If you run a forum, a community board, a file-sharing page, or any site where visitors can post content for other visitors to see, the UK Online Safety Act may apply to you, even if you are not in the UK. Many small operators found out the hard way in 2025, when dozens of small forums blocked British users or closed. This guide helps you work out where you stand.
Step 1: Are you in scope?
The Act regulates two main kinds of service:
- User-to-user services: users can generate or upload content that other users can encounter. Social networks, forums, chat, and sharing sites are typical.
- Search services.
It applies when the service has links to the UK, such as many UK users or targeting the UK market. Services where people can only comment on the provider's own content, or like and react, are generally treated as limited-functionality and fall outside the user-to-user rules.
Ofcom, the regulator, offers an online scope checker. Use it and keep a copy of the result.
Step 2: Assess the risks
Two assessments matter most for small services:
- Illegal-content risk assessment. Think through how your service could be used to share illegal content (for example fraud, harassment, or abuse material), how likely that is, and what you do about it.
- Children's access assessment. Decide whether children are likely to access your service. If they are, a children's risk assessment and extra protections follow. Services that add strong age checks, or can show children do not use them, face fewer duties.
Write the assessments down. A short, honest document that matches how your site actually works is better than a long generic one. Ofcom has said providers must send their risk assessments to it, on request, between 1 May and 31 July 2026, so keep them ready.
Step 3: Act and keep records
Proportionate measures for a small service often include:
- Reporting and complaints: an easy way for users to flag content, and a record of what you did.
- Moderation: a named person or routine that removes illegal content promptly.
- Clear terms of service that say what is not allowed and how you enforce it.
- Review: repeat the assessment at least yearly and when you add major features.
Keep logs of decisions. If Ofcom writes to you, the first question is usually: "Have you done your risk assessment? Please show it to us."
Penalties and proportionality
Ofcom can fine up to 18 million pounds or 10% of qualifying worldwide revenue, whichever is greater, and has opened investigations into companies suspected of breaches. At the same time, it has stated that it does not set out to penalise small, low-risk services trying to comply in good faith, and that it prioritises larger and higher-risk platforms.
A quick decision list
- Do visitors post content others can see? If no, you are probably outside the user-to-user rules.
- Do you have UK users or target the UK? If no, you may be out of scope, but check.
- Run Ofcom's scope checker.
- Write your two assessments, and a one-page policy for reporting and moderation.
- Decide your fallback. Some small operators decided that blocking UK visitors was simpler. That is a legitimate business choice, but it should be deliberate.
Rules for tracking and cookies are a separate topic. See our look at the EU cookie position after the Digital Omnibus for the EU side.
Sources
- Ofcom: helping small services navigate the Online Safety Act
- The Register: Online Safety Act and smaller forums
Overview as of November 6, 2026. Ofcom's guidance and deadlines change, so check the regulator's current pages. This is not legal advice.