Rules and ethics
Online Safety Act: when esports creators have duties
Esports creators running UK gaming communities: when the Online Safety Act applies, Ofcom codes and deadlines, service duties, and the ICO Children’s Code.
What to take away
- Esports creators are not subject to platform duties simply because they post content; those duties apply to providers of regulated online services, including creator-run communities when they meet the Act’s scope.
- Ofcom’s Illegal Content Codes of Practice for user-to-user services were in force from 17 March 2025. Children’s safety duties began on 25 July 2025.
- Relevant service duties include illegal content and children’s risk assessments, safety measures, accessible reporting and complaints routes, and record keeping.
- Registration and transparency reporting apply to certain categorised services, not every creator or community.
- The ICO’s Children’s Code is separate from Ofcom’s Online Safety Act duties.
What the Online Safety Act 2023 requires in outline
The Online Safety Act 2023 places duties on providers of regulated online services, including user-to-user services and search services. Ofcom is the regulator for the Act’s online safety duties. An individual creator is not a regulated service just because they post gameplay or interact with viewers on another provider’s platform.
The duties depend on the type and scope of the service. They include an illegal content risk assessment, proportionate safety measures, and clear terms of service. Services likely to be accessed by children have additional duties, including a children's access assessment and, where required, a children's risk assessment and measures to protect child users.
A creator may be a service provider if they operate their own online service that lets users encounter or interact with user-generated content. Posting gameplay or enabling comments on a platform owned by someone else does not, by itself, make the creator the provider of that platform. The Act’s explanatory notes set out the definitions of regulated services.
A Discord server, forum or live chat is not automatically a regulated service. The person or organisation providing it must assess whether it meets the Act’s definition and scope; the platform provider and a creator running a separate community may have different responsibilities.
The Act also creates offences relating to communications, including sending false communications, threatening communications and cyberflashing. These offences concern the conduct of the person who commits them; they do not make every creator responsible for all content hosted by a platform.
For a wider view of which UK rules reach a gaming creator, from advertising to copyright and tax, see our related guide.
Ofcom duties and the commencement timetable
Ofcom’s Illegal Content Codes of Practice for user-to-user services were in force from 17 March 2025. The children’s safety codes are the Protection of Children Codes of Practice. The 6 April 2025 date is not the commencement date for these duties: children’s safety measures began on 25 July 2025.
Online Safety Act commencement
- 6 April 2025user-to-user duties apply
- By 6 April 2025first children's risk assessment
- By 6 April 2025safety measures implemented
- OngoingOfcom enforcement action
Providers of regulated services likely to be accessed by children had to complete and record their children's risk assessments by 24 July 2025. From 25 July 2025, they had to take the safety measures set out in the Protection of Children Codes of Practice or use other effective measures to protect child users from harmful content.
Depending on the service and its scope, Ofcom duties include:
- Completing an illegal content risk assessment and keeping it up to date.
- For services likely to be accessed by children, completing a children's access assessment and, where required, a children's risk assessment.
- Taking proportionate steps to mitigate identified risks and meet applicable safety duties.
- Keeping records of risk assessments and relevant compliance measures, and reviewing them regularly.
- Providing accessible reporting and complaints routes and complying with applicable terms of service duties.
- Registering on Ofcom's Register of Categorised Services and publishing a transparency report where the service meets the relevant category and threshold conditions.
Do not assume that a small audience removes a service from the Act. Registration is not required of every regulated service: Ofcom's Register of Categorised Services relates to services that meet the relevant category and threshold conditions set by regulations. Those conditions apply to services, not to an individual creator's follower count.
If you are unsure whether you provide a regulated service or meet a registration threshold, check Ofcom's guidance on service scope and categorisation. The explanatory notes to the Act are also useful for definitions.
Which gaming platforms count as regulated services
The Act covers user-to-user services and search services within its scope. A user-to-user service allows users to encounter or interact with user-generated content. This can include social media, gaming services with chat and forums, but the presence of chat alone does not establish that a particular service is regulated.
Is your service regulated?
Can users interact or post content?
likely user-to-user service
may be out of scope
A search service is a service that allows users to search multiple websites or databases. Most gaming creators will not run a search service, but platforms that host game discovery might.
For a gaming service, assess whether it meets the statutory definition and scope of a user-to-user service. Features such as chat, sharing clips or forming teams may be relevant; they do not, on their own, prove that the service is regulated. A single-player game without user interaction may fall outside the user-to-user definition.
The Act contains scope provisions and exemptions, so do not assume that every commercial gaming platform or creator community is covered. Assess the service against the statutory definitions and any applicable exemptions.
Services likely to be accessed by children have additional duties, including a children's access assessment and, where required, a children's risk assessment. Age assurance is one possible measure for particular risks; it is not a blanket requirement for every service or every child user.
A platform may have its own Online Safety Act duties, while a creator who runs a separate community space may need to assess that service separately. A creator's Discord server is not automatically covered or exempt: the service's provider, features and scope matter.
A useful comparison is the data protection workflow for a gaming channel, from privacy notice to breach, which shows how to document compliance.
Age assurance and children's information duties
Where a service must prevent children from encountering specified harmful content, Ofcom requires highly effective age assurance for relevant content, including pornography and primary priority content. Ofcom identifies methods that may be highly effective, such as photo-ID age verification, facial age estimation, mobile-network-operator checks, credit-card checks, open banking and digital identity services. The method should fit the risk; there is no single method approved for every service.
Age assurance and children's duties
- Prevent children accessing harmful content
- Use age verification or estimation
- Apply ICO Children's Code standards
- Design with children's safety in mind
- Set default privacy settings
- Limit data collection
- Provide clear reporting tools
Children's information guidance from the ICO sets out how to handle children's data under the UK GDPR. It includes the Age Appropriate Design Code, commonly called the Children's Code, which has 15 standards that apply to relevant services likely to be accessed by children. These standards cover transparency, data minimisation and parental controls. The standards are:
- Best interests of the child
- Data protection impact assessments
- Age appropriate application
- Transparency
- Detrimental use of data
- Policies and community standards
- Default settings
- Data minimisation
- Data sharing
- Geolocation
- Parental controls
- Profiling
- Nudge techniques
- Connected toys and devices
- Online tools
For gaming platforms, age assurance is only one part of a service's duties where it is required. The Children's Code also informs how an in-scope service designs defaults, collects data and gives children clear information. The service should provide usable reporting tools where required by its safety duties.
Creators who operate community spaces should assess whether their own service is likely to be accessed by children and whether it falls within the Act. If it does, the relevant children's safety duties apply to the service provider; the presence of under-18s does not automatically make an individual creator subject to every platform duty.
The ICO's Children's Code is relevant where a service is likely to be accessed by children and processes their personal data. Its guidance explains how to assess whether the Code applies and how to follow its standards.
Ofcom and the ICO work together, but their duties are separate. You may need to comply with both.
A checklist for age assurance:
- Assess whether your service is likely to be accessed by children.
- Complete the required children's access and risk assessments.
- Use age assurance where it is required for the relevant content and risk.
- Provide suitable privacy settings, reporting and blocking tools.
- Review the service's measures and records when it changes.
Creator duties when a young audience is in the room
If a creator's community is a regulated user-to-user service, the service provider must comply with the applicable children's safety duties. Those duties address specified categories of content harmful to children; they do not make an individual creator responsible for every type of content merely because they have a young audience.
A creator who operates a service likely to be accessed by children and processes their personal data may also need to follow the ICO's Children's Code. A young following alone does not establish that the Code applies to an individual creator.
Creators should also consider the Advertising Standards Authority (ASA) and the CAP Code on ad labelling. If you are promoting products to children, you must ensure ads are clearly identifiable and not misleading.
The Competition and Markets Authority (CMA) influencer and online endorsement guidance also applies. You must disclose paid promotions.
For esports creators, a young audience can make it important to assess a creator-run community space, such as a Discord server or chat room. If the service falls within the Act, its provider must meet the applicable children's safety duties; do not assume that audience age alone settles the legal scope.
Twitch streamer Discord compliance
- Assess risks to children
- Implement age assurance if needed
- Keep records of compliance
- Train moderation team on child safety
Operational risks, from account takeover to unreconciled income, sit outside the Act and are covered separately.
If you run a Discord server, forum or live chat
This is the point where an esports creator can move from posting on someone else's service to providing one. Work through the steps in order and keep the answers on file.
- Decide who provides the space. A chat on a platform owned by someone else is that platform's service; a separate community you set up and control may be yours to assess.
- Assess whether the space lets users encounter or interact with user-generated content, and whether it falls within the Act's scope and exemptions.
- If it is in scope, complete an illegal content risk assessment and keep it up to date.
- Complete a children's access assessment and, if children are likely to use the space, a children's risk assessment.
- Set out reporting and complaints routes in rules members can find and understand, including children where relevant.
- Choose moderation measures that match the risks you recorded, and note who reviews reports and how quickly.
- Keep records of the assessments and measures, and review them when the community, its features or its audience change.
- Check separately whether you process children's personal data in a way that brings in the ICO's Children's Code.
If step two shows the space is not in scope, record why. That note is what you show if the question is raised later.
ICO guidance on online safety and data protection
The ICO's guidance on online safety and data protection explains how online safety measures can interact with data protection duties. It is separate from Ofcom's Online Safety Act codes: the ICO oversees data protection law, including the UK GDPR.
The ICO's children's information guidance is part of this. It provides detailed advice on how to handle children's data, including the Children's Code. The code applies to services likely to be accessed by children, and it has 15 standards.
Key points from the ICO guidance include:
- Put the child's best interests at the centre of service design and assess data protection impacts.
- Make the service age-appropriate and explain data practices clearly.
- Use privacy-protective default settings and collect only the data needed.
- Avoid detrimental uses of children's data and apply the Code's standards on sharing, location, profiling and design nudges.
ICO guidance key points
- Data protection by design and default
- Transparency about children's data use
- Data minimisationcollect only necessary
- Parental controls and age assurance
- Reporting and blocking mechanisms
For gaming platforms, data protection remains relevant when using age assurance or moderation tools. Collect and retain only the personal data needed for the purpose, explain the processing clearly and set an appropriate retention period.
Creators who operate community spaces should check whether they process children's personal data and whether the Children's Code applies to their service. Where it does, provide clear privacy information and identify a lawful basis for processing.
The ICO can take enforcement action, including fines, for breaches of data protection law. This is separate from Ofcom's enforcement of the Online Safety Act.
A table comparing Ofcom and ICO duties:
Ofcom (Online Safety Act)
- Focus
- Illegal content, children's safety
- Age assurance
- Required for harmful content
- Record keeping
- Risk assessments, moderation records
- Enforcement
- Fines, service restrictions
ICO (UK GDPR)
- Focus
- Data protection, children's data
- Age assurance
- Required for data protection
- Record keeping
- Data processing records
- Enforcement
- Fines, enforcement notices
Read the ICO column with care: age assurance is one way an in-scope service can apply the Children's Code's age appropriate application standard, not a general UK GDPR requirement for every service.
Moderation, reporting and record keeping in practice
Regulated services have duties relating to reporting illegal content and handling complaints. They must provide applicable reporting and complaints mechanisms that are accessible, including to children where relevant, and act in line with the Act and their terms of service.
For creators, moderation means having a team or tools to review reports. You need to document your moderation policies and keep records of actions taken. This is important for showing compliance to Ofcom.
Record-keeping and review duties include:
- Keeping records of the required risk assessments.
- Recording relevant measures taken to comply with safety duties.
- Reviewing risk assessments and measures regularly, including when the service or its risks change.
- Keeping practical records of reports and responses to help demonstrate how the service operates.
Reporting and complaints arrangements should:
- Let users report relevant content and make complaints through accessible routes.
- Explain how the service handles and resolves complaints in its terms of service where required.
- Set out how the service responds to reports and records relevant actions.
The Act does not make every creator subject to a blanket duty to report content to the police or the Internet Watch Foundation.
For small creators, record keeping can be simple. A spreadsheet or document may suffice, as long as it is accurate and up to date.
Set up moderation and reporting
- Write moderation policy covering illegal content
- Set up easy-to-find reporting system
- Train moderators on handling reports
- Keep records of all reports and actions
- Review policy regularly
If you use a third-party moderation service, outsourcing the work does not transfer the regulated service provider's legal duties. The provider remains responsible for its service and should check that its moderation arrangements support compliance.
Child-safety duties may develop as Ofcom updates its codes and guidance. Check the current requirements for your service rather than relying on a predicted future date.
Compliance is ongoing. Providers should review risk assessments and measures regularly, particularly when their service or its risks change.
