The Online Safety Act

We help clients determine whether and how OSA applies and then build the underlying compliance architecture: illegal content risk assessments, children’s access assessments and children’s risk assessments, recordkeeping and review frameworks, terms of service drafting, complaints and reporting mechanisms, and governance structures that put accountability where Ofcom expects to find it.

We advise on children’s access assessments, highly effective age assurance design and vendor selection, recommender system and feed safety measures, and the data protection and privacy trade-offs that age assurance inevitably creates. We work alongside privacy counsel to reconcile OSA obligations with UK GDPR and the Children’s Code rather than treating them as separate workstreams.

For Category 1, 2A and 2B services – and for those designated as emerging Category 1 – we advise on categorisation assessments and representations, transparency reporting, user empowerment and identity verification duties, protections for news publisher, journalistic and democratic importance content, fraudulent advertising obligations, and the additional risk assessments Category 1 providers must complete.

We manage the relationship with Ofcom: responding to statutory information notices, preparing for and participating in supervisory engagement, making representations on provisional decisions, and handling the confidentiality and privilege questions that arise when a regulator asks for internal documents. Early positioning shapes everything that follows.

We act for providers in active Ofcom investigations – from first information notice through provisional decision, representations, and penalty and remediation outcomes. We advise on parallel exposure across regulators and jurisdictions, on public and press strategy, and on the internal investigation and privilege issues that run alongside the regulatory process.

We have been instructed on judicial review challenges arising from the online safety regime. Where a decision by Ofcom or the Secretary of State is unlawful, disproportionate or wrongly reasoned, a public law challenge is a genuine option – and the courts have signalled that the door is open where obligations bite disproportionately on a particular service model.

Most OSA questions arise as product questions: how to design a recommender system, what a reporting flow looks like, how a new feature changes a risk profile, or how generative AI features interact with illegal content and child safety duties. We embed with product, trust and safety, and engineering teams so the legal analysis reaches the decision before it ships.