The UK’s Online Safety Bill, a wide-ranging piece of legislation that aims to make the country “the safest place in the world to be online” received royal assent today and became law. The bill has been years in the making and attempts to introduce new obligations for how tech firms should design, operate, and moderate their platforms. Specific harms the bill aims to address include underage access to online pornography, “anonymous trolls,” scam ads, the nonconsensual sharing of intimate deepfakes, and the spread of child sexual abuse material and terrorism-related content. 

Although it’s now law, online platforms will not need to immediately comply with all of their duties under the bill, which is now known as the Online Safety Act. UK telecoms regulator Ofcom, which is in charge of enforcing the rules, plans to publish its codes of practice in three phases. The first covers how platforms will have to respond to illegal content like terrorism and child sexual abuse material, and a consultation with proposals on how to handle these duties is due to be published on November 9th.

Meanwhile, phases two and three cover platforms’ obligations around child safety and preventing underage access to pornography as well as producing transparency reports, preventing scam ads, and offering “empowerment tools” to give users more control over the content they’re shown. An initial consultation covering pornography sites is due in December, while additional consultations on other duties relating to child safety will follow next spring. Ofcom says it expects to publish a list of “categorised services,” which are large or high-risk platforms that will be subject to obligations like producing transparency reports, by the end of next year.

Failing to comply with the act’s rules could land companies with fines of up to £18 million (around $22 million), or 10 percent of their global annual turnover (whichever is higher), and their bosses could even face prison.

“The Online Safety Act’s strongest protections are for children. Social media companies will be held to account for the appalling scale of child sexual abuse occurring on their platforms and our children will be safer,” said UK Home Secretary Suella Braverman. “We are determined to combat the evil of child sexual exploitation wherever it is found, and this Act is a big step forward.”

The Online Safety Bill has been a controversial piece of legislation, with opponents ranging from encrypted messaging apps to the Wikimedia Foundation. Messaging apps like WhatsApp and Signal have objected to a clause in the bill that allows Ofcom to ask tech companies to identify child sexual abuse content “whether communicated publicly or privately,” which the companies say fatally undermines their ability to provide end-to-end encryption. Providers of these services have suggested they’d rather leave the UK than comply with these rules.

Meanwhile, the Wikimedia Foundation has said that the bill’s strict obligations for protecting children from inappropriate content could create issues for a service like Wikipedia, which chooses to collect minimal data on its users, including their ages.

In a statement, Ofcom’s chief executive Melanie Dawes pushed back against the idea that the act will make the telecoms regulator a censor. “Our new powers are not about taking content down,” Dawes said. “Our job is to tackle the root causes of harm. We will set new standards online, making sure sites and apps are safer by design. Importantly, we’ll also take full account of people’s rights to privacy and freedom of expression.”

The act has been welcomed by child safety advocates. “Having an Online Safety Act on the statute book is a watershed moment and will mean that children up and down the UK are fundamentally safer in their everyday lives,” the National Society for the Prevention of Cruelty to Children chief executive, Peter Wanless, said in a statement. “Tech companies will be legally compelled to protect children from sexual abuse and avoidable harm.”

Update October 26th, 9:43AM ET: Updated with diagram and additional information on Ofcom’s phased implementation approach.