

Alliance Map

These run at the same time. The regulator is paid by fees from the providers it regulates, is directed and reviewed by the Secretary of State who also set the thresholds the High Court upheld, and is named by the same department as enforcer of the planned under-16 restriction; the regulated include the American firms whose government has described the statute’s reach as an expansion; and the age-assurance market that benefits from the duty is paid by the services the duty binds. The overlap is the finding, not a coordination claim.

Reach Assessment

Institutional: High, and exported. The Act is the precedent cited on both sides of the American age-verification wave — roughly 25 US states by end-2025, blessed by Free Speech Coalition v. Paxton — with ITIF explicitly offering the UK experience as the cautionary tale for the US. What Westminster builds, statehouses read.

Memetic: High. “Highly effective age assurance” is the vocabulary export — a compliance category invented by this statute’s implementation that now names an industry, a certification posture, and a policy position in three jurisdictions. Owning the category is upstream of every debate conducted in it.

Civilizational: High. The Act does not build AI systems and does not write their refusals. It built the first national-scale legal machinery that makes identity the precondition for lawful access — and the same drawer’s digital-ID research documents the EU building its age-verification tool on the identity-wallet stack outright. The recurring lesson of this file’s drawer, in statutory form: the gate is built for the children, the identity layer remains for everyone, and a statute never resigns.

Score basis. Atk 8 is reach: Schedule 13 paragraph 4 sets the penalty at the greater of “£18 million” and “10% of the person’s qualifying worldwide revenue,” the duties bind every regulated service with links to the UK, and Ofcom’s report counts “over 69 million age checks” across 32 services in six months (Schedule 13; Ofcom s.157 report). It is not a 9 because the penalties recorded in this file fell on an imageboard, a nudification site and an adult-site operator rather than on a global platform, and Ofcom’s own report says “almost half of the pornography services visited by children have no age checks in place” and doubts the age-inference models of social media services. Def 9 is funding insulation: the cost of Ofcom’s online-safety functions “will be met by fees charged to providers of regulated services,” a £250 million threshold fixed by SI 2025/1204, and the one judicial review of the categorisation regulations was dismissed on 11 August 2025 (SI 2025/1204; judgment). It is not a 10 because the same judgment leaves Ofcom’s categorisation decisions open to review for public-law error, and the Secretary of State has asked Ofcom’s chair for “an urgent view of whether Ofcom has the right capabilities in place.” Hp 9 is entrenchment: the Government replied to a 550,136-signature petition that it “has no plans to repeal” the Act, and its July 2026 response extends the regime with an under-16 restriction Ofcom will enforce and regulations due “by the end of this year” (petition 722903; DSIT response). Peers on the same values: EU AI Act at 8/9/9, hazard 86, whose reach likewise rests on a statutory penalty schedule and an enforcement arm still being built, and BlackRock at 8/9/9, hazard 84, whose reach rests on assets under management and a client base rather than on a statute; EU Digital Services Act at 9/9/9, hazard 88, is a point higher on reach because its fining power has already been used three times against named global platforms, where this Act’s recorded penalties have not reached one. The values hold.

Sources: Online Safety Act 2023 — legislation.gov.uk; Online Safety Act 2023, Section 121 — legislation.gov.uk; Online Safety Bill receives Royal Assent — Norton Rose Fulbright; Statement: Protecting people from illegal harms online — Ofcom; Age checks for online safety — Ofcom; The UK’s Online Safety Act’s Predictable Consequences Are a Cautionary Tale for the US — ITIF, Sep 2025; Enforcement under the Online Safety Act — Bristows; Online safety fees and penalties — Ofcom; Ofcom sets out fees and penalties regime under the Online Safety Act — Lewis Silkin, Jul 2025; 2025 UK Online Safety Act round-up — CMS Law-Now, Dec 2025; Ofcom fines adult website provider £1 million — Lewis Silkin, Dec 2025; Ofcom fines nudification site £50,000 — Ofcom; Free Speech Coalition, Inc. v. Paxton, 606 U.S. ___ (2025) — Justia; The Year States Chose Surveillance Over Safety — EFF, Dec 2025; Ofcom fines 4chan £20K for Online Safety Act failings — The Register, 13 Oct 2025; Online Safety Act 2023, Schedule 13 — legislation.gov.uk; Online Safety Act 2023, Schedule 11 — legislation.gov.uk; Online Safety Act 2023, section 83 — legislation.gov.uk; Category 1, 2A and 2B Threshold Conditions Regulations 2025, SI 2025/226 — legislation.gov.uk; SI 2025/226, regulation 4; SI 2025/226, regulation 5; Online Safety Act 2023 (Fees) (Threshold Figure) Regulations 2025, SI 2025/1204 — legislation.gov.uk; Wikimedia Foundation and BLN v Secretary of State for Science, Innovation and Technology, [2025] EWHC 2086 (Admin) — National Archives; Repeal the Online Safety Act, petition 722903 and Government response — UK Parliament; June progress statement: letter from the DSIT Secretary of State to the Ofcom Chair and CEO — GOV.UK; Growing up in the online world: government response, July 2026 — DSIT; Report on the use of age assurance, s.157, 16 July 2026 — Ofcom; 2024 Country Reports on Human Rights Practices: United Kingdom — U.S. Department of State, Aug 2025; Ofcom — profile.