UK Online Safety Act: what actually changed for parents
Why age checks appeared everywhere in July 2025 — and the one thing your child can do to their own feed that almost nobody mentions.
The Protection of Children Duties came into force on 25 July 2025, and they put the obligation on online services rather than on families. Services must use highly effective age checks to keep children away from the most serious content, and services whose recommendation algorithms carry a medium or high risk must filter harmful material out of children’s feeds. That is why age checks appeared across the UK internet that month.
The two tiers of content, and what services must do about each
Ofcom’s Protection of Children Codes split harmful material into tiers, and the wording of the duty differs between them in a way worth understanding.
- Primary Priority Content — pornography, and material that encourages, promotes or gives instructions for suicide, self-harm or eating disorders. Services must prevent children from encountering it, using highly effective age verification or age estimation.
- Priority Content — including violent content and cyberbullying. Services must protect children from it, and more broadly minimise exposure to violent, hateful or abusive material, online bullying, and content promoting dangerous challenges.
Prevent is a higher bar than protect. In practice a parent should expect a hard gate in front of the first category, and best-efforts filtering in front of the second.
Why you are being asked to prove your age
“Highly effective age assurance” means age verification, age estimation, or both. Any service that allows pornography had to have it in place by July 2025, which is why the change was so visible so quickly, and why adults noticed it too: a gate that keeps children out asks everyone.
The practical implication for a family is that the protections attach to a service knowing your child is a child. An account created with a false birth date, or a parent’s account handed over, sits outside all of it. That is worth saying out loud to a teenager rather than assuming the law has covered it.
Personalised recommendations are the main route by which children meet harmful content, so the Codes address the algorithm directly. A provider running a recommender system that poses a medium or high risk must configure it to filter harmful content out of children’s feeds — and children must be able to give negative feedback directly to the feed, so it learns what they do not want to see.
That last part is a concrete thing to do this week. Sit with your child and use the “not interested”, “don’t recommend this” or equivalent control on whatever they actually watch. It is a right the Codes require the service to give them, it works on the mechanism that causes most of the harm, and it takes ten minutes.
What the Act does not do
- It sets no screen-time limits and creates no parental controls of its own. Everything in our device guides still applies.
- It places no duty on parents or children, and creates no offence for a family.
- It does not make private messaging or gaming chat safe, and those are where most stranger contact begins.
- Compliance is uneven and is being enforced over time; Ofcom runs enforcement programmes rather than switching every service on at once. Do not read the law as a guarantee about any particular app.
What to actually do
- Check the birth date on your child’s accounts. The Codes only protect a user the service believes is a child.
- Sit with them and use the feed’s negative-feedback control on anything they do not want more of.
- Set the device-level controls, which the Act does not provide — see our iPhone and iPad and Android guides.
- Cover the services the Act reaches least: Discord, WhatsApp and Roblox.
- Agree what your child should do when a gate blocks them, so the answer is not “borrow an adult’s account”.
Families outside the UK should read our regional differences guide, and Australian families the under-16 rules guide, which works very differently — it removes accounts rather than gating content.
Common questions
Why is my child suddenly asked to prove their age on UK sites?
Because the Protection of Children Duties came into force on 25 July 2025. Services must use highly effective age assurance — age verification, age estimation or both — to keep children away from the most serious content, and any service allowing pornography had to have it in place by then. A gate that keeps children out asks everyone, which is why adults noticed it too.
What content does the Online Safety Act actually cover?
Two tiers, with different duties. Primary Priority Content — pornography and material encouraging suicide, self-harm or eating disorders — must be prevented from reaching children. Priority Content, including violent material and cyberbullying, must be protected against, alongside minimising exposure to hateful or abusive material and dangerous challenges. Prevent is the higher bar of the two.
Can my child train their feed to show less harmful content?
Yes, and it is a right the Codes require services to give them. Providers running a recommender system that poses a medium or high risk must filter harmful content out of children’s feeds, and children must be able to give negative feedback directly to the feed so it learns what they do not want. Sit with your child and use the “not interested” control on whatever they actually watch.
Does the Act mean UK children are protected now?
Not on its own. The protections only apply where a service believes the user is a child, so an account with a false birth date or a borrowed adult account sits outside all of them. The Act also sets no screen-time limits, provides no parental controls, and does not make private messaging or gaming chat safe. Compliance is being enforced over time rather than switched on everywhere at once.
Do parents break the law if their child gets past an age check?
No. The duties fall on services, not on families, and the Act creates no offence for a parent or a child. Ofcom enforces against providers. Your job is the part the law does not reach: the birth date on the account, the device-level controls, and the apps the Codes touch least.
When parental controls change
Parental controls get renamed and moved without announcement. Roughly monthly we send new guides, changes to controls like these, and scams worth knowing about.
Free. No ads, no affiliate links, and we never sell or share your address.