How UK Internet Censorship Works Under the Online Safety Act

Internet censorship in the UK operates on several layers at once: the Online Safety Act 2023 forces websites and apps to police what their users post, individual users can be prosecuted for certain messages they send, internet providers block entire websites at the network level, and the government can compel providers to retain records of what people do online. There is no single agency deciding what is allowed, but the combined effect is one of the more assertive online regulatory systems in a Western democracy.

How the Online Safety Act Controls What Platforms Show

The Online Safety Act is the main law shaping what appears on the UK internet. It applies to any service that lets users post content or interact with each other, including social media, messaging apps, dating services, forums, and cloud-sharing sites, as well as search engines that index the web.¹ These services owe a legal duty of care to their UK users, meaning safety must be designed into how the platform works rather than added on later.

Every service in scope must run risk assessments identifying how its design might expose users to illegal content or harm children. Illegal content risk assessments were due by March 2025, and children’s risk assessments by July 2025.² The duties scale with the platform’s size, reach, and risk profile. The largest services face the heaviest obligations, but smaller ones are not exempt.

Removal after a user complaint is not enough. The obligation is proactive: services must use automated tools and human moderation to find and remove illegal content before it spreads, and their recommendation algorithms must not amplify prohibited material.

What Content Platforms Have to Remove

Ofcom lists specific categories of criminal content that platforms must prevent, detect, and take down. The priority offense areas include:

Terrorism
Child sexual exploitation and abuse, including grooming and image-based abuse material
Hate offenses
Harassment, stalking, threats, and abuse
Controlling or coercive behavior
Intimate image abuse (non-consensual sharing of sexual images)
Extreme pornography
Sexual exploitation of adults
Human trafficking and unlawful immigration
Fraud and financial offenses
Proceeds of crime
Drugs and psychoactive substances
Firearms, knives, and other weapons
Encouraging or assisting suicide
Foreign interference
Animal cruelty

The list grew in January 2026, when regulations added two new priority offenses: encouraging or assisting serious self-harm, and cyberflashing. Ofcom launched a consultation in March 2026 to update its codes of practice to reflect these additions.³ The government has also signaled it intends to bring AI-generated deepfake intimate images into the framework.

Age Checks and Content Limits for Children

The Act treats children’s safety as a higher-priority duty. Platforms likely to be accessed by anyone under 18 must prevent children from encountering material that is legal for adults but harmful to minors, including pornography, content promoting eating disorders, material encouraging self-harm, and bullying.¹

To enforce this, services must implement what Ofcom calls “highly effective age assurance.” Ofcom and the Information Commissioner’s Office have not mandated a single verification method, but they have set a minimum effectiveness bar. Simply asking users to declare their age does not qualify. Neither does requiring a debit card, since those are available to under-18s. The chosen method must reliably prevent fake input and confirm the person presenting for the check is actually the age they claim.⁴

Sites that publish their own pornographic content, classified as “Part 5 services,” faced an accelerated deadline and were required to have robust age checks in place by July 2025.⁵ Platforms must also default child accounts to the highest privacy and safety settings and provide reporting tools designed for young people and parents.

For adult users, the largest platforms (designated Category 1 services) must offer tools letting people filter their own exposure to certain content, including material on suicide, self-injury, eating disorders, and hate speech. The choice sits with the user rather than the platform being ordered to remove the material for everyone. Category 1 services must also let users filter out accounts that have not verified their identity, and they must protect content of “democratic importance,” meaning they cannot simply remove political speech because it is controversial.⁶

What You Can Be Prosecuted For Posting

UK law does not only regulate platforms. Individual users face criminal prosecution for certain messages they send online. The Online Safety Act created three new communication offenses that replaced older provisions in the Communications Act 2003 and the Malicious Communications Act 1988. They took effect on 31 January 2024.⁷

False Communications

Under section 179 of the Online Safety Act, it is a criminal offense to send a message containing information you know to be false, if you intend to cause non-trivial psychological or physical harm. The message does not have to be sent to a specific person. If it is reasonably foreseeable that someone will encounter it, including through sharing or forwarding, that is enough. The maximum penalty is 51 weeks in prison.⁸

Threatening Communications

Section 181 makes it an offense to send a message conveying a threat of death or serious harm, either intending the recipient to fear the threat will be carried out or being reckless about whether they would. This is the most serious of the new offenses. On conviction in a Crown Court, the maximum sentence is five years in prison.⁹

Sending Flashing Images

Section 183 targets a narrow form of online attack: sending flashing images electronically to someone you know or suspect has epilepsy, intending to cause them harm.⁶

The older offense of sending a “grossly offensive” message under section 127 of the Communications Act 2003 remains partially in force. Prosecutors still use it for messages that are indecent, obscene, or menacing, though the false-message provisions of that law were repealed when the Online Safety Act offenses came into effect.⁷

Websites Blocked by Your Internet Provider

Some UK censorship happens above the level of individual platforms. Internet service providers block access to entire websites at the network level through several overlapping mechanisms.

Rights holders can obtain court injunctions under section 97A of the Copyright, Designs and Patents Act 1988 forcing ISPs to block sites that facilitate copyright infringement. The power has been used extensively against torrent sites and streaming platforms.¹⁰

ISPs also voluntarily use URL lists maintained by the Internet Watch Foundation to block pages hosting child sexual abuse material. The IWF describes this as a short-term disruption tactic while the material is removed at its source; the block stops UK users from stumbling across it in the meantime.¹¹

Since 2013, the UK’s major ISPs have voluntarily applied default-on adult content filters to new home broadband customers. These network-level filters categorize websites and block those classified as sexually explicit, violent, or otherwise unsuitable for children, across every device on the home network. Customers can switch them off, but the default is that they are active. When a user requests a blocked page, they see a notification rather than the content.

Browsing Records and Encrypted Messages

The Investigatory Powers Act 2016 gives the government authority to collect and retain communications data. Under section 87, the Home Secretary can issue a retention notice requiring a telecommunications operator to store communications data, including internet connection records showing which websites a user visited, for up to twelve months. Each retention notice must be approved by a Judicial Commissioner.¹²

The Investigatory Powers (Amendment) Act 2024 expanded these powers. It introduced “Notification Notices,” which require technology companies, including those based outside the UK, to inform the Home Office before making changes to their encryption or security systems. The government can then order a halt to those changes pending review, with no fixed time limit. Security patches are excluded, but broader changes to how a service encrypts user data are not.¹³

Section 122 of the Online Safety Act sits alongside these powers. It gives Ofcom the authority to issue “technology notices” to messaging services, requiring them to develop and deploy technology capable of scanning messages, including end-to-end encrypted messages, for child sexual abuse material. Critics have called it a “spy clause,” arguing it amounts to mandating mass surveillance of private communications.

As of May 2026, Ofcom has published final guidance on technology notices and delivered its advice to the Home Secretary, but no notice has yet been issued to a major encrypted messaging provider.² Signal and WhatsApp have publicly stated they would rather withdraw from the UK market than compromise their encryption. The power exists in law; whether it will be used against a major provider remains open.

Penalties and Where Enforcement Stands

Ofcom, the UK’s communications regulator, enforces every duty under the Online Safety Act. Its toolkit includes:

Fines of up to £18 million or 10 percent of a company’s qualifying worldwide revenue, whichever is greater.¹
Service restriction orders, which allow Ofcom to apply to the courts for orders requiring ISPs to block access to a non-compliant platform within the UK.
Transparency demands, including detailed reports and direct audits of a platform’s safety systems.
Senior manager liability, meaning individual executives can face criminal prosecution for failing to comply with Ofcom’s information requests or for destroying evidence.

Ofcom’s approach so far has been phased. The regulator spent much of 2025 issuing codes of practice and giving platforms time to complete their risk assessments. From 2026, enforcement is shifting toward active compliance checking. Ofcom began requesting risk assessment records from services in April 2026, with responses due by the end of July, and the categorisation of the largest services is expected to be finalised around mid-2026.² How aggressively Ofcom uses these powers over the next two years will decide whether the Act becomes a genuine constraint on how the internet operates in the UK.

1
GOV.UK. Online Safety Act: Explainer
2
Ofcom. Ofcom’s Approach to Implementing the Online Safety Act
3
Ofcom. Illegal Content Duties Under the Online Safety Act
4
Information Commissioner’s Office. Age Assurance: A Joint Statement by Ofcom and the Information Commissioner’s Office
5
Ofcom. Age Checks to Protect Children Online
6
Legislation.gov.uk. Online Safety Act 2023
7
Crown Prosecution Service. Communications Offences
8
Legislation.gov.uk. Online Safety Act 2023 Section 179
9
Legislation.gov.uk. Online Safety Act 2023 Part 10
10
Legislation.gov.uk. Copyright, Designs and Patents Act 1988 Section 97A
11
Internet Watch Foundation. IWF URL List Policy and Blocking Good Practice
12
Legislation.gov.uk. Investigatory Powers Act 2016
13
GOV.UK. Investigatory Powers (Amendment) Act 2024: Response to Consultation