New UK legislation supplements the UK's online safety regime as the government comes under increasing pressure to ban social media for under-16s. What are the changes?
The Online Safety Act 2023 (OSA) was intended to provide a future-proof framework to protect users from illegal user-generated content and content harmful to children. Since the OSA was passed, technology and, in particular, AI have moved on and the government has been under increasing pressure to add to the regime.
What's the development?
The Children's Wellbeing and Schools Act 2026 (CWSA) and the Crime and Policing Act 2026 (CPA), both finalised in May 2026, have made direct amendments to the OSA and changes to the types of content covered by the OSA with the introduction of a range of new criminal offences.
Children's Wellbeing and Schools Act 2026
The government has come under sustained pressure to restrict children's access to social media. Having initially ruled this out, it launched a consultation on Growing up in the online world on 2 March 2026 (Consultation). This includes questions around banning or restricting access by children to certain services or types of service and the government maintained that it would not act before it had analysed the outcome of the consultation which closed on 26 May 2026. The CWSA (which is not primarily online safety legislation) was delayed as the House of Lords tried to get amendments which would pre-empt any government decision and introduce a social media ban. Negotiations ended in an uneasy compromise and insertion of online safety provisions in Part 3 ss70-73 of the Act.
Section 70 – restriction of access by children to internet services
Section 70 – inserts a new s214A into the OSA which gives the Secretary of State (SoS) powers for the purposes of protecting children from a risk of harm including as a result of content, to introduce secondary legislation requiring providers of specified internet services to prevent or restrict access by relevant children to specified internet services or functionalities or features of those services. What constitutes a 'relevant child' will be set out by the SoS.
S214A(1)(b) can include requirements on a provider of an internet service (by way of example), to:
-
limit the amount of time per day or other specified period for which relevant children may access the service, functionality or feature;
-
limit the times of day for such access, or restrict access to a service or part of it whereby the user could receive unsolicited contact from strangers, encounter live oral or video communications directly generated, uploaded or shared on or by the service by an unknown person or vice versa; or
-
limit access where a person unknown to the user could identify their actual or approximate location.
Regulations which can be made under s214A can cover steps a provider must or may take to comply with the relevant secondary legislation, the monitoring of compliance, and enforcement.
The SoS must exercise the power under subsection 1 such that they take into account the Consultation.
Section 71 – timing of secondary legislation
Within three months from the date on which the CWSA is passed, the SoS must lay before Parliament a progress statement regarding the first regulations to be made under s214A of the OSA and the timeline. The first regulations must be laid before Parliament before the end of 12 months beginning on the date on which the progress statement is published and if no such regulations have been laid, the SoS must lay a statement explaining why and then lay the first regulations six months after that.
Section 72 – age of consent in processing of children's personal data by information society services
The SoS has the power to amend the age of children's consent in relation to information society services (or to certain specified services or types of service) to anywhere between 13-16. The SoS is also empowered to introduce secondary legislation round age verification requirements.
Crime and Policing Act 2026
Over the course of 2025, the government made a number of announcements about new online safety-related offences and further measures. These have now been included in the CPA and cover:
-
Civil penalties relating to unlawful weapons content on online platforms and a content removal regime as well as a requirement on online platforms to appoint a content manager as a contact point for law enforcement (Part 2, Chapter 1).
-
A new criminal offence where a person facilitates online child sexual exploitation and abuse. (Part 4, Chapter 1).
-
A new criminal offence around making, adapting, possessing or supplying child sexual abuse image-generators (s72) (subject to limited exceptions and defences), and an offence for making, adapting, supplying or offering to supply a thing for use as a generator of purported intimate images (which is intended to capture so-called 'nudification tools') (s99).
-
A new criminal offence of carrying out relevant internet activity (including providing or maintaining an internet service, moderating or controlling access to content or facilitating content) with the intention of creating CSEA content (s77) (CSEA offences are set out in schedule 10). Senior executives can be held liable where the offence is committed by their company with their consent or connivance (s79).
-
Section 83 adds grooming as an aggravating sentencing factor.
-
Mandatory reporting of CSEA (ss85-95) subject to statutory exceptions for those engaged in "relevant activities".
-
Under s100, s10 OSA is amended to introduce a new duty on user-to-user and search services to use proportionate systems and processes designed to take down content identified as a result of an "intimate image content report" and any identical content (i.e. copies not just the original content) as soon as reasonably practicable and no later than 48 hours after receiving the report (subject to exceptions). Services are also required to facilitate the making of intimate image content reports by having appropriate systems. The SoS may make regulations around what that entails. Search services have to treat such content as illegal content and prevent users encountering it within 48 hours of receiving a report. Intimate image content is any content amounting to an offence under the Sexual Offences Act 2003 ss 66B 1-3 (sharing an intimate image without consent). The Courts are also given powers to issue image deletion orders (s102). Schedule 14 makes provision about reporting and registration of intimate image material.
-
New criminal offences relating to pornographic images of strangulation or suffocation, incest, and sexual activity with under-16s (ss104-7) and encouraging or assisting serious self harm (ss135-6).
-
The SoS is required to review the role of internet service providers in verifying the age of individuals appearing in pornographic content and whether the individual consented to the content being published. A report must be published within 12 months of the Act being passed (s108) and s109 amends the OSA to give the SoS power to introduce regulations to impose age verification and consent verification duties on regulated providers in this regard. These duties may also be imposed on specified internet service providers (s110).
-
The Police are given a range of new powers including the power to suspend IP addresses and domain names (s170 and Schedule 18).
-
Provisions around information to be given by ISPs in connection with child death investigations (s247).
-
Section 248 introduces a new s216A into the OSA. This gives the SoS the power to amend the OSA to minimise or mitigate the risk of harm arising from illegal AI-generated content and the use of AI services to commit or facilitate priority offences. This may include imposing illegal content duties on providers of AI services, extending Part 3 reporting requirements for CSEA content to AI-generated CSEA content and extending Ofcom's powers. The SoS is required to submit a report on progress towards making such regulations by 31 December 2026.
-
Schedule 13 makes changes to the Sexual Offences Act 2003 around intimate image offences. This includes new offences around taking or recording intimate images without consent and installing, maintaining or preparing etc. equipment to enable taking or recording such images and creating copies of temporarily shared non-consensual intimate images.
What does this mean for you?
Many of the changes impacting user-to-user services and search services will be set out in secondary legislation, and some are dependent on reports or consultations concluding beforehand. This leaves a high degree of uncertainty but what we do know is:
-
We can expect secondary legislation on children's online access within 15 months, or 21 months at the latest, but it is not yet clear what services will be covered nor what the age parameters will be.
-
There are new requirements to take down intimate image content within 48 hours and to provide reporting mechanisms for such content.
-
There are new types of illegal content and primary priority content for the purposes of the OSA and a range of offences relating to intimate image abuse, including in relation to equipment enabling taking, recording or copying of sexual abuse intimate images and purported intimate images.
-
OSA illegal content safety duties are likely to be extended to illegal AI-generated content and the use of AI services to commit or facilitate priority offences. This may include imposing illegal content duties on providers of AI services, extending Part 3 reporting requirements for CSEA content to AI-generated CSEA content. This is not likely to happen before 2027.
-
There may be regulations to impose age verification and consent verification duties on regulated providers in relation to pornographic content. Again this is unlikely to happen before the end of 2027.
As with much recent legislation, a lot of the detail around the provisions in the CPA and CWSA will be or may be introduced under secondary legislation. The conclusions of the Consultation will be pivotal in determining policy going forward but it seems likely that more legislation and, consequently, further changes to the OSA, will follow.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]