{"id":26543,"date":"2025-09-15T09:26:13","date_gmt":"2025-09-15T09:26:13","guid":{"rendered":"https:\/\/www.complycube.com\/?p=26543"},"modified":"2025-09-08T11:08:05","modified_gmt":"2025-09-08T11:08:05","slug":"online-safety-act-2023-what-you-need-to-know","status":"publish","type":"post","link":"https:\/\/www.complycube.com\/en\/online-safety-act-2023-what-you-need-to-know\/","title":{"rendered":"Online Safety Act 2023 vs. EU DSA: What You Need to Know"},"content":{"rendered":"
\n

TL;DR: <\/strong>The UK’s Online Safety Act 2023 and EU’s Digital Services Act now pose a serious challenge<\/strong> to businesses with a lack of multilayered<\/strong> age verification checks. While digital service act and online safety act compliance aims to protect children<\/strong> from harmful and illicit content, they both have key differences<\/strong> that are crucial for businesses to maintain compliance.\u00a0<\/p>\n<\/div>\n\n\n

How the Online Safety Act and the Digital Safety Act Protects Users<\/h2>\n\n\n\n

As digital markets evolve rapidly, the need to protect users from harmful content and illegal online activity continues to grow. The Online Safety Act 2023 and the Digital Services Act set out landmark rules to create a safer environment across platforms, social media, and digital services that host user-generated content.<\/p>\n\n\n\n

\"Age<\/figure>\n\n\n\n

The OSA<\/a> places an emphasis on safeguarding fundamental rights for children. By requiring online platforms to proactively tackle harmful activities and implementing age verification tools, online safety act compliance prioritizes removing illegal content and giving users more control over the content they encounter. Online safety act compliance also introduces criminal charges to address online abuse and dangerous stunts.<\/p>\n\n\n\n

In contrast, the DSA impacts all online platforms operating within the European Union, including Very Large Online Platforms (VLOPs) and large online search engines. The DSA sets out rules for these digital platforms, requiring them to publish annual reports with online safety compliance related information. They must disclose how their algorithms operate and provide explanations for content removal decisions.<\/p>\n\n\n\n

Scope and Jurisdiction of the Online Safety Act 2023 and Digital Services Act<\/h2>\n\n\n\n

The Online Safety Act and the Digital Services Act approach regulation differently with online safety and age verification<\/a>. In terms of sectoral scope, they both apply to online instant messaging services, social media companies, and online forums that enable user-generated content, regardless of the provider\u2019s geographic location. The key factor lies in the service’s target market being users in the United Kingdom or the European Union.<\/p>\n\n\n\n

Companies operating digital services may be subject to both regulatory frameworks, even if they are based outside these regions. Covered services include a significant number of search services, social media platforms, video-sharing services, file-sharing tools, online messaging and forums, dating services, search engines, and cloud hosting providers.<\/p>\n\n\n\n

The OSA enforces a UK-focused, rules-based compliance model, while the DSA adopts a layered, risk-based approach tailored to each platform\u2019s scale and function. Despite these differences, both frameworks apply to digital services that host user content in\u2014or target\u2014the UK or EU. As a result, companies must comply regardless of where their headquarters are located.<\/p>\n\n\n\n

Age Verification Obligations For Online Platforms with the Online Safety Act 2023 and Digital Services Act<\/h2>\n\n\n\n

The Online Safety Act 2023 requires platforms to implement \u201chighly effective\u201d age verification mechanisms<\/a>, particularly for pornography and content that could harm minors. This obligation extends to legal content when it presents identifiable risks to children. The OSA mandates that platforms establish and enforce clear age restrictions to prevent underage access.<\/p>\n\n\n\n

Approved verification methods include government-issued ID checks, biometric authentication, AI-powered facial age estimation, and systems resistant to circumvention tactics such as VPN use. For example, if a user tries to hide their location using a VPN, ComplyCube can detect and flag the session as part of a biometric authentication check<\/a>, preventing the user from continuing until they have verified their age.<\/p>\n\n\n\n

\"UK\u2019s<\/figure>\n\n\n\n

In contrast, the Digital Services Act (DSA) calls for \u201cappropriate and proportionate<\/a>\u201d measures. It offers more flexibility depending on the platform\u2019s size, reach, and risk profile. Although less prescriptive than the OSA, the DSA still obliges platforms to demonstrate the effectiveness of their age verification processes. This is prevalent especially where minors may be exposed to harmful content.<\/p>\n\n\n\n

Regulatory enforcement under the DSA needs a clear justification of how protective measures are applied in practice. Despite their differences, both acts share a common objective. They safeguard children online through enforceable age limits and clear accountability standards. Learn more here about identity fraud in the UK: The Price of Identity Fraud in the UK<\/a>.<\/p>\n\n\n\n

Transparency and Reporting Duties for the Online Safety Act 2023 and Digital Services Act<\/h2>\n\n\n\n

Both the Online Safety Act 2023 and the Digital Services Act require platforms to publish annual transparency reports. The first set was due by July 2025. These reports must cover takedown requests, moderation metrics, and broader risk mitigation efforts.<\/p>\n\n\n\n

While the DSA focuses on reducing systemic risks through flexible, risk-based obligations, the OSA enforces stricter operational compliance aligned with Ofcom-approved<\/a> standards. Together, the laws aim to enhance accountability and ensure child safety across digital platforms through regular, verifiable disclosures.<\/p>\n\n\n\n

Illegal Content and Platform Liability for the Online Safety Act 2023 and Digital Services Act<\/h2>\n\n\n\n

The OSA requires platforms to proactively address illegal and harmful content, with specific illegal content duties to prevent illegal harms. Regulations include fines up to 10% of global turnover, blocking orders for persistent breaches, prioritizes child safety by reducing content around self-harm and child sexual abuse material (CSAM), and encouraging or assisting serious self-harm.<\/p>\n\n\n\n

It highlights what is now classified as illegal content and a criminal offence. Enforcement actions are triggered when there is a material risk of significant harm to UK users. The DSA regulations include fines up to 6% of global turnover<\/a>. It needs management by national authorities with European Commission (EC) oversight, and focus on very large online platforms (VLOPs) as well as algorithmic accountability.<\/p>\n\n\n

\n

Case Study: TikTok Under DSA Enforcement (2024)<\/strong><\/h3>\n
Overview<\/strong><\/h5>\n

In February 2024, the European Commission opened an investigation into TikTok for suspected violations of the Digital Services Act (DSA). The inquiry targeted key areas, including child protection, advertising transparency, T hiand risk management around potentially addictive platform design.<\/p>\n

Particular focus was paid to the effectiveness of TikTok\u2019s age verification systems and whether it could protect minors from dangerous content. The platform\u2019s structure and its contribution to addictive user behavior were also investigated.<\/p>\n

Actions and Response<\/strong><\/h5>\n

The European Commission\u2019s investigation into TikTok focused on three critical areas. It looks at child safety mechanisms, transparency in advertising practices, and the platform\u2019s data access policies. Central to the inquiry was the algorithmic design of TikTok\u2019s systems and their potential role in promoting harmful behaviors.<\/p>\n

Resolution<\/strong><\/h5>\n

By August 2024, the European Union Commission published a press release about TikTok agreeing to remove the “TikTok Lite” rewards feature<\/strong><\/a>. This feature had come under scrutiny for its addictive design, which affected children’s user experience. This case underscores how DSA enforcement is not purely reactive. Regulators are now shaping platform design and safeguarding fundamental rights, especially in critical areas such as youth engagement and algorithmic risk.<\/p>\n<\/div>\n\n\n

Advertising and Content Profiling Controls for Children Online<\/h2>\n\n\n\n

The Digital Services Act (DSA) explicitly prohibits behavioural targeting of minors. This includes profiling-based advertising and the use of dark pattern user interfaces within content recommendation systems. These new rules aim to reduce manipulative practices that disproportionately affect children on the internet.<\/p>\n\n\n\n

While the Online Safety Act 2023 does not directly govern ad targeting, it imposes new obligations to prevent children from encountering harmful commercial content, particularly on search engines. Together, these frameworks signal a tightening regulatory stance on digital platforms\u2019 responsibility toward young users.<\/p>\n\n\n\n

More Control with Technical and Ethical Implementation Standards<\/h2>\n\n\n\n

To comply with both the Online Safety Act 2023 and the Digital Services Act, platforms are required to minimise data collection in line with GDPR. They must avoid storing sensitive age-related information, and maintain transparency around their age verification processes. Additionally, they must also implement safeguards against re-identification risks and use secure integration methods such as SDKs<\/a> or no-code modules.<\/p>\n\n\n\n

\"How<\/figure>\n\n\n\n

ComplyCube\u2019s platform supports these requirements through on-device verification, biometric liveness detection, and NFC chip reading<\/a>. With cross-device recognition, they can deliver both prescriptive compliance and adaptable implementation at scale.<\/p>\n\n\n\n

Governance, Risk Mitigation, and Senior Accountability<\/h2>\n\n\n\n

Under both the Online Safety Act 2023 and the Digital Services Act, platforms are obligated to perform regular risk assessments and actively mitigate any material risks to users, particularly children. These assessments must address exposure to content such as pornography, self-harm, or eating disorders, as well as systemic abuse risks arising from user-generated content.<\/p>\n\n\n\n

Additionally, platforms must evaluate the impact of their advertising and recommendation systems on minors. The OSA requires the appointment of compliance officers and the maintenance of audit-ready records, while the DSA mandates robust content governance policies and internal audits for Very Large Online Platforms (VLOPs).<\/p>\n\n\n\n

How OSA and DSA Impact SMEs and Niche Platforms<\/h2>\n\n\n\n

There is a common misconception that smaller platforms are exempt from regulatory obligations. In fact, the Online Safety Act 2023 applies based on the nature of content risk and accessibility, not the size of the platform. While the Digital Services Act provides procedural relief for small and medium-sized enterprises (SMEs) with fewer than 50 employees or under \u20ac10 million in annual turnover, it does not waive core responsibilities. All platforms, regardless of scale, are required to implement proportionate safety measures if their services are likely to be accessed by children.<\/p>\n\n\n\n

Integration with Other New Data Protection Rules<\/h2>\n\n\n\n

Age verification requirements intersect with several key regulatory frameworks. Under the General Data Protection Regulation (GDPR)<\/a>, platforms must ensure data minimisation, establish a lawful basis for processing, and apply privacy-by-design principles. The eIDAS regulation sets digital identity assurance standards, particularly relevant for EU-based verifications. <\/p>\n\n\n\n

Additionally, the Digital Markets Act<\/a> places design scrutiny on gatekeeper platforms, including age-related considerations. Secondary legislation under the OSA and DSA provides the detailed thresholds and classifications necessary to operationalise these obligations for different service providers. <\/p>\n\n\n

\n

Ofcom Investigates 34 Pornography Websites for Failing Age Verification<\/strong><\/h3>\n
Investigation of Primary Priority Content<\/strong><\/h5>\n

On 31 July 2025, Ofcom launched formal investigations into four digital service providers operating a combined 34 pornographic websites. These platforms were suspected of breaching OSA requirements by failing to implement the new rules. Ofcom\u2019s scrutiny focused on whether the platforms had adopted age assurance systems that met the legally required \u201chighly effective\u201d standard.<\/p>\n

Potential Penalties for Non-Compliance<\/strong><\/h5>\n

The outcome of these probes could set critical precedents for how similar platforms are regulated moving forward. These sanctions can reach up to \u00a318 million or 10% of a platform\u2019s qualifying worldwide revenue, whichever is higher. In extreme cases, Ofcom can also direct internet service providers to block access to offending platforms within the UK.\u00a0<\/p>\n

Outcomes & Impacts<\/strong><\/h5>\n

While final rulings from the ongoing investigations are still pending, early data suggest the OSA\u2019s enforcement is already having a measurable impact. Major adult content platforms have experienced substantial traffic declines with one report indicating a 47% drop in UK visits following the new rule\u2019s implementation. This sharp decline signals that age verification systems are actively being adopted, either voluntarily or under regulatory pressure.\u00a0<\/p>\n<\/div>\n\n\n

Adopting a Unified Compliance Strategy<\/h2>\n\n\n\n

To comply with both the OSA and DSA, firms should adopt a holistic compliance strategy. Businesses must invest in dynamic risk management solutions that can trigger automated workflows according to user geolocation or document types. <\/p>\n\n\n\n

Streamlining the testing and iteration cycles becomes more efficient when partnering with an age verification vendor<\/a> with SDKs and APIs for seamless integration. Additionally, monitoring evolving codes of practice can further equip organizations to be on top of changing regulations. You can learn more here: What are Identity Verification Solutions?<\/a><\/p>\n\n\n

\n

Key Takeaways<\/h3>\n