On 16 December 2024, Ofcom published the Illegal Harms Codes of Practice (the "Codes"), marking the regulator's first major policy statement under the Online Safety Act (OSA). The Codes set out the steps that in-scope providers should take to address illegal harms including terror, hate, fraud, child sexual abuse, and assisting or encouraging suicide. The Codes follow Ofcom's consultation on Protecting people from illegal harms online which closed on 23 February 2024.
From the date of the Codes' publication, in-scope providers now have a statutory duty to conduct an Illegal Harms Risk Assessment to examine the risk of illegal harms on their platforms by 16 March 2025. Subject to the Secretary of State's approval, providers must then start implementing safety measures to mitigate these risks from 17 March 2025. Ofcom may take enforcement action if providers do not act promptly to address risks on their services.
- What are the key updates?
Under the OSA, obligations for in-scope providers become enforceable following the publication of codes of practice and guidance being finalised by Ofcom and secondary legislation being approved by the Secretary of State. As mentioned in our October update, illegal harms duties have been Ofcom's key priority under the OSA since it received Royal Assent in October 2023.
The publication of the Codes and associated deadline for compliance therefore marks a key milestone in the development of the OSA regime. The Codes set out more than 40 safety measures that platforms may introduce from March 2025 to reduce the risk of illegal harms on their platforms, including those designed to enhance senior accountability for safety, enable improved moderation, reporting, and safety tests, and counteract pathways to online grooming.
Appropriate measures are adjusted to account for the risk profile of the in-scope provider. For example, the Codes expect high-risk providers to use automated tools including URL detection and hash-matching to detect child sexual abuse material (CSAM).
- What's next?
The Codes are subject to review by the Secretary of State, whose decision is expected in early 2025. Ofcom is also working towards producing a further consultation in Spring 2025 on expansions to the Codes, including proposals around banning the accounts of those found to have shared CSAM, crisis response protocols for emergency events, and using AI to tackle illegal harms.
The publication of the Codes forms part of Phase 1 of Ofcom's implementation of the OSA. Codes and Guidance on the Protection of Children are expected to be published as part of Phase 2 in April 2025, with additional requirements for higher-risk, higher-reach categorised services as part of Phase 3 expected early in 2026.
- Where can i read more?
- To keep on top of latest developments in relation to the Online Safety Act (and digital regulation more generally), click 'Subscribe' on the top right-hand corner of this page.
- For an easily-digestible overview of specific aspects of the OSA and the Codes of Practice and guidance published by Ofcom to date, see our 'Your questions answered' series on the OSA.
- For insights on online safety developments both in the UK and around the world, visit our Global Online Safety Hub.
Key contacts
Key contacts
Georgie Green
Associate , London
Disclaimer
The articles published on this website, current at the dates of publication set out above, are for reference purposes only. They do not constitute legal advice and should not be relied upon as such. Specific legal advice about your specific circumstances should always be sought separately before taking any action.