If people can post, upload, message or comment on your product, the Online Safety Act 2023 probably applies to you. It doesn't matter whether you call yourself a social app, a community platform, a creator tool, a dating app, a forum, or a SaaS product with a chat feature. Ofcom has been enforcing the Act since March 2025. By October 2026 it had fined a string of smaller services, opened investigations into some of the largest platforms, and published a register of the services that get the heaviest duties.
This guide is for UK startups, and overseas startups with UK users, that run user-to-user features. It covers three questions founders ask us. Does the Act apply to us? What can Ofcom actually do to the company and to its directors? And which parts of that risk can insurance pay for, and which parts it can't?
A short answer to the last question: insurance won't pay an Ofcom penalty for you, and you shouldn't plan as if it will. What insurance can do is fund the legal costs of dealing with Ofcom, defend your directors, and pay claims from people harmed by content on your platform, such as defamation or copyright claims. That only works if the wording is right.
Some boundaries first. If your platform matches buyers and sellers and the main risk is transactions, payments or a seller's goods hurting a buyer, read Marketplace Platform Insurance for UK Startups. If you sell reviews, UGC or influencer tools to brands, read Martech Insurance for UK Startups. If you make games with chat, start at Games Studio Insurance for UK Startups. This page is about the platform itself: user content, online safety duties, and the regulator.
Mesh'd Limited trading as Meshed is authorised and regulated by the Financial Conduct Authority under firm reference number 1033248. We arrange cover from the insurers on our panel and charge a flat 10% broker fee, with no admin add-ons. We're not lawyers, and nothing here is legal advice on your compliance. For that, use a solicitor who works on online safety. Our job is the insurance that sits around it.
Does the Online Safety Act apply to your startup?
The Act regulates two kinds of service: user-to-user services and search services. Most startups that ask us about it are user-to-user.
Under section 3 of the Act, a user-to-user service is an internet service that lets content generated, uploaded or shared by one user be encountered by another user. Two details catch founders out:
The feature only has to exist. It doesn't matter whether anyone actually uses it.
The proportion doesn't matter. A B2B product where user content is a small side feature can still be a user-to-user service.
A service is in scope if it has links with the UK (section 4). There are three ways to have those links:
it has a significant number of UK users;
the UK is a target market; or
it can be used in the UK and there are reasonable grounds to believe there's a material risk of significant harm to people in the UK.
Being incorporated in Delaware or Dublin doesn't take you out of scope. Ofcom says it regulates more than 100,000 companies, many of them based entirely outside the UK.
What's exempt
Schedule 1 exempts some services entirely. The exemptions that matter most to startups:
Email, SMS/MMS, and one-to-one live voice calls, where these are the only user content the service enables.
Limited functionality services. Users can only post comments or reviews about your own content (and share them, or react with likes, emoji or ratings). The product reviews on your own shop, or comments under your own blog, usually fall here. Once users can post their own content or talk to each other, the exemption goes.
Internal business services. Tools available only to a closed group, such as a business's own officers, staff and authorised contractors. An internal wiki or company chat tool is usually exempt for the business that uses it.
Many B2B SaaS products sit in a grey area. A project tool where a client's staff comment on shared files might be an internal business service for that client. A platform where users from different organisations can find and message each other probably isn't. If you're not sure, record your reasoning. Ofcom and insurers will both ask how you reached your view.
A quick scoping table
Feature in your product | Likely in scope? | Note |
|---|---|---|
Public posts, profiles, feeds | Yes | Classic user-to-user |
Direct messages between users | Yes | DMs also count towards Category 2B thresholds |
Comments on other users' posts | Yes | |
Comments or reviews on your content only | Usually exempt | Schedule 1 limited functionality |
User uploads (images, video, audio, files) others can see | Yes | |
Community forums or groups | Yes | Including small hobby or niche forums |
In-game or in-app chat | Yes | See the games page for the rest of a studio's stack |
Closed tool for one organisation's staff | Usually exempt | Schedule 1 internal business services |
Generative AI output that users can share with each other | Possibly | Depends on how sharing works; take legal advice |
Where the Act stands in October 2026
The Act came in through phases rather than a single start date. These are the dates that matter to a startup, taken from Ofcom's published roadmap and statements.
Date | What happened |
|---|---|
16 December 2024 | Ofcom published its illegal harms statement and codes. In-scope services had three months to complete an illegal content risk assessment. |
17 January 2025 | Age assurance duties for pornography providers under Part 5 came into force. |
16 March 2025 | Deadline for the first illegal content risk assessments. |
17 March 2025 | Illegal content safety duties became enforceable. Services must use the codes or an equivalent approach. |
16 April 2025 | Deadline for children's access assessments for services already operating. A new service must complete one within three months of launch. |
24 April 2025 | Ofcom published the Protection of Children Codes and children's risk assessment guidance. |
24 July 2025 | Deadline for children's risk assessments for services likely to be accessed by children. |
25 July 2025 | Children's safety duties became enforceable, including highly effective age assurance where the codes require it. |
7 April 2026 | Duty to report child sexual exploitation and abuse content to the National Crime Agency came into force for user-to-user services. |
10 July 2026 | Ofcom published the register of categorised services (Category 1, 2A and 2B), with consultations on the additional duties. |
Autumn 2026 onwards | Further measures, including hash matching for intimate image abuse on some higher-risk services, subject to Parliament. |
2027 | Final statements on the additional duties for categorised services, terms of service guidance, and the first transparency reports from categorised services. |
The government also added new priority offences in December 2025, covering serious self-harm and cyberflashing. In June 2026 Ofcom said services need to account for them in their risk assessments. If you did your illegal content risk assessment in early 2025 and haven't touched it since, it's probably out of date. Ofcom has opened investigations into services that made significant changes without reassessing risk first.
Categorisation: most startups won't be categorised
Categorised services take on extra duties, such as transparency reporting and user empowerment tools. The thresholds are set in regulations made in February 2025:
Category 1: more than 34 million UK monthly active users plus a content recommender system, or more than 7 million plus a recommender system and a resharing function.
Category 2A: search services with more than 7 million UK monthly active users.
Category 2B: more than 3 million UK monthly active users plus direct messaging.
Few seed or Series A startups get near these numbers. The core duties don't depend on categorisation, though. Illegal content risk assessments, illegal content safety duties, children's access assessments, and (if children are likely to use the service) children's safety duties apply to every in-scope service, whatever its size.
Ofcom fees
Providers with qualifying worldwide revenue of £250 million or more must notify Ofcom and pay fees from the charging year starting 1 April 2026. There's an exemption where UK-referable revenue is under £10 million. Very few startups reach this. We mention it because investors sometimes confuse the fees regime with the safety duties. The duties apply whatever your revenue.
What Ofcom can do
This part sets your insurance priorities, so it's worth reading carefully.
Penalties against the company
Under Schedule 13, the maximum penalty is the greater of £18 million and 10% of qualifying worldwide revenue. For a pre-revenue startup the cap is £18 million. In practice, the fines so far have been much smaller than the maximum, but they're not trivial for a small company. Ofcom fined 4chan £450,000 for age check failures, plus £50,000 for failing to carry out an illegal content risk assessment and £20,000 for terms of service failures. It fined an online suicide forum £950,000. Several pornography providers were fined between tens of thousands and over a million pounds. By March 2026 Ofcom had issued 16 fines against six companies totalling nearly £4 million. More followed in the months after that.
Where non-compliance continues, Ofcom can also apply to the courts for business disruption measures. These can require payment providers, advertisers, or internet service providers to withdraw services from, or block access to, a non-compliant platform. For a startup, that is close to an extinction event.
Information powers
Ofcom can send information notices (section 102) requiring documents and data. It can require a service to name a senior manager responsible for responding (section 103). A senior manager is someone who plays a significant role in decisions about, or managing, the company's online safety compliance. Ofcom can also require interviews with officers, employees and former employees (section 106).
Personal exposure for directors and managers
This is the part that changes the conversation with a board:
Information offences (section 109) cover failing to comply with an information notice, giving false information, or destroying documents.
A named senior manager can commit an offence if the company fails to comply with an information notice and they didn't take all reasonable steps to prevent it (section 110).
Offences for failing to comply with a confirmation decision (section 138) cover certain children's safety duties and some child sexual abuse requirements. The penalties include imprisonment.
Where a company commits certain offences with the consent or connivance of an officer, or because of their neglect, the officer is also guilty (section 202). "Officer" includes directors, managers and the company secretary.
So a startup's online safety failure isn't only a company problem. A director can face interviews, a criminal investigation, and their own defence costs.
What insurance can and can't pay for
The table below is the centre of this guide. "Possibly" means the cover exists on some policies, and the wording decides.
Exposure | Can insurance pay? | Policy to look at | What to check |
|---|---|---|---|
Ofcom penalty against the company | Don't rely on it | None | Policies that mention fines usually say "where insurable by law". UK law is generally understood not to let a company insure against its own regulatory penalties. Budget for this as a business risk. |
Ofcom business disruption order | No | None | Business interruption cover usually needs physical damage or a cyber event. A regulator cutting off your payment provider isn't either. |
Cost of compliance work (risk assessments, moderation, age assurance) | No | None | These are operating costs, not losses. |
Legal costs of responding to an Ofcom investigation | Possibly | Cyber, media liability, or D&O with regulatory defence cover | Whether "regulator" or "regulatory proceeding" includes Ofcom and online safety, not only data protection |
Directors and senior managers interviewed or investigated | Possibly | D&O | Cover for investigation and interview costs; whether it starts at a formal notice or only at a charge |
Director's criminal defence (s110, s138, s202) | Usually, for defence costs | D&O | Defence costs advanced until final judgment; repayment if a deliberate act is proved; fines on individuals are not covered |
Defamation claim about a user's post | Yes, if the wording covers user content | Media liability | Many media wordings cover "content you publish" and exclude third-party content. Ask for user-generated content expressly. |
Copyright or trade mark claim over user uploads | Possibly | Media liability, IP cover | Patent claims are usually excluded; check the territory and US exposure |
Privacy or data breach, including age assurance data | Yes | Cyber | Vendor breaches (your age assurance or moderation supplier); biometric and ID data |
B2B customer says your moderation or safety feature failed | Yes, if it's in the tech PI wording | Technology PI | Contractual liability exclusions; liability caps in your contracts |
Moderator suffers psychiatric injury from harmful content | Yes | Employers' liability | Tell the insurer what moderators see; contractor moderators may need their own cover |
Investors sue the board after enforcement | Possibly | D&O | Insured v insured exclusion; major shareholder exclusion |
Three points sit behind that table.
Fines. Treat an Ofcom penalty as uninsurable. Even where a policy says it covers fines "where insurable by law", there's a strong public policy argument against a company recovering a penalty for its own breach. If a contract asks you to "indemnify the customer for regulatory fines", treat that the same way. You can promise it, but your insurance probably won't back the promise.
Costs are where cover earns its keep. A company can spend a lot of money before any penalty: lawyers reading an information notice, specialist advisers reconstructing a risk assessment, forensic work on moderation logs, and separate counsel for an interviewed director. This is the part of the bill that the right policy can fund.
Third-party claims didn't start with the Act. Before it, platforms already faced defamation, harassment, privacy and copyright claims about user content. The Act raises the standard of the systems you're expected to have. A weak notice-and-takedown process now hurts you with Ofcom and in court.
The covers, one by one
Media liability for user content
This is the cover most user-to-user startups don't realise they lack. Media liability pays defence costs and damages for defamation, privacy, and intellectual property infringement in content.
The usual gap is user content. A wording written for publishers covers what the publisher creates. A platform's exposure is mostly what users post. Ask for a wording that expressly covers user-generated content you host, and check:
Defamation. Under section 5 of the Defamation Act 2013 (England and Wales), a website operator has a defence for statements posted by someone else. That defence fails if the claimant couldn't identify the poster, gave you a notice of complaint, and you didn't respond as the regulations require. A working complaints process is your legal defence and your insurer's defence.
Hosting. Regulation 19 of the Electronic Commerce Regulations 2002 protects hosts that don't know about unlawful content, or act expeditiously once they do. Insurers will ask about your takedown times and records.
Territory. If you have US users, check whether US claims are covered. US defamation and copyright litigation costs more to defend.
Investigation and regulatory defence costs
Cyber policies often include cover for regulatory investigations. Many define "regulator" or "regulatory proceeding" around data protection: the ICO and its equivalents. That may not reach an Ofcom online safety investigation. Some media and D&O wordings are wider. Ask for:
a definition of "regulatory proceeding" that includes Ofcom investigations under the Online Safety Act, or any regulator with authority over your business;
cover from the first formal step (an information notice or a notice of investigation), not only once enforcement starts;
cover for the company's costs, not only the individuals'.
Not every insurer will agree. The wording an insurer offers is a useful sign of how it sees your platform.
Directors' and officers' (D&O) insurance
D&O protects the people. For an online safety exposure, look for:
Investigation and interview costs for directors, officers and employees, including when Ofcom requires an interview under section 106.
Criminal defence costs for the information and confirmation decision offences, with costs advanced as they arise.
Named senior managers who aren't directors. Check that "insured person" includes employees acting in a managerial capacity, such as a head of trust and safety.
Conduct exclusions that only apply after a final, non-appealable judgment, so cover isn't withdrawn on an allegation.
D&O doesn't pay fines or penalties imposed on individuals. It pays to defend them. For more on how D&O works and what investors ask for, read Directors and Officers Insurance UK.
Cyber
Online safety work creates a lot of sensitive data. Age assurance may involve ID documents, facial estimates, or third-party checks. Moderation creates records of illegal content reports. Child sexual abuse reporting creates data that has to be handled carefully. A breach of any of it is a cyber claim, plus a data protection issue that may also interest Ofcom.
Check that cyber covers incidents at your suppliers (age assurance vendors, moderation tools, cloud hosting), and how it treats biometric data. The general guide is Cyber Insurance UK. Sole traders should note that we don't currently place cyber cover for sole traders.
Technology professional indemnity
If you sell a platform or feature to other businesses, such as white-label community software, a moderation API, or chat inside a client's app, your customers may claim that your product failed to do what you promised. Tech PI covers those claims. Read your contracts for promises about compliance, such as "the service will comply with the Online Safety Act". A warranty like that can turn the customer's regulatory problem into a claim against you, and contractual liability exclusions may then apply. See Professional Indemnity Insurance UK.
Employers' liability
Content moderators can suffer psychiatric injury from repeated exposure to harmful material. Employee claims for work-related injury fall under employers' liability, which is compulsory once you employ people. Tell the insurer what your moderation team handles and what welfare support you provide. If you outsource moderation, check that the contract makes the supplier responsible for its staff and that it holds its own cover. See Employers' Liability Insurance UK.
What underwriters will ask a user-content platform
Expect most of these questions. Having the answers written down makes a difference to terms.
What can users do: post, upload, message, livestream, or share links? Is any of it end-to-end encrypted?
Roughly how many UK monthly active users do you have, and in which other countries?
Is the service likely to be accessed by children? What does your children's access assessment say?
When did you last complete or review your illegal content risk assessment? Who signed it off?
What age assurance do you use, and who supplies it?
How do users report content? What's your typical response time, and do you keep logs?
Is moderation in-house, outsourced, automated, or a mix? Who checks the automated decisions?
Have you had any information requests or contact from Ofcom, the police, or another regulator?
Have you had legal letters about user content in the last five years?
What do your terms of service say about prohibited content, and how do you enforce them?
Who is your named senior manager for online safety, if you have one?
What do your B2B contracts promise about safety or compliance?
Three examples
These are illustrations, not real clients.
A community app gets an information notice. A UK hobby forum with 40,000 users receives a notice asking for its illegal content risk assessment and moderation records. The founders realise the assessment was never updated after they launched DMs. The costs are external lawyers, an adviser to rebuild the assessment, and time. A cyber policy limited to data protection regulators doesn't respond. A wording that covers "any regulator with authority over the insured" might. Whatever the policy says, the assessment work itself is a business cost.
A creator platform gets a defamation letter. A user uploads a video accusing a local business owner of fraud. The business owner's solicitors write to the platform. The platform takes the video down within a day and keeps records. Its media liability wording covers user-generated content, so the insurer funds a response. A second platform, with a publisher-style wording, finds third-party content excluded.
A dating app's age assurance supplier is breached. ID images held by a supplier leak. The cyber policy responds to incident response and notification costs because it covers incidents at suppliers. The board also faces questions from investors about vendor due diligence. Whether D&O responds to an investor claim depends on the wording.
Before you buy: a 30-day readiness list
You'll get better terms, and be in a stronger position with Ofcom, if you can show:
None of this replaces legal advice. It's also what investors increasingly ask for in diligence. Our Series A Diligence Insurance Pack for UK Startups covers the insurance side of that.
How this fits with the rest of your startup insurance
Online safety cover isn't one product. It's a set of extensions and checks across policies you probably need anyway: tech PI and cyber as the core, D&O once you have a board or investors, employers' liability once you hire, and media liability once users can post. The wider map is on Startup Insurance UK.
Related pages:
Matching buyers and sellers, payments and transaction disputes: Marketplace Platform Insurance for UK Startups
Selling reviews, UGC or influencer tools to brands: Martech Insurance for UK Startups
Games with chat and user content: Games Studio Insurance for UK Startups
AI products and generated output: AI Insurance for UK Startups
Learning platforms used by children: Edtech Insurance for UK Startups
IP disputes in detail: IP Insurance for UK Startups
Launching to US users: US Expansion Insurance for UK Startups
FAQs
Is there such a thing as Online Safety Act insurance?
Not as a single policy. The cover comes from media liability (for user content), regulatory defence extensions, D&O, cyber, tech PI and employers' liability. We put that set together for platforms.
Will insurance pay an Ofcom fine?
Don't rely on it. UK law is generally understood not to let a company insure against its own regulatory penalties, and policies that mention fines usually limit cover to fines that are insurable by law. Insurance is more useful for the legal costs around an investigation.
What's the maximum Ofcom fine?
The greater of £18 million and 10% of qualifying worldwide revenue. Fines so far have been much lower, but they've reached hundreds of thousands of pounds for small services.
Can directors go to prison under the Online Safety Act?
Some offences carry imprisonment. These include certain failures to comply with a confirmation decision about children's safety duties, and officers can be liable where an offence happens with their consent, connivance or neglect. D&O can pay for the defence. It can't pay a criminal penalty.
We're a small startup with a few thousand users. Does the Act really apply?
Probably, if users can share content with each other and you have UK links. Size affects categorisation and fees, not the core duties. Ofcom's enforcement so far includes small and niche services.
We're based outside the UK. Does it matter?
If UK users are a significant number, the UK is a target market, or there's a material risk of significant harm to UK users, the Act applies. Ofcom says many of the companies it regulates are based entirely outside the UK.
Do you cover sole traders?
Yes, for most covers. We don't currently place cyber cover for sole traders.
Which insurers do you use?
We arrange cover from the insurers on our panel, as an FCA-regulated broker (FRN 1033248) charging a flat 10% fee.
Talk to us
If you run a platform with user content and want your cover checked against the Online Safety Act, send us your current policies, your product description, and any B2B contract terms about safety or compliance. We'll tell you where the gaps are and what the insurers on our panel will offer. Speak to us.
Vincent Liu
Co-founder & CTO
