When “we have policies” is no longer enough.

What the policy now expects.

The direction of travel in UK online-safety policy has moved through three stages. First came the duty to have rules: terms of service, age limits, reporting routes. Then came the duty to enforce them: moderation teams, takedown processes, transparency reports. The Growing Up in an Online World agenda, and Ofcom’s enforcement posture under the Online Safety Act, mark the third stage — a duty to demonstrate effectiveness.

That word changes the conversation inside a platform. A policy can be written in an afternoon, and an age gate pointed at in an audit. Effectiveness has to be evidenced: what was detected, how early, what happened next, and what the outcome was for the young person involved. Ofcom’s own language — failsafe protections, highly effective age assurance — describes results, not intentions.

The detection gap.

Most safety tooling in use today examines individual pieces of content: a message, an image, an upload. Each item is checked against rules or classifiers, and each is judged on its own. That approach catches what is harmful in isolation — and misses what is only harmful in sequence.

Grooming is the clearest example: safeguarding failures rarely happen in message one; they happen around message forty, after weeks of individually innocuous contact. The same is true of bullying pile-ons, scam scripting aimed at young account-holders, and radicalisation pathways. These are behaviours that develop through sequences of interactions over time — and a system that only reads one message at a time is structurally unable to see them.

This is the gap the policy shift exposes. A platform can be fully compliant on paper — policies published, filters running, reports actioned — and still be unable to evidence that developing harm is detected before it lands. Demonstrating effectiveness means being able to show detection at the level where the harm actually operates.

Practical questions for your team.

Whether you build, buy, or blend your detection capability, these are the questions the effectiveness agenda will ask of it. They are worth asking internally first.

1. Sequence, or snapshot?Does our detection assess interactions across time and across surfaces — public channel to private message — or does it judge each item alone?
2. How early?At what point in a developing pattern would our systems first raise a signal — and what evidence could we show a regulator of that timing?
3. Calibrated for age?Do detection thresholds account for the age of the people in the conversation, or is a child’s exchange assessed by the same rules as an adult’s?
4. Every modality?As interaction moves into voice, image and video, does detection follow it — or does coverage stop at text?
5. An evidence trail?If asked to demonstrate effectiveness — by Ofcom, a board, or a family’s lawyers — what record of detection and intervention could we actually produce?
6. Privacy by design?Can we evidence detection without retaining the content of children’s conversations — and would our answer satisfy both the safety regulator and the privacy one?