The Online Safety Act 2023 (OSA) imposes legal duties on providers of three types of internet services (user to user services, search services, and pornographic content services) to protect their users from online harms. The duties under the OSA also apply to in-scope providers based outside of the UK that either have a significant number of UK users, target the UK market, or pose a material risk of harm to UK users.
WHAT'S THE LATEST?
In a statement published on 17 March, Ofcom confirmed that its Illegal Harms Codes of Practice (the "Illegal Harms CoP") have now come into force, requiring in-scope providers to implement the specific measures set out in the Illegal Harms CoP in order to (among other things) prevent users from encountering illegal content, mitigate the risk of harm to individuals arising from such content and swiftly take down such content on being alerted to its presence. In-scope providers are also required to publish via their terms of service or (in the case of search services) via a publicly available statement, details of the measures adopted to protect users from illegal content.
Illegal content is defined under the OSA as content whose use, possession, viewing, accessing, publication or dissemination constitutes one of the offences listed in the OSA or in other legislation (for example offences relating to terrorism, hate, sexual abuse, fraud and assisting or encouraging suicide).
The Illegal Harms CoP, originally published on 16 December 2024, represent the regulator's first major milestone in relation to the implementation of the Online Safety Act 2023 (OSA). Ofcom has made clear that the illegal harm duties under the OSA are a key priority and the entry into force of the Illegal Harms CoP marks an important development on its roadmap.
Ofcom has made clear in its guidance that it will take a risk-based approach to enforcement and the extent to which an in-scope provider is expected to adopt each specific measure in the Illegal Harms CoP will depend on the level of risk posed by that provider's service. Ofcom will not require the same measures from small, lower-risk services as from larger, higher-risk ones.
Enforcement powers
As part of their 17 March statement, Ofcom announced that in the coming weeks and months, they will assess whether online platforms have complied with their new obligations under the OSA, and initiate enforcement actions where concerns have been identified. Ofcom has indicated that initial enforcement priorities will focus on child sexual abuse material present on file-sharing and file-storage services.
In cases of non-compliance, Ofcom has robust enforcement powers under the OSA, including the authority to issue fines of up to 10% of qualifying worldwide revenue or £18 million (whichever is greater), and in the more serious cases, Ofcom can also exercise business disruption measures, such as application to the court to block a website or service in the UK.
WHAT'S NEXT?
We will be following Ofcom's enforcement activity closely to gauge how Ofcom intend to approach enforcement. In particular, we will be tracking whether Ofcom use their strongest enforcement powers immediately or adopt a softer and more collaborative approach with in-scope providers aimed at identifying and addressing compliance issues. We will also monitor the extent to which Ofcom enforces the specific measures contained in the Illegal Harms CoP.
Looking beyond the Illegal Harms CoP, Ofcom has now transitioned into Phase 2 of its online safety roadmap, whose primary focus is on child safety, pornography and the protection of women and girls.
Following Ofcom's finalisation of its children's risk assessment guidance, expected in April 2025, services that are likely to be accessed by children must carry out a children's risk assessment within three months. The Children's Safety Codes of Practice, first published on 7 May 2024, will then come into force in July 2025.
Additionally, Ofcom is expected to publish the register of higher-risk, higher-reach 'categorised services' in Summer 2025. This will be a significant development for providers of categorised services, as they will need to comply with additional duties based on their category. Ofcom has expressed that there will be an opportunity for services to respond to consultations regarding these additional duties. Phase 3 of Ofcom's roadmap will focus on the additional duties that will apply to such categorised services, and draft codes of practice in relation to these services are expected to be published no later than early 2026.
WHERE CAN I READ MORE?
- To remain updated with the latest developments in relation to the Online Safety Act (and digital regulation more generally), click 'Subscribe' on the top right-hand corner of this page.
- For an overview of specific aspects of the OSA and the Codes of Practice and guidance published by Ofcom to date, see our 'Your questions answered' series on the OSA.
- For insights on online safety developments both in the UK and around the world, visit our Global Online Safety Hub.
- For an interactive visual overview of emerging online safety legislation around the world, visit our Global Online Safety Heatmap.
Key contacts
Key contacts
Simge Aslan
Trainee Solicitor, London
Disclaimer
The articles published on this website, current at the dates of publication set out above, are for reference purposes only. They do not constitute legal advice and should not be relied upon as such. Specific legal advice about your specific circumstances should always be sought separately before taking any action.