The Online Safety Act is one layer of a family safety plan
The 2023 Act places legal duties on social media companies and search services, while Ofcom is the online safety regulator and is implementing the legislation in phases. That gives covered online services responsibilities for reducing certain risks and protecting users, including children.
For your family, the practical answer is a division of responsibility. Online services must meet the duties that apply to them; Ofcom oversees the regulatory framework; you still decide which apps, accounts, devices and home controls fit your child. Your child also needs support to use safety settings and talk about problems. Treat the legislation as one layer of a wider plan, not as a promise that every online experience will be safe.
This distinction matters whether your family lives in a town, a city or a rural part of England. Legal duties sit with covered services, while practical choices sit across the platforms, devices and connection your child uses. You can therefore ask two separate questions: what should the relevant service do, and what does your household still need to manage?
What the Online Safety Act is designed to do
The 2023 Act is UK legislation that protects children and adults online by placing new legal duties on social media companies and search services. In practical terms, those duties require relevant providers to consider how their services can be used, put systems and processes in place to reduce risks linked to illegal activity, and take down illegal content when it appears.
The Act is therefore aimed primarily at the design, operation and governance of covered online services. The legal duties apply according to the service and its position within the regulatory framework, so a headline about the Act cannot by itself settle how one platform or one child’s account is treated.
When you read about the Act, separate three questions:
- Which type of online service is being discussed?
- Which duty or child-safety measure is being described?
- Which part of your family’s setup still needs a separate decision?
That separation keeps the legal purpose clear.
The legislation also works through processes rather than a single switch labelled safe. Services may have to assess risks, put relevant systems in place and provide ways to address problems. Ofcom’s phased implementation means that the detail attached to a particular service or duty can change over time, so keep a general explanation separate from a question about a specific platform.
The child-safety risks the Act addresses
The Act’s child-safety measures address harmful and age-inappropriate content, relevant age limits and age-checking measures, transparency about risks, and ways for parents and children to report problems. Those categories cover more than a single type of content. They reflect the fact that children can encounter material or interactions that are unsuitable for their age in different parts of an online service.
The child-safety measures include:
- Preventing children from accessing harmful and age-inappropriate content.
- Enforcing relevant age limits and using age-checking measures where they apply.
- Giving parents and children clearer ways to report problems.
- Improving transparency about the risks that services pose to children.
These measures concern how regulated services reduce and manage risks. They do not mean that you can hand responsibility for every conversation, account or device to a platform.
For your household, the useful question is not whether the Act names every situation your child might face. Ask instead which risks are addressed by the service, which settings you can control, and what your child needs to know before using the service. An age check or reporting route can form part of that arrangement, while regular conversations and device settings remain separate family tasks.
A service measure and a family safeguard also operate at different points. A reporting route matters after a problem needs to be raised; an age requirement matters before access is treated as appropriate; a device or account setting matters when your child is using that particular route. Map the measure to the situation rather than assuming that one control covers every service your child can reach.
What covered services may need to assess and change
All user-to-user services and search services regulated under the Act must carry out a children’s access assessment. The statutory child-protection duties apply to regulated user-to-user services that are likely to be accessed by children. The question of whether children may use a service is therefore part of the regulatory route, rather than a decision you can settle from a service’s marketing description alone.
Where the relevant duties apply, regulated services must also carry out a children’s risk assessment and comply with related record-keeping, safety and child-protection duties. These requirements put structured work on the service. They do not tell you that one child’s experience will match another’s, or that your family can stop checking settings after a service has completed an assessment.
Use this distinction when you encounter a statement about compliance:
- A regulated service may have an assessment duty under the Act.
- The service may have further safety and record-keeping duties where applicable.
- The service’s duties do not remove the need for your own age, account and device decisions.
Do not turn a general description of an assessment into a conclusion that a particular platform complies in every respect or that your child is protected from every risk.
An assessment is part of how a regulated service identifies and manages its responsibilities. It is not the same as a setting on your child’s phone, and it does not give you a way to inspect or change the service’s internal decisions. For your purposes, the useful response is to identify the service, understand the household settings available to you and keep a route open for reporting problems.
Who is responsible for what
Regulated online services are responsible for carrying out the assessments and meeting the safety, record-keeping and child-protection duties that apply to them. The Act also requires providers to use systems and processes intended to reduce risks linked to illegal activity and to take down illegal content when it appears. Those are service-level responsibilities, not tasks you can perform through a home router.
Ofcom is the online safety regulator under the Act and is implementing the legislation in phases.
Parents and children have a different, everyday role. You can support your child in managing safety and wellbeing settings across devices and accounts, while your child can take part in understanding those settings and telling you when something feels wrong. NSPCC advice also recommends keeping online-safety conversations regular. That gives your family a routine for discussing changes rather than treating one setup session as permanent.
Use this simple boundary:
- Services manage their regulated duties.
- Ofcom manages the regulatory role and phased implementation.
- You manage household choices, settings and conversations.
- Your child needs age-appropriate support to use the services and settings involved.
Keeping those roles separate helps you act on the part you can control without claiming that a family safeguard changes a platform’s legal position.
The same division applies if your home has several children, a shared connection or a mobile connection that is used away from home. The service’s legal duties do not organise your household, and your household settings do not determine the service’s legal duties. Review each child’s actual devices and accounts, including the routes used outside the home.
What the Act does not guarantee for a child’s online experience
The duties apply to regulated services and include risk assessments, access measures, reporting routes and other safety duties; they are not a promise about every post, message, search result, account or device.
The child-protection duties also depend on the scope of the regulated service and whether it is likely to be accessed by children. A service-level measure may address a particular risk without covering every route through which your child uses the internet. Age checks can be relevant without answering whether a particular conversation is suitable for your child, and a reporting route can help when a problem arises without preventing the problem from occurring.
Your household therefore still needs a practical safety plan. Check the ages attached to the services your child wants to use, review settings across devices and accounts, and keep talking about online experiences. The point is not to promise complete control. It is to make the separate layers visible so you can decide what needs attention.
Keep these boundaries in view:
- A service duty is not a substitute for checking whether an app, site or game is suitable for your child’s age.
- A platform setting is not a substitute for a device setting or a household conversation.
- A broadband control is not a substitute for the safeguards attached to an individual account or service.
- A reporting route is not a promise that a problem will never occur.
These boundaries do not make the measures pointless. They show you where each measure fits.
Start with your child’s age, services and devices
Your child’s age and the service they want to use should be the starting point for a household review.
Your child’s devices and accounts need separate attention because safety and wellbeing settings may be distributed across them. Work through the services your child actually uses, then identify the account and device where each setting is managed. Support your child in understanding the choices rather than presenting every control as a hidden restriction.
Start with this short sequence:
- List the apps, sites and games your child wants to use.
- Check the age requirement for each one.
- Identify the account and device connected to each service.
- Review the available safety and wellbeing settings with your child.
- Record any setting that needs a separate conversation or decision.
If a service’s age requirement does not fit your child’s age, pause that decision rather than relying on a filter to make the service appropriate.
A simple map can prevent the same control being assumed to apply everywhere. For each service, note the child’s account, the device used, the relevant setting and the adult who will help manage it. If a service is used on a phone, tablet and computer, check each route rather than treating the first device you review as the whole arrangement.
Combine platform controls with regular conversations
Regular online-safety conversations give your child a place to discuss settings, contacts, content and mistakes. NSPCC advice recommends keeping these conversations regular and supporting your child with safety and wellbeing settings across devices and accounts. That approach keeps the technical control and the family understanding connected.
A useful conversation can cover:
- Which services your child is using and what each age requirement means.
- Which safety or wellbeing settings your child can see and change.
- How your child would tell you about unwanted contact or harmful content.
- Where the service provides a reporting route.
- Which situations need an immediate conversation rather than a silent settings change.
You do not need to wait for a serious incident before raising these subjects. Keep the discussion proportionate to your child’s age and the services involved, then return to it as their use changes.
Platform controls and family conversations perform different jobs. A setting can change access or visibility within a service, while a conversation helps your child understand what to do when a situation falls outside that setting. Keep both in the plan, and use the service’s reporting route when a problem needs to be reported.
Keep the routine ordinary enough to continue. You might discuss a new app when your child asks to use it, revisit settings after a device change and ask what has felt comfortable or difficult. The aim is to give your child a regular way to raise concerns, not to make one conversation carry the whole responsibility.
Add mobile and device safeguards where they fit
Your child’s smartphone can need a separate check from the family broadband connection. If your child has their own smartphone, NSPCC advice recommends contacting the service provider to ask whether it can be registered as a child’s device so additional safety restrictions can be put in place.
The action here is a question, not an assumption that every provider offers the same arrangement. Ask whether the phone can be registered as a child’s device, what restrictions that status applies and which settings you would still need to manage on the phone or in the child’s accounts. Keep the answer alongside your other household checks.
A mobile-device setting remains separate from the Act’s duties on regulated online services. Use it as one practical household layer, then continue with age checks, account settings and regular conversations.
Pay attention to where the phone is being used. A home connection and a mobile connection may be separate routes, while the child’s account and device settings follow the child. That is why a home control should be treated as one part of the arrangement rather than as the only place to review access.
Where safer home broadband can add another layer
Safer home broadband can add an optional household layer alongside platform, account and device controls. At Gigabit IQ, we offer FamilyGuard+ parental controls that let parents control their children’s internet access, block risky websites and set screen-time limits.
The value of a broadband-level option depends on the task you want it to handle. Before choosing one, identify whether you need to manage access to websites, set a time boundary, receive an alert or apply a control to a specific app. A home control can sit beside service and device settings; it should not be treated as a replacement for either.
Use these questions to decide whether another home layer fits:
- Which child, device or account needs the extra control?
- Is the concern website access, app access, screen time or a web threat alert?
- Have you already checked the platform’s own settings?
- Does your child understand what the control does and how to raise a concern?
- Which settings will you revisit as your child’s use changes?
The answers should determine the feature you need, rather than the presence of a legal headline.
The practical benefit of separating the layers is clarity. The Act concerns duties on covered services; platform controls concern the child’s use of a particular service; device settings concern a particular device or account; home controls concern the internet access managed within your household. Decide which layer matches the problem before adding another setting.
What FamilyGuard+ can and cannot contribute
FamilyGuard+ is our optional parental-control layer for home internet access. We offer FamilyGuard+ parental controls that let parents block risky websites and set screen-time limits. FamilyGuard+ also sends instant alerts about parental-control breach attempts or web threats.
FamilyGuard+ provides several types of control that you can consider separately:
- Website controls for risky websites.
- Screen-time limits for children’s internet access.
- YouTube and Google SafeSearch settings to prevent exposure to inappropriate content.
- Blocking for specific apps, including social media platforms.
- Instant alerts about parental-control breach attempts or web threats.
Choose only the controls that match the concern you have identified. A longer feature list does not remove the need to decide which settings are suitable for your child.
FamilyGuard+ does not become a requirement because the Act places duties on regulated online services, and it does not replace the platform, device and family measures described above. Keep checking age requirements, support your child with account settings and maintain regular conversations. Use FamilyGuard+ as an optional home control where its stated features match the household task you want to manage.
Match the feature to the decision in front of you. If the concern is a risky website, website blocking may be the relevant feature; if the concern is timing, a screen-time limit may be relevant; if the concern is a specific app, app blocking may be the relevant option. You still need to review the child’s account and device settings because the home control and the individual service do different jobs.
Build a simple family online-safety review
A family online-safety review works best when it turns a broad concern into a short list of decisions. Use the following sequence for the services, devices and home controls that apply to your child.
-
- Map the access points. List the child’s phones, tablets, computers, accounts and the services used on each one.
- Review platform and device settings. Support your child in managing safety and wellbeing settings across devices and accounts.
- Ask about the mobile device. If your child has their own smartphone, ask the service provider whether it can be registered as a child’s device so additional restrictions can be put in place.
- Choose any home control deliberately. Decide whether website blocking, app blocking, screen-time limits, SafeSearch settings or alerts address a specific household need.
- Explain the arrangement. Tell your child what each setting does, what it does not do and how they can raise a concern.
- Keep the conversation regular. Return to the setup when your child’s services, devices or online experiences change.
Keep a simple record of the decisions you have made: the service, the device, the setting and the reason for using it. Add a note about which household control you chose, if any. This gives you something concrete to revisit with your child instead of relying on memory or assuming that one setting applies everywhere.
The review is a household aid, not a compliance test for an online service and not a guarantee of a risk-free experience. Use it to identify your next practical action, then keep the legal duties of covered services separate from the choices your family makes.
Revisit the record when your child starts using a new service, receives a new device or needs a different time arrangement. Check whether the control still matches the concern, whether your child understands it and whether another access route needs attention. A short review is more useful when it follows the changes in your household.
Keep changing legal information separate from household choices
As at 5 November 2026, the regulatory material describes Ofcom as implementing the legislation in phases. It also describes children’s access assessments for regulated user-to-user services and search services, with further children’s risk assessment, record-keeping, safety and child-protection duties where applicable. Treat those details as time-sensitive rather than as a permanent description of every future stage.
A changing regulatory position and a household broadband decision answer different questions. The first concerns what a covered service or regulator must do. The second concerns which apps, accounts, devices, conversations and optional home controls you want to manage. Do not use a broadband feature to infer that a service has met its duties, and do not use a platform announcement to assume that your household settings are complete.
When a legal detail affects a decision you need to make, use the current legislation and regulatory guidance for that detail. Keep this article’s practical framework separate from any question about how the law applies to a particular service, account or dispute.
Avoid carrying a general statement forward as though it were an individual legal assessment. Whether a duty applies can depend on the type of service and the relevant regulatory conditions. If your question concerns a specific service, account or legal position, treat that as a separate matter from choosing sensible household safeguards.
Choose the next practical safety layer for your family
The Act gives regulated online services duties and gives Ofcom a regulatory role, but it does not make a family safe by itself. Your next step is to match the child’s age and services with the right combination of age checks, account and device settings, regular conversations and optional home controls. For an individual legal interpretation, speak to a qualified legal professional. If an additional household layer fits your needs, our stated FamilyGuard+ features give you specific controls to consider rather than a promise of complete protection.
Start with one clear action: check the age requirements for the services your child uses, then review the relevant settings with your child. If you need website blocking, app blocking, screen-time limits, SafeSearch settings or alerts, compare that need with the available home-control features and keep the platform and device checks in place.
What should families check before choosing an extra online-safety layer?
What is the Online Safety Act 2023?
It is UK legislation that places legal duties on covered social media, user-to-user and search services to reduce certain risks, address illegal content and protect children through measures such as age-related safeguards, risk assessments and reporting routes. Ofcom is the regulator, and implementation is phased.
Does the Online Safety Act require families to use parental controls or safer broadband?
No. Families can still choose platform, account, device and home-network controls that match their child’s needs.
What should parents check alongside online-safety rules?
Check the age requirements for each app, site or game, review safety settings on the relevant accounts and devices, and keep online-safety conversations regular. If your child uses a smartphone, ask its service provider whether it can be registered as a child’s device and what restrictions that would add.
Do home broadband controls protect children when they use mobile data?
A home broadband control applies to the access route and devices it covers, so it should not be assumed to manage a child’s separate mobile connection. Review the phone, its accounts and service settings as separate layers, while continuing to use age checks and family conversations.
How current is the implementation of the Online Safety Act?
As at 5 November 2026, Ofcom’s implementation remains phased. Requirements can depend on the type of regulated service and the applicable regulatory conditions, so a general explanation should not be treated as a current legal assessment of a particular platform or account.
