The UK Online Safety Act: What It Means If You’re Harmed Online

The Online Safety Act 2023 is a UK law that puts legal duties on social media sites, search engines and other online services to tackle illegal content and protect children, with Ofcom as the regulator. For victims, it means platforms must offer easy ways to report harmful content and complain, and it created new criminal offenses such as sharing intimate images without consent, cyberflashing, and sending false or threatening communications.

This guide explains what the Online Safety Act does and doesn’t do if you’re being targeted online, and how to use it in practice. It’s general information, not legal advice. If you’re considering legal action, talk to a UK solicitor.

What the Online Safety Act is

The Act became law in October 2023. Rather than banning particular posts, most of it works by making online services responsible for their systems: how they assess risk, how they find and remove illegal content, and how they respond when users report problems.

It applies to two broad kinds of service that have links with the UK:

• User-to-user services, where people can post or share content others see: social media, forums, video sites, messaging features, dating apps and online games.
• Search services, such as search engines.

Ofcom, the UK communications regulator, enforces the Act. It writes codes of practice that set out how services can meet their duties, and it can investigate and fine services that fall short. The duties are being phased in: the illegal content duties took effect in 2025, followed by the child safety duties, with further duties for the largest services coming later.

What platforms now have to do

The duties that matter most to people being harmed online are these.

Duty	What it means for you
Illegal content	Services must assess the risk of illegal content, take proportionate steps to reduce it, and remove illegal content quickly once they become aware of it. This includes threats, harassment, stalking, intimate image abuse, fraud and child sexual abuse material.
Reporting	Services must offer easy-to-find, easy-to-use ways to report illegal content and, where relevant, content harmful to children.
Complaints	Services must run a complaints process, including for people who think the service failed to act on a report, or who think their own content was wrongly removed.
Children’s safety	Services likely to be used by children must protect them from harmful content, including through age checks for the most harmful categories, such as pornography.
Terms of service	Services must explain in their terms how they protect users, and apply those terms consistently.

In short, “we didn’t see it” is a weaker answer than it used to be. Once you report illegal content through the platform’s tools, the service is expected to act on it.

The new criminal offenses

The Act also changed the criminal law, mostly in England and Wales. These offenses apply to the people who post or send the content, not to platforms.

• Sharing intimate images without consent. It’s now an offense to share, or threaten to share, an intimate image of someone without their consent. You no longer have to prove the person meant to cause distress, and the offense covers images that have been digitally altered or created, including deepfakes.
• Cyberflashing. Sending an unsolicited image of genitals to cause alarm, distress or humiliation, or for sexual gratification, is an offense. Our cyberflashing guide explains how to report it.
• False communications. Sending a message you know is false, intending to cause non-trivial psychological or physical harm, without a reasonable excuse.
• Threatening communications. Sending a message that threatens death, serious harm or serious sexual assault, intending the person to fear the threat will be carried out, or being reckless as to that.
• Encouraging serious self-harm, and sending flashing images intended to harm people with epilepsy.

Scotland and Northern Ireland have their own laws on some of these, so the exact offense depends on where you are. If you’re in Scotland, Police Scotland can advise.

How to use the Online Safety Act if you’re being harmed online

The Act doesn’t give you a new court to go to or a single government form. It works through the platforms’ own systems, backed by Ofcom. Here’s the practical order.

1. Make sure you’re safe. If there are threats to your safety, contact the police first.
2. Save evidence before you report. Screenshot the posts, profiles and messages with dates, and copy the web addresses. Don’t screenshot or save sexual images of anyone under 18; report the link instead.
3. Report the content on the platform. Use its report button or reporting form and pick the closest category, such as harassment, threats, non-consensual intimate images or impersonation. Say plainly if you think it’s illegal and why.
4. Use the complaints route if nothing happens. If the platform doesn’t act, or its response doesn’t deal with your report, look for its complaints process. Keep a record of what you reported, when, and any reference numbers.
5. Report crimes to the police. Threats, stalking, intimate image abuse and cyberflashing are crimes. In England and Wales, contact your local police on 101, or 999 in an emergency.
6. Get specialist help for intimate images. The Revenge Porn Helpline can advise adults and help with removals, and the StopNCII.org tool it runs can help stop images being re-uploaded to participating platforms. Our guide on removing intimate images shared without consent covers each step.

For content that isn’t illegal but is harmful, such as bullying that falls short of a crime, your main tool is still the platform’s own rules. The Act requires services to apply their terms consistently, so quote the rule the content breaks.

What Ofcom can and can’t do for you

This is the part people most often misunderstand. Ofcom regulates the systems platforms use; it doesn’t handle individual complaints about specific posts, and it can’t order a particular piece of content to be taken down on your behalf.

You can still tell Ofcom about a platform that you think isn’t meeting its duties, for example one with no working report button or one that ignores reports of illegal content. Ofcom uses this information to decide where to look, and it can investigate services and impose significant fines. Just don’t expect a personal resolution from it.

For a specific post, your routes are the platform, the police, specialist services such as the Revenge Porn Helpline or Report Harmful Content, and, where relevant, the courts.

A worked example

This is an illustrative scenario, not a real client. Hannah, 29, in Bristol, finds that an ex-partner has posted an altered intimate image of her on a forum and sent it to two friends. She’s frightened and doesn’t know where to start.

1. She saves the forum address, screenshots the post and the messages her friends received, and writes down dates.
2. She calls the Revenge Porn Helpline, which explains her options and helps her report the image to the forum. She also uses StopNCII.org to create a hash of the image so participating platforms can block copies.
3. She reports the post on the forum as non-consensual intimate imagery. The forum’s first response is automated, so she uses its complaints process, citing the report reference.
4. She reports her ex-partner to the police. Because the image is a deepfake and was shared without her consent, it can fall within the offense the Act created.
5. The post comes down after her complaint. She sets up a name alert and checks search results a few weeks later.

The Act didn’t remove the image by itself, but it gave her report weight and meant the altered image was clearly covered by the criminal law.

What the Online Safety Act doesn’t cover

• Defamation. False statements that damage your reputation are mainly a civil matter under defamation law. Our guide to UK defamation law explains that route.
• Your personal data. If a site is publishing your personal information, data protection law may help. See our guides to the UK GDPR and making an ICO complaint.
• Negative but lawful reviews and opinions. The Act doesn’t require platforms to remove criticism that’s legal and within their rules.
• Private messages in every case. Some duties apply differently to private messaging, so report messages to the platform and to police where there’s a crime.
• Fraud losses. Scams are covered by the illegal content duties, but getting money back is a matter for your bank. Our guides on reporting to Report Fraud (formerly Action Fraud) and how to report a scammer cover that.

Common mistakes

• Complaining to Ofcom instead of reporting to the platform. Ofcom can’t act on an individual post. Report to the service first and keep a record.
• Reporting without saving evidence. Content can disappear, and so can your proof. Save it first, except sexual images of minors, which you should only report.
• Picking a vague report category. “I don’t like it” is easy to dismiss. “This is a threat” or “this is an intimate image shared without my consent” is not.
• Replying to or confronting the person. It can escalate things and muddy the evidence.
• Assuming everything upsetting is illegal. Much harmful content isn’t a crime. It may still break the platform’s rules, which is often a faster route.

When to get help

Talk to a solicitor if you want to sue someone, need an injunction, or are dealing with a defamation or privacy claim. Our guide on how to find a defamation lawyer in the UK explains how to choose one. For content that keeps spreading across sites or shows up when people search your name, our content removal team can help assess what can realistically be taken down and what can’t. We won’t promise removal, because no one honestly can.

Frequently asked questions

What is the Online Safety Act in simple terms?

It’s a UK law from 2023 that makes social media sites, search engines and other online services responsible for dealing with illegal content and protecting children. Ofcom enforces it. It also created new criminal offenses, including sharing intimate images without consent and cyberflashing.

Can I complain to Ofcom about a post?

Ofcom doesn’t resolve individual complaints about specific content or order single posts to be removed. You can tell Ofcom if you think a service is failing its duties, but for a specific post, report it to the platform, use its complaints process and contact the police if it’s a crime.

Does the Online Safety Act cover deepfakes?

Yes, in part. The offense of sharing intimate images without consent covers images that have been digitally created or altered, including deepfakes, in England and Wales. Platforms must also deal with this kind of illegal content when it’s reported.

Does the Online Safety Act apply in Scotland and Northern Ireland?

The platform duties and Ofcom’s role apply across the UK. Some of the new criminal offenses apply only in England and Wales, because Scotland and Northern Ireland have their own laws on some of these areas. Local police can tell you which law applies.