The UK Government has secured significant new powers to amend the Online Safety Act 2023 ("OSA") by way of secondary legislation, enabling it to move quickly, to impose restrictions on children's access to online services and restrict mobile phones in schools, similar to developments we have seen in other countries in recent years. Providers of in-scope services (and, in particular, user-to-user services, including social media services but potentially also other services which carry user-generated content) should be alert that far-reaching requirements could now be made without the need for primary legislation.

Children's Wellbeing and Schools Act 2026

Amongst other measures, the Children's Wellbeing and Schools Act 2026 inserts a new section 214A into the OSA, granting the Secretary of State a broad power to make regulations requiring providers of specified internet services to prevent or restrict access by children of or under a specified age to those services, or to specified functionalities or other features of such services. This may include, for example, regulations requiring providers to: 

• limit daily screen time;
• impose overnight curfews; or,
• restrict contact from strangers and exposure to live video from unknown users. 

Breach of any such requirement may, subject to the contents of the regulations, be treated as an enforceable requirement under the OSA, carrying the prospect of Ofcom enforcement action, including fines of up to 10% of qualifying worldwide revenue. 

Crucially, the Secretary of State is required to exercise this power following the conclusion of the Government's consultation entitled "Growing up in the online world: a national consultation", launched on 2 March 2026. That consultation closes on 26 May 2026, with the Government having committed to publishing its response in summer 2026. The Government is required to publish a progress report in the next 3 months, with regulations to follow within the next 12. 

The Act also amends the UK GDPR to give the Secretary of State power to change the age of digital consent below which parental consent may be required when relying on consent as a lawful basis for processing (currently 13 in the UK) to any age between 13 and 16, and to specify different ages for particular services or types of service. This could mean that certain platforms face a higher threshold age for obtaining valid consent than others.

What this means for providers

The headline message is this: the Government now has the legislative machinery in place to act swiftly by secondary legislation without needing to introduce new legislation through Parliament. As the Education Secretary, Bridget Phillipson, stated last week: "We are clear that under any outcome, we will impose some form of age or functionality restrictions for children under 16". 

Providers of user-to-user services should expect substantive regulatory proposals to emerge shortly after the consultation closes on 26 May 2026 and should be reviewing their age assurance capabilities, service design and data processing practices now. Given the pace at which the Government is moving, early engagement, including responding to the consultation, is strongly recommended.

You can find our UK Online Safety Tracker here.