The Online Safety Act: What It Means for Schools
The Online Safety Act 2023 puts new legal duties on the apps, sites and search engines children use. It changes the online world pupils step into, but it does not hand schools a new set of filtering rules.
This guide sets out what the Act does, what it leaves to schools, and the practical steps worth taking this year.
Let platforms do their part while your school filter does its own
The Act puts duties on the services children use, and none of them reaches inside your network. What happens on school devices is still decided by your filter, so it helps to have category rules you control and can explain.
- Our hosted CIPA filter blocks by category, with Adult switched on in the preset
- Your school decides which other categories to add, school by school
- Reports show what was requested and blocked, whatever the platforms changed
Two tracks of online safety law
It helps to see UK online safety as two separate tracks. One regulates the companies that run online services. The other governs how schools safeguard pupils. They aim at the same goal from different ends.
Platform track
Online Safety Act 2023, enforced by Ofcom- Social media, video sharing, messaging, forums and gaming chat
- Search engines
- Sites that publish pornographic content
- Duties to assess risk, reduce harm and protect children
- Fines and business disruption for breaches
School track
KCSIE, DfE standards, Prevent, inspection- Appropriate filtering and monitoring on school systems
- A named senior lead and governor oversight
- Annual review with a written record
- Staff training and online safety teaching
- Accountability through inspection and governance
What the Online Safety Act 2023 does
The Act is long and detailed. These are the parts that matter most for anyone thinking about children's safety online.
Illegal content duties
In-scope services must assess the risk of illegal content and take steps to reduce it, such as child sexual abuse material, terrorism and fraud.
Child safety duties
Services likely to be used by children must assess risks to them and protect them from content that is harmful to minors.
Age assurance
Where the most harmful content is allowed, services must use highly effective age checks to keep children out.
Ofcom codes
Ofcom writes codes of practice. Following them is the clearest way for a service to show it meets its duties.
Reporting and complaints
Services must give users easy ways to report harmful content and to complain about decisions.
Extra duties for large services
Services designated as categorised face added duties, such as transparency reporting and more user controls for adults.
Enforcement
Ofcom can fine providers up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.
Business disruption
In serious cases Ofcom can ask a court to restrict a service, for example through payment providers or internet access.
New criminal offences
The Act created offences such as cyberflashing, encouraging serious self-harm, and sending threatening or knowingly false messages.
Primary priority content for children
The most harmful category. Services must stop children from encountering it, which in practice usually means age checks.
Priority content for children
Harmful material that services must protect children from, using age-appropriate design, safer feeds and moderation.
How services in its scope sit in our categories
The Act covers user-to-user sites, search and pornography providers. We looked up some well-known names to show what a school filter sees when a pupil reaches them.
| Service | Category labels held | What it means at school |
|---|---|---|
| pornhub.com | Adult | Blocked by the Adult switch in the preset |
| reddit.com | Social Networking, Forums / Message Boards, Community Sites | Several labels, so a school can choose what to restrict |
| 4chan.org | Forums / Message Boards, Community Sites | Anonymous boards a school may choose to block |
| telegram.org | Email and Messaging, Social Networking | A messaging app with a public side |
| discord.com | Email and Messaging, Social Networking, Gaming | Chat servers where age checks happen on the platform |
Online Safety Act timeline: how it is coming into force
The Act is switched on in phases as Ofcom publishes each code. The key dates for children so far are below. Later phases are still rolling out, so check Ofcom's current roadmap.
Royal Assent
The Online Safety Bill became law as the Online Safety Act 2023, with Ofcom named as regulator.
First new offences take effect
Criminal offences such as cyberflashing and encouraging serious self-harm began to apply.
Illegal content duties enforceable
Services needed illegal harms risk assessments in place and had to start acting on Ofcom's illegal content codes.
Protection of children codes in force
Children's risk assessments were due by 24 July and the children's codes applied from 25 July, including age checks for the most harmful content.
Categorised services and further codes
Extra duties for the largest services, transparency reporting and further guidance follow in later phases.
What the Online Safety Act does not require of schools
Headlines about the Act often leave school leaders wondering if they have new legal duties. For most schools the honest answer is no, not directly.
Still the school's job
Not a school duty under the Act
Online services that schools and other education providers run for education are generally exempt from the Act, because schools already have safeguarding duties. That exemption covers the provider, not necessarily a third-party app the school buys. Check the current text and Ofcom guidance for edge cases.
How the Act interacts with KCSIE and school filtering
The Act and KCSIE do not overlap legally, but they meet in the daily life of pupils. This table shows where each one does the work.
| Risk | Online Safety Act (platforms) | KCSIE and DfE standards (schools) | What it means in practice |
|---|---|---|---|
| Pornography | Age checks to keep children off sites and services that allow it | Filtering blocks adult content on school systems | Two layers: one at the platform, one on school devices |
| Self-harm and suicide content | Services must stop children from encountering it | Filtering and monitoring flag searches and sites | Alerts still matter, because harmful content can surface on any site |
| Child sexual abuse material | Illegal content duties, detection and removal | Illegal content lists applied by the filtering provider | No change to the school baseline: it stays blocked for everyone |
| Terrorist content | Illegal content duties on services | Official terrorist content list plus Prevent duty filtering | Keep the provider confirmation in your annual review record |
| Bullying and abuse | Moderation, reporting tools and safer design for children | Behaviour policy, monitoring and pastoral support | Teach pupils to use platform reporting tools |
| Contact from strangers | Safer default settings for children's accounts | Monitoring, education and DSL response | Talk about default settings in online safety lessons |
| VPN and workaround use | Not regulated as such | Block VPN and proxy categories on school systems | Age checks may raise interest in VPNs, so review this category |
For the school track in detail, read KCSIE filtering and monitoring explained and the DfE filtering and monitoring standards guide.
Practical implications of the Online Safety Act for schools
Even without new legal duties, the Act changes the landscape. These are the steps that most schools will find useful.
Review VPN and proxy filtering
Age checks on platforms give some young people a reason to look for ways round them. Check that VPN, proxy and anonymiser categories are blocked on school systems.
Add a VPN test to your next filter check.Update online safety lessons
Explain why platforms now ask for age checks, what safer defaults mean and how to report content. Pupils who understand the purpose are less likely to bypass it.
Add a session to RSHE or computing.Keep your filtering baseline
Do not relax school filtering because platforms are now regulated. The Act covers some services, not the whole web, and school filters protect on every site.
Note this decision in your annual review.Check your edtech suppliers
Apps with chat or sharing features may be in scope of the Act even if your school is not. Ask suppliers how they handle their duties.
Add a question to procurement checklists.Brief parents
Families have read about age checks and may assume the problem is solved. A short note explains what has changed and what still needs parental attention.
Include it in the next newsletter.Train staff on the new offences
Cyberflashing and encouraging self-harm are now specific offences. Staff should know when a pupil disclosure may involve a crime and how to pass it to the DSL.
Cover it in safeguarding updates.Update your online safety policy
Mention the Act briefly, so staff and parents understand where platform duties end and school duties begin.
One short paragraph is enough.Watch for AI tools
AI image and chat tools raise new risks, and how they fit the Act is still developing. Decide your own position on AI access at school.
Review the AI tools category in your filter.What the Online Safety Act means for each role in school
The same law lands differently depending on your job. A quick view for each of the key roles.
Headteachers and SLT
No new compliance burden. Make sure policies explain the Act in context and that filtering is not relaxed on the assumption platforms now handle everything.
Designated safeguarding leads
Know the new offences, and use the Act to support conversations with pupils and parents about reporting harmful content.
IT and network managers
Focus on workarounds. Test VPN and proxy blocks and confirm filtering on devices that leave site.
Governors and trustees
Ask how the school has responded, and expect to see the answer in the annual filtering and monitoring review.
Key Online Safety Act terms for school staff
The Act brings its own vocabulary. These short definitions, in our own words, help when reading news coverage or supplier updates.
User-to-user service
Any online service where people can share content that others see, such as social media, forums, video sharing or in-game chat.
Search service
A service that lets people search across many websites. These have their own set of duties under the Act.
Highly effective age assurance
Age checks strong enough to reliably tell whether a user is a child, such as photo ID matching or facial age estimation. Simple self-declaration does not count.
Likely to be accessed by children
The test that decides whether a service must follow the children's duties. Many general services meet it even if they are not aimed at children.
Risk assessment
A provider's own written review of how its service could expose users, and children in particular, to harm.
Categorised service
A larger or higher-risk service placed on Ofcom's register, which takes on extra duties beyond the baseline.
Online Safety Act myths heard in staff rooms
Coverage of the Act has been loud. These are the misunderstandings that come up most often in schools, with the reality alongside.
| What people say | The reality |
|---|---|
| "The internet is safe for children now." | The Act raises the bar for regulated services, but it cannot reach every site, and enforcement takes time. School filtering and education remain essential. |
| "Schools have to register with Ofcom." | Schools are not regulated for the services they run for education. Ofcom regulates online service providers. |
| "We can switch off our filter for older pupils." | KCSIE still expects appropriate filtering on school systems for all pupils. Settings can vary by age, but filtering stays. |
| "Age checks mean pupils cannot see adult content." | Checks apply on in-scope services. Pupils can still meet harmful content elsewhere or try to bypass checks with VPNs. |
| "The Act bans social media for under-16s." | It does not set a ban. It requires services to protect children who use them. Check the latest news, as policy debate continues. |
| "Ofcom will deal with our pupils' complaints." | Individual reports go to the platform first. Ofcom focuses on whether services have systems that work. |
When age checks push pupils toward VPNs
VPN / Proxy / Anonymizers is a category you switch on, so new bypass sites are blocked as we categorize them. Staff can use a PIN for adult research for 15, 30 or 60 minutes, and VPN / Proxy stays blocked even then.
The Act and web filtering products
School filters are not regulated services under the Act, but the risks the Act names map closely to filter categories. Products that serve UK schools benefit from category data that keeps pace.
Breadth
120 million categorised domains, with the top 20 million covering 99.99% of web traffic.
New domains daily
About 300,000 newly registered domains categorised each day, rechecked after a week and a month.
58 categories
Including Adult, Violence, Hate/Discrimination, VPN / Proxy / Anonymizers and AI / LLM Tools.
Vendors can read about the school web filtering category database or check a site with the domain category lookup.
What a school still has to arrange, and where our filter helps
The Act changes the platforms, so the rows below stay with the tasks that remain yours.
| School task | What the Act changes | Hosted CIPA filter |
|---|---|---|
| Blocking adult sites on school devices | Platforms must check ages, yet school devices still need a rule | Adult is on in the CIPA preset |
| Stopping VPN workarounds | Nothing about school networks | VPN / Proxy / Anonymizers blocked by category, even with a staff PIN |
| Public encrypted DNS | Not covered | Public encrypted DNS and browser settings that skip the filter blocked by default |
| Devices at home | Not covered | Private encrypted link keeps the same rules off the network |
| Evidence of what is blocked | Not a school duty under the Act | Activity reports, policy record and log export |
Online Safety Act explained: questions from schools
Quick answers. For legal advice on a specific case, speak to your trust or local authority.
Does the Online Safety Act apply to schools?
Schools are not its target. Services that education providers run for education are generally exempt, because schools already have safeguarding duties.
Does the Act replace school web filtering?
No. It places duties on platforms. Schools in England still need appropriate filtering and monitoring under KCSIE and the DfE standards.
Who enforces the Online Safety Act?
Ofcom. It writes codes, supervises services and can fine providers up to £18 million or 10% of qualifying worldwide revenue.
When did the children's safety duties start?
The children's codes came into force on 25 July 2025, after illegal content duties in March 2025. Further phases continue.
Do age checks change what schools need to do?
Not legally. In practice, they may push some pupils towards VPNs, so review VPN filtering and talk to pupils about why checks exist.
Can a school report a platform to Ofcom?
Ofcom does not usually handle individual complaints about content. Report content to the platform first. Serious harm or crimes go to police or the relevant helpline.
Does the Act cover private messaging?
Messaging services are user-to-user services and can be in scope. How specific duties apply to private and encrypted messages is set out in Ofcom codes, so check current guidance.
Does the Act apply in Scotland, Wales and Northern Ireland?
Yes, it is UK-wide law for online services. School safeguarding guidance, however, differs by nation, so the school track varies.
Should the Act appear in our annual filtering review?
Yes, briefly. Note any changes you made in response, such as tighter VPN blocking or new lessons, and record that school filtering settings were kept rather than relaxed. Governors can then see the reasoning at a glance.
Does the Act affect the learning platforms we use?
Platforms a school runs itself for education are generally exempt. Third-party products with chat or sharing features may have their own duties, so ask suppliers how they meet them.
We quote by the number of schools and devices, and the answer arrives within one business day. A pilot on one school is a way to watch the blocks and reports at work before you decide.
Is your filtering ready for the post-Act web?
Talk to us about your school or trust. We can walk through category coverage for VPNs, adult content, self-harm and AI tools.
This page is general information, not legal advice. The Online Safety Act is being implemented in phases, so check Ofcom's current codes and the latest DfE guidance.