The duties usually fall on services
The Online Safety Act primarily regulates providers of in-scope user-to-user and search services. It does not turn every user into a legal compliance expert.
Protection, evidence and public rules
Online safety law and regulation explained
Online safety law places duties on certain online services and gives regulators powers to supervise compliance. It can change platform systems, reporting routes and accountability. But it does not make every online interaction safe or guarantee that individual losses will be prevented or reimbursed.
Page T-016Guidance pageReviewed 29 August 2026
Key Guidance
Treat regulation as an extra layer of protection, not proof that a post, advert, account or search result is genuine. Continue to verify the person, request and route, and report harmful or fraudulent content through the service and the appropriate public route.
Start with Key Guidance for the short answer. Then read the sections that match what happened and what you need to do.
Understand the issue
Why this matters to you
Legal duties are often described in broad headlines. The practical effect depends on which service is covered, which duty has commenced, the risk on that service and the measures required or adopted.
Fraud is one of several illegal harms
In-scope services must assess relevant illegal-content risks and take proportionate measures, including risks connected with fraud and financial-services offences.
Implementation happens in stages
Risk assessments, safety measures, children’s protections and extra duties for categorised services do not all begin at the same time.
Regulation does not validate content
A regulated platform can still contain harmful material, false accounts or misleading adverts. Presence on the service is not an endorsement.
Consequences and movement
What may happen next
Separate the law itself, Ofcom’s codes and guidance, the duties currently in force and proposals that are still being consulted on.
Services assess their risks
Providers must understand how their design, users, algorithms, business model and features may create or increase illegal harm.
Safety measures are implemented
Measures can concern moderation, reporting, complaints, recommender systems, user controls, governance and other parts of service design.
Ofcom supervises compliance
The regulator can request information, investigate and take enforcement action where regulated services do not meet applicable duties.
Public routes remain separate
Platform reporting, fraud reporting, banking complaints and reimbursement processes continue to serve different purposes.
Practical response
What you should do
Use regulation to understand responsibility and reporting—not as a substitute for checking the immediate situation.
- Report content to the serviceUse the platform’s reporting or complaints route and keep the reference, screenshots and date when the content may be illegal, fraudulent or harmful.
- Use the correct external routeReport suspicious messages or sites through the relevant cyber route, and report actual fraud, loss or hacking through the national fraud-reporting route.
- Protect yourself immediatelyContact a bank or provider without waiting for a platform investigation when money, sign-in details or account access are at risk.
- Check whether a duty is activeLook for the regulator’s current implementation information before claiming that a proposed rule is already enforceable.
- Describe the limit accuratelyState which services, content or advertising the rule covers. Avoid implying that the whole internet or every scam is within one regulator’s remit.
- Preserve evidence of systemic problemsRepeated reports, unresolved complaints and design features may be relevant to regulatory supervision even when one item has already disappeared.
Look more closely
Regulation reduces risk but cannot verify a live request for you
Rules can improve services, reporting and accountability without making every contact inside a regulated environment genuine. The identity, authority, destination and requested action still require an independent check.
A search result, post, advert, message or account creates contact.
Relevance, urgency, opportunity or fear makes the content matter.
Platform presence, verification symbols or professional presentation can borrow legitimacy.
The user is moved toward a controlled link, conversation, payment or disclosure.
Independent verification and reporting protect the individual while regulation addresses the wider environment.
Current developments
Researched feedProposed rules for paid-for fraudulent advertising
Ofcom published draft codes for extra duties applying to certain large categorised services. These are proposals under consultation, distinct from the illegal-content safety duties already in force.
Read the Ofcom consultation
What the proposed advertising rules mean now
The consultation is an implementation step, not a declaration that every paid advert is now checked or that every loss will be refunded.
Illegal-content safety duties have applied since 17 March 2025 to in-scope services, including proportionate measures for priority illegal harms.
The 2026 consultation concerns paid-for fraudulent advertising duties for Category 1 and Category 2A services.
User-generated illegal content, search results and paid advertising can fall under different provisions and implementation stages.
Users should still verify adverts and report suspicious content. The proposal does not certify individual advertisements.
What to do with this information
When describing a new rule, identify whether it is law, an active duty, a code, guidance or a proposal. That distinction determines what the public can reasonably expect today.
Selected history
Historical cases and lasting lessons
Online Safety Act becomes law
The Act confirmed the statutory framework for regulating in-scope online services and gave Ofcom the online-safety role.
Lasting lesson: The Act is the framework. Practical duties depend on commencement, codes, guidance and the type of service.
Illegal-content safety duties commence
In-scope platforms were required to implement appropriate measures to address illegal material and priority criminal activity.
Lasting lesson: Commencement is more useful to the public than treating the Act’s original passage date as the date every protection began.
Transferable understanding
Patterns over time
Law, code and guidance are not synonyms
They have different legal status and roles in explaining or demonstrating compliance.
Platform responsibility and personal action coexist
A duty on a service does not transfer blame to the user, nor remove the value of immediate protective action.
Enforcement evidence accumulates
One report may remove one item. Repeated evidence can reveal a wider failure in systems or complaints handling.
Regulatory headlines can overpromise
A new proposal or phase may be presented as though every relevant harm has already been eliminated.
Plain-language answers
Common questions
Does the Online Safety Act make social media safe from scams?
No. It creates duties and regulatory powers intended to reduce risk. It does not guarantee that every harmful item will be prevented.
Does Ofcom investigate my individual fraud loss?
Ofcom regulates services. Individual fraud reporting, bank claims and complaints use separate routes.
Are paid scam adverts already covered by all proposed 2026 measures?
No. Ofcom’s July 2026 fraudulent-advertising codes were proposals under consultation. Check the current implementation status before stating that they are in force.
Can a verified account still be misleading?
Yes. Verification can mean different things and does not prove every claim or request made by the account.
Use regulation and reporting for the right purpose
Report the content to the service, preserve the evidence and use the relevant fraud, banking or cyber route for personal effects. Ofcom’s public information explains what regulated services must do.
Scamology Insights
Understand what protection changes—and what still needs checking
These apps, tools, books and courses can help you separate the trust created by a regulated setting from the evidence for one particular claim, person or contact method. Links are intentionally withheld in this production version.
Continue understanding
Explore related guidance
Evidence and currency