Online safety regimes around the world are converging around a common principle: digital service providers are accountable for mitigating online harm. Regulators are imposing proactive obligations on platforms to manage risks, remove or minimize harmful design features, protect vulnerable users, improve transparency and embed safety into the design and operation of their services.
A core principle of this shift is a growing focus on protecting children online. Child online safety previously sat on the margins of platform governance, largely implemented through parental controls and content moderation. That is changing. Regulators are looking beyond the management of individual pieces of content hosted on platforms and scrutinizing the systems, features and algorithms that shape children’s online experiences and interactions. The focus is no longer limited to harmful content but extends to whether products, algorithms and user journeys are designed in ways that create or amplify risks in the first place.
Regulatory shifts underscore a common objective
Despite significant differences in legislative frameworks, regulators across major jurisdictions are increasingly pursuing the same objective: requiring platforms and digital services to identify, assess and mitigate online harms before they occur, particularly those affecting children.
Australia
As an early mover in the online safety space, Australia demonstrates where regulation is heading globally: broader regulatory scope, greater corporate accountability and a requirement for organizations to identify and avoid or mitigate online harms before they occur.
Under the Online Safety Act 2021, the Australian Government has developed a proposed Digital Duty of Care framework, with draft legislation released in September 2026. The proposed duty would require digital service providers ensure, as far as is reasonably practical, a “safe online environment” supported by risk assessments, safety-by-design principles and enhanced transparency obligations.
In practice, this would require a robust set of systems and processes including measures such as age assurance tools, safer default settings for minors, proactive identification and removal of problematic content and conduct, and enhanced reporting and complaints mechanisms. The reforms would also increase scrutiny of algorithms and AI-driven systems that shape users’ online experiences, including increasing transparency and user choice in relation to such design features. These proposed reforms sit alongside existing wider online safety initiatives, including Australia’s world-first Social Media Minimum Age legislation, which requires the removal of U16 or under 16 accounts from social media services, with significant penalties for non-compliance.
Most significantly, Australia’s online safety regime extends well beyond traditional social media platforms. The regime applies across a broad range of digital services, essentially covering all businesses with an online presence of any kind, as well as supporting services such as equipment and hosting providers. As a result, businesses that do not consider themselves technology or social media companies will likely nevertheless find themselves within scope.
“The level of obligation placed upon each organization is relative to the role it plays in the delivery of online services. For example, a hosting service would have different responsibilities to a social media service provider. The effect of this is that any organization providing a digital service, such as a company website or even perhaps enterprise systems for their employees, may find itself regulated under Australia’s online safety laws – moving away from the traditional idea that only social media companies or digital platforms are captured.”
Adrian Lawrence, Partner, Sydney
UK and EU
Elsewhere, the UK’s Online Safety Act 2023 introduces a comprehensive framework requiring online services to assess and mitigate risks arising from illegal and harmful content, with a particular focus on protecting children. Regulated by Ofcom, the regime includes obligations relating to risk assessments, age assurance, child safety measures, transparency and platform governance, reinforcing the increasing emphasis on platform accountability and safety-by-design.
“The UK’s Online Safety Act reflects a broader global shift in regulatory thinking. Regulators are increasingly focused not only on harmful content itself, but on whether a service’s design, features, recommendation systems and governance arrangements create foreseeable risks. For businesses, online safety is becoming a core product governance issue that must be considered from the earliest stages of product design and development.”
John Groom, Partner, London
The EU’s Digital Services Act (DSA) adopts a risk-based approach to online safety, imposing obligations on online platforms to identify, assess and mitigate systemic risks arising from their services. The framework places particular emphasis on protecting minors, increasing transparency around algorithms and recommender systems, and strengthening accountability for very large online platforms and search engines.
Rather than focusing solely on harmful content, the DSA requires platforms to examine how services are designed and how features such as recommender systems, content curation tools and user interfaces may contribute to risk. In practice, this may require changes to content recommendation processes for minors, greater algorithmic transparency, stronger privacy protections, age assurance measures and design choices that reduce exposure to harmful or inappropriate content.
USA
Unlike the UK, EU and Australia, the US has not adopted a comprehensive online safety framework. Instead, regulation is developing through a patchwork of federal and state initiatives focused on children’s privacy, online safety and platform accountability. As of mid-2026, roughly 20 states have enacted laws specifically regulating minors’ use of social media, a handful of states have enacted standalone age-appropriate design code legislation and several others have incorporated comparable protections for minors into broader state privacy laws.
These laws vary significantly in both their scope and their approach. Some are based on whether a service is directed to children, has actual knowledge that a user is a child, or is “reasonably likely” to be accessed by children. Others target particular categories of services, such as social media platforms, app stores or AI companion chatbots. The relevant age thresholds also vary, with some requirements focused on children under 13, others on users under 16, and still others extending protections to all minors under 18. Parents play different roles across these regimes as well: some laws require parental consent before a minor can open an account or access particular features, while others require parental controls, notices or tools that allow parents to manage a child’s experience.
The substantive requirements are similarly diverse. Some states have adopted highly targeted rules governing particular product features—for example, addictive or personalized feeds, autoplay, push notifications, direct messaging or AI companion chatbots—while others take a broader age-appropriate-design approach that requires businesses to assess and mitigate risks across the design and operation of services likely to be accessed by children. Increasingly, these regimes also address age assurance, privacy-protective defaults, targeted advertising, data minimization, risk assessments and the use of children’s data to personalize content.
The result is a particularly complex compliance environment: companies may face different triggers, age bands and substantive obligations from state to state, and a number of these laws remain subject to constitutional challenges or injunctions.
“The US may have a fragmented regulatory framework, but the enforcement message is increasingly consistent. Federal and state regulators are pursuing both the largest technology platforms and much smaller online businesses, and the consequences can be significant. Any company operating an online service that could reasonably attract teenagers—not just a service designed specifically for children—should be taking these developments seriously and considering youth privacy and safety as part of its core product compliance program.”
Jonathan Tam, Partner, San Francisco
Key trends
Safety-by-design is becoming the norm
Regulators are increasingly scrutinizing product features, algorithms, recommender systems and default settings, rather than focusing solely on content moderation.
Child protection is the primary policy driver
Many new online safety laws are designed to reduce risks to minors, leading to requirements around age assurance, safer defaults and enhanced safeguards for younger users.
Proactive risk management is replacing reactive enforcement
Organizations are increasingly expected to identify, assess and mitigate risks before harm occurs through risk assessments, robust governance frameworks and ongoing monitoring.
Platform accountability is increasing
Regulators are imposing greater transparency, reporting and compliance obligations alongside stronger enforcement powers and significantly higher penalties for non-compliance.
What this means for businesses
Online safety must be embedded in product development, governance and risk management from the outset. Organizations that build safety considerations into the design and operation of their products will be better placed to meet evolving regulatory expectations, reduce regulatory risk and adapt to future reforms. In the emerging regulatory landscape, online safety is no longer simply a moderation issue. It is increasingly a core product governance discipline. Organizations should increasingly assess how recommendation systems, AI-enabled features, direct messaging functions, user-generated content tools, age assurance measures and reporting mechanisms may create or amplify risks particularly for children and other vulnerable users.
