<p dir="ltr">We are building a platform with user generated content and wanted to actually understand the Online Safety Act age requirements before assuming this only applies to large social media companies. Here is what I have pieced together so far, would appreciate anyone correcting me or adding context.

<p dir="ltr">The Online Safety Act places duties on a wide range of online services, not just the obvious large platforms, requiring companies to assess the risk their service poses to children and to put in place proportionate measures to protect them, which can include age verification or age estimation for services that carry higher risk content. The specific requirements seem to scale with risk rather than applying identically to every service.

<p dir="ltr">Ofcom, as the regulator, has published codes of practice outlining what counts as highly effective age assurance, and simple self declaration of age is generally no longer considered sufficient for higher risk services, pushing companies toward more robust methods like document verification or facial age estimation. This creates a real cost and technical burden for smaller startups.

<p dir="ltr">What I am still trying to understand is how a very early stage startup is expected to carry out this risk assessment without a dedicated legal or compliance team, and whether there are simplified expectations for smaller platforms.

<p dir="ltr">Has anyone here actually had to implement age verification under the Online Safety Act? Curious what approach you took, how much it cost, and whether Ofcom's guidance was clear enough to act on confidently.



<p dir="ltr">Found a fairly clear explanation of this onEntrepreneur Plus while I was reading around the topic, helped me understand the founder side of it a bit better.