Online Safety Act: new steps towards restricting children’s access online

The UK government’s proposals to restrict children’s access to online services underwent further development following renewed debate between the House of Commons and House of Lords on 27 April 2026. These discussions formed part of the final stages of the Children’s Wellbeing and Schools Bill, which received Royal Assent on 29 April 2026 and is now the Children’s Wellbeing and Schools Act 2026 (the Act). The Act introduces amendments relevant to the Online Safety Act 2023 (OSA).

While the government resisted calls to introduce an immediate statutory ban on under-16s’ access to social media, the final Act reflects a degree of compromise, including a clearer commitment to future action and additional procedural safeguards around the exercise of new powers.

 

Legislative developments: refined framework for future restrictions

As noted in our earlier article, the government rejected the Lords’ more prescriptive approach (particularly proposals mandating age verification requirements and an effective prohibition on under-16s accessing certain services) in favour of a broader delegated power.

The Act retains this enabling framework, allowing the Secretary of State to introduce regulations requiring providers of specified internet services to prevent or restrict children’s access to services or functionalities. However, following some parliamentary ping pong with the House of Lords, the drafting was refined in several respects. In particular, the power is now expressly for the purpose of protecting children from risks of harm, including harm arising from content, and includes illustrative examples of the types of restrictions that may be imposed. These include limits on:

• the amount of time children may spend on services;
• the times of day services may be accessed; and
• access to functionalities that facilitate contact with unknown users or exposure to live or location-based features. 

The relevant provisions still allow for significant flexibility in how obligations are designed, including the ability to impose compliance, monitoring and enforcement requirements, and to amend or implement existing legislation through secondary legislation.

 

Transparent timing and accountability

A notable development is the introduction of provisions requiring greater transparency around the timing of future measures.

The Act requires the Secretary of State to publish a progress statement within a three months following Royal Assent, setting out both the steps taken towards introducing the first set of regulations and an indicative timeline for doing so. The timeline set out in the progress statement should provide for the first regulations to be laid before Parliament within 12 months of the date the statement is published, with a 6 month backstop to the 12 month deadline is missed.

In parallel, ministerial statements during the Commons debates indicate a political commitment to act promptly following the conclusion of the government’s consultation on children’s online safety (due to close on 26 May 2026). The government has indicated that:

• some form of age-based or functionality-based restrictions for under-16s will be introduced, regardless of the consultation outcome; and
• restrictions may extend beyond access controls to include measures targeting addictive design features and algorithmically driven content. 

While these statements do not themselves create legal obligations, they provide useful insight into the likely direction of travel and may inform how new delegated powers under the Children’s Wellbeing and Schools Act 2026 are exercised.

 

Interaction with data protection and age assurance

In addition to OSA-related powers, the Act also contains provisions enabling the government to amend the age of consent for data processing in relation to information society services (within a range of 13 to 16), and to introduce associated age verification requirements through secondary legislation.

These measures may operate alongside, and potentially reinforce, any restrictions imposed under the OSA framework.

 

What this means for businesses

There are still no immediate new obligations under the OSA. However, the direction of travel is now clearer, and the statutory framework for future restrictions is now in place. In particular:

• additional restrictions appear increasingly likely in the near term;
• restrictions may focus not only on access, but also on platform design and features; and
• implementation may proceed relatively quickly following the consultation.

Businesses should therefore continue preparing for potential changes in areas such as age assurance, user interaction features that may be characterised as addictive or risk-enhancing, and content delivery or service availability for under-16s.

 

What next?

The Act received Royal Assent on 29 April 2026. Attention will now turn to the outcome of the government’s consultation and the development of detailed regulations under the new powers. Such developments will be in addition to existing requirements in relation to children's safety online including OSA children's access assessments and the ICO's Children Code (Age Appropriate Design Code).