Rules and ethics
Part of Online Safety Act 2023: what community managers must know
Online Safety Act 2023: what community managers must know
Community platforms count as user-to-user services under the Online Safety Act 2023. Here are the moderation duties, records and evidence UK managers need.
What to take away
- If members can post, comment or message one another, your site is a user-to-user service and sits inside the Online Safety Act 2023.
- Compliance begins with an illegal content risk assessment, not a moderation rota. Every later duty rests on what that assessment found.
- Ofcom's illegal harms duties commenced on 17 March 2025 and the children's safety duties on 25 July 2025.
- Keep the file rather than the intentiondated decisions, reasons on file and a review date are what an inspection asks for.
Do community platforms count as user-to-user services?
The Act draws its definition of a user-to-user service widely: any internet service where content generated, uploaded or shared by one user can be encountered by another.
Forums, comment threads, member directories, direct messages and event pages all fall inside that definition. So does a branded community that lives on hosted software, in the same way as a forum you built yourself.
The duty attaches to the provider of the service, which is usually the organisation holding the member relationship rather than the vendor running the servers. Small services carry lighter duties than the largest. Limited functionality services can be exempt — think of a service whose only user-generated content is, for example, email, one-to-one messages or comments and reviews on your own content.
Read the Online Safety Act 2023 against your own feature list before assuming you are out of scope.
What the moderation duties actually require
Ofcom, not the Information Commissioner, regulates the safety duties, and its codes scale the work by size and risk. The two you will work from are the Illegal Harms Code of Practice and the Children's Safety Codes of Practice. Five obligations do most of the work.
Five Online Safety Act duties
- Illegal content risk assessment
- Safety duties
- Children's safety
- Reporting and complaints
- Records and governance
The five duties are:
- Terms of service.Set out what members may not post, and apply those terms consistently.
- Take-down.Remove illegal content, and minimise the time it stays visible.
- Proactive technology.Where proportionate, use automated tools to prevent, detect or minimise illegal content.
- Reporting.Give users a clear route to report illegal content.
- Complaints and records.Operate a complaints procedure, and keep records of the risk assessment and of the action taken in response.
Services Ofcom categorises as the largest also owe transparency reports.
A five-step compliance sequence
Work through the steps in order, because each one supplies the evidence for the next.
Five-step compliance sequence
- Inventory every place a member can publish
- Write and date the illegal content risk assessment
- Turn each finding into a control
- Publish and test reporting and appeals routes
- Set a review date and named owner
- Scope the service.Confirm that members can encounter one another's content, which makes it a user-to-user service, and check whether the limited functionality exemption applies.
- Complete the illegal content risk assessment.Written, dated and signed off. Ofcom's deadline for the first assessment was 16 March 2025, the day before the illegal harms duties commenced on 17 March 2025.
- Complete a separate children's risk assessment.Whether children can reach the service is a duty in its own right, with its own deadline: 24 July 2025, ahead of the children's safety duties commencing on 25 July 2025, as set out on Ofcom's children's safety page.
- Put the safety measures in place.Work from Ofcom's Illegal Harms Code of Practice and, where children are in scope, the Children's Safety Codes of Practice: take-down, proactive technology, reporting and complaints routes, and terms of service that match what you actually do.
- Keep the evidence.Hold records of the risk assessment and the decisions behind it, plus a fixed review date. If Ofcom categorises the service, its register of categorised services shows what else applies.
If the platform is not yet live, our guide to community platform implementation sets out staged testing with test identities before real members arrive.
Records that survive a request for evidence
Papers answer inspections, not memory. The table sets out the minimum file for a community platform of any size.
| Record | What it should show | When to review |
|---|---|---|
| Risk assessment | Risks found, features considered, decisions taken | Annually, and on any new feature |
| Moderation log | Decision, rule applied, reviewer, time to action | Monthly sample |
| Appeals | Who appealed, the outcome, the reasons given | Quarterly |
| Training | Who was trained, on what, and when | On joining, then annually |
| Children's measures | What you did, and why it is proportionate | On any change to age rules |
Two failures recur. Logs that name no reviewer, and review cycles that change nothing. Both suggest the process exists for show.
Where data protection meets moderation
Moderation produces personal data: reports, device logs and decisions about named members. The Data Protection Act 2018 supplements the UK GDPR and covers all of it.
Retention is the usual weak point. A stated period, applied consistently and with deletion on schedule, is easier to defend than keeping everything in case it becomes useful.
Small organisations get no exemption. The ICO's advice for small organisations covers records, retention and answering requests from members.
Where that data lives belongs in platform selection. Our guide to GDPR community management software for UK businesses covers retention settings and subject access handling.
Common questions
Does a small forum need a full illegal content risk assessment?
Yes, if the service is not exempt. The assessment can be short and proportionate, but it must be written, dated and reviewed.
Who is responsible when the community runs on hosted software?
The provider of the service carries the duties, and in most branded communities that is your organisation. Contracts should still state who operates each control.
How long should moderation records be kept?
Long enough to show controls worked and to answer a complaint or a regulatory request. Set the period, apply it consistently, and delete on schedule.
Do members need age verification to join?
No blanket requirement exists, but you must know whether children can reach the service and act on that risk. Where children are likely, age assurance or design restrictions are the usual response.
