The Online Safety Act moved from regulatory framework to active enforcement instrument on 15 June 2026 when Prime Minister Keir Starmer announced that under-16s will be prohibited from accessing Snapchat, TikTok, YouTube, Instagram, Facebook and X by spring 2027, with Ofcom empowered to oversee the age assurance regime that will underpin the ban.
The announcement marks the most significant expansion of the Online Safety Act’s operational scope since royal assent, and the legislative timetable it sets — a bill before Parliament before Christmas 2026, rules in force by spring 2027 — gives in-house counsel and their external advisers fewer than six months to map compliance obligations across product lines, data architectures and contractual supply chains.
Ofcom has been directed to complete a rapid study identifying the most effective age assurance methods, with face scanning and documentary ID verification cited by the government as probable mechanisms. For solicitors advising platform operators, that study will be the critical document: its conclusions will shape the technical standards against which Ofcom measures compliance, and the regulator has already demonstrated its willingness to investigate non-compliance, with Australia’s eSafety Commission currently probing Facebook, Instagram, Snapchat, TikTok and YouTube over failures in that jurisdiction’s equivalent regime. No fines have been issued there yet, but the enforcement trajectory is clear, and UK platforms will be watching those outcomes as a proxy for Ofcom’s likely posture.
The government’s scope extends beyond the headline platforms. Gaming sites, livestreaming services and stranger-communication functions fall within the ban for under-16s, while 16 and 17-year-olds face default restrictions on livestreaming and stranger contact to prevent what the government describes as a cliff-edge at 16.
A separate minimum age of 18 will apply to romantic companion chatbots, with other chatbot products required to restrict intimate functionalities — a provision that will require careful drafting of product terms and privacy notices across the AI assistant market. WhatsApp and Signal are expressly excluded from the current scope, a carve-out that barristers and in-house teams will need to characterise precisely in client advice to avoid over-compliance costs.
The NSPCC has described the announcement as a watershed moment for child protection while Barnado’s has called for platforms to accept direct accountability for safety failures. Both positions signal that civil society will sustain pressure on Ofcom to enforce robustly, which raises the litigation risk profile for any platform that delays structural compliance work.
The evidence from Australia — where 70% of parents reported their children remained on banned platforms six months after that country’s ban took effect — underlines that technical enforcement is the central legal challenge, not policy intent. For law firms advising media, technology and gaming clients, the instruction window is now.
Compliance audits, age assurance procurement advice, data protection impact assessments under UK GDPR, and platform liability opinions under the Online Safety Act will all need to be in place well before Christmas, when the government intends to introduce the enabling legislation. Firms that have built Online Safety Act practices since 2023 are positioned to absorb that work; those that have not will find capacity constrained at precisely the moment client demand peaks.