Three years on from the Online Safety Act: lawfare and the need for robust enforcement 

Today marks the three-year anniversary of the UK’s Online Safety Act receiving Royal Assent. How have things changed for children In the UK?  

Three years after the Online Safety Act (OSA) became law, and more than a year since Ofcom’s Protection of Children Codes came into force, the UK has an important opportunity to assess whether children are safer online and what is still missing to ensure the digital environment is safe for all children. 

 As we have always argued, children’s experiences are an important test of whether online safety measures are working. Internet Matters report that 68% of children have noticed an increase in safety features like reporting tools and content filters. Similarly, research from the Digital Futures for Children Centre shows that Meta, Google, TikTok, and Snapchat introduced a total of 45 child safety and privacy changes between 2024 and 2026 across the UK and EU.  

This evidence indicate the positive impact of regulation. Yet according to Ofcom, there was no significant change in the proportion of children encountering harmful content online in the nine months following the introduction of the Protection of Children duties in July 2025. 

This is a stark reminder that a regulatory framework, however good, is only as effective as its enforcement. The public agrees. New YouGov polling for the Online Safety Network finds that 78% of UK adults are not confident that online safety laws are being properly enforced, and 74% believe Ofcom should take enforcement action within a week or faster when platforms break the law.  

Tech companies ‘lawfare’

While the public is calling for faster enforcement, it is increasingly apparent that tech companies are exploiting legal challenges to slow it down. Companies have the right to challenge regulatory decisions, but when litigation delays the implementation of legal duties, it is children who risk losing out. 

Ofcom’s ongoing disputes with Meta, TikTok and X illustrate the challenge. Just two weeks ago, 5Rights intervened in support of Ofcom in Meta’s High Court judicial review concerning the calculation of fees and penalties under the OSA. We argued that penalties must be meaningful enough to deter non-compliance. 

What must happen next

Irrespective of the judicial review’s outcome, Ofcom needs to be emboldened. The OSA will only deliver on its promise if it is robustly enforced, with the Government providing the regulator with clear backing to use its powers and hold platforms to account. 

But enforcement alone is not enough. Polling shows that 79% of UK adults support the Government introducing stricter online safety rules for technology companies. The Online Safety Network’s 10-point plan, which 5Rights has endorsed, sets out targeted changes to strengthen the OSA, such as removing the safe harbour provision, introducing a statutory Safety by Design Code of Practice, strengthening Ofcom’s codes and enforcement powers, and ensuring AI chatbots are properly covered by the regulatory framework. By implementing this plan, the Government would deliver on Parliament’s original intent to hold tech companies accountable for unsafe and untested products and services.  

Beyond responding to harm after it occurs, the Government must prevent such products from reaching children. 5Rights is calling for a pre-certification system, requiring digital products and services intended for children to demonstrate that they meet robust safety standards before reaching the market. Children should not have to bear the risks of products that have not been designed with their rights and safety in mind. 

Three years on, the OSA remains a landmark achievement, but its success will be measured not by the legislation itself but by whether it delivers a safer digital environment for children.