Ofcom publishes update regarding Online Safety Act implementation

Following publication by Ofcom of various consultations relating to implementation of the Online Safety Act (OSA) (including the illegal harms consultation in November 2023, the consultation on guidance for online pornography services in December 2023 and the consultation on proposed measures for protecting children in May 2024), we have been waiting to see whether Ofcom's original timeline for implementation of the OSA (which received royal assent in October 2023) would be pushed back as a result of the change in UK government over the summer. However Ofcom's latest update suggests Ofcom's implementation roadmap remains broadly on track, albeit with some reprioritisation of specific activities.

What are the key updates?

Illegal harms

The illegal harms duties remain the number one priority for Ofcom, and the regulator specifically references the acts of violence witnessed in the UK in August of this year as demonstrating the blurred lines between online and physical harms and providing further impetus to implement the new OSA requirements in this area as soon as possible.

In light of this, Ofcom intends to publish finalised illegal harms Codes of Practice and related guidance (including finalised risk-assessment guidance) by mid-December 2024. All in-scope user-to-user and search services will then need to complete their risk-assessments by mid-March 2025.

In-scope service providers will be required to comply with the illegal content safety duties under the OSA (and Ofcom will commence enforcement against non-compliance) from March 2025.

You can read more about the illegal harms duties (and related Ofcom Codes of Practice and guidance) in Chapter 2 of our 'Your questions answered' series on the OSA.

Protection of children

This is Ofcom's second priority, with finalised Children's Access Assessment guidance and guidance on age assurance for pornography providers due for publication in January 2025, and the finalised Codes of Practice for the protection of children to follow in April 2025 (by which time in-scope services will need to have completed their children's access assessments).

Service providers will need to comply with the children safety duties under the OSA (and Ofcom will commence enforcement against non-compliance) from July 2025 (by which time in-scope services will also need to have completed their children's risk assessments).

Ofcom will also be consulting on guidance related to the protection of women and girls in February 2025 (earlier than originally planned).

Additional illegal harms and protection of children measures

Ofcom has indicated that it intends to supplement the illegal harms and protection of children Codes of Practice with additional measures (some of which will be based on responses received as part of the consultations already undertaken) but will introduce these additional measures as part of a secondary consultation and implementation phase (starting in spring 2025) so as to avoid delaying publication of the first editions of the Codes of Practice.

Categorised services

Ofcom previously submitted advice to the former government in relation to the thresholds applicable for categorised services (which have enhanced obligations under the OSA), and is awaiting confirmation of those thresholds from the new government via secondary legislation. Within 5 months of this secondary legislation being passed (currently anticipated to take place by the end of 2024) Ofcom intends to draw up and publish the register of categorised services (which will involve Ofcom submitting formal and enforceable information requests to service providers to assess whether they meet the relevant thresholds).

In the meantime, Ofcom has re-prioritised its plans to implement the duties for categorised services, and will focus for the time being on implementing those duties relating to transparency reporting (which Ofcom sees as being fundamental to improving user safety by 'shining a light' on actions taken by service providers). With that in mind, Ofcom will publish finalised transparency guidance in early 2025, with the intention of issuing transparency notices (requiring categorised service providers to publish transparency reports, pursuant to s77 of the OSA) within a few weeks of the register of categorised services being finalised.

Publication of draft Codes of Practice in relation to other duties applicable to categorised services (including in relation to user empowerment tools, consistent application of terms of service and fraudulent advertising) will be pushed back by a year to early 2026.

Other key takeaways from Ofcom's update

1. Super-complaints regime: Ofcom is working together with the Department of Science, Innovation and Technology (DSIT) to develop and implement a super-complaints regime primarily aimed at enabling eligible entities to raise systematic online safety issues arising across services with the regulator. The criteria and procedural requirements for this super-complaints regime will be introduced via secondary legislation, following which Ofcom expects guidance on super-complaints to be published by Q4 of 2025.
2. Fees regime. The online safety regime will be funded by fees paid by providers of regulated services whose qualifying worldwide revenue meets or exceeds a certain threshold (and who are not exempt). The Secretary of State will set the relevant threshold based on Ofcom's advice. Ofcom is planning to consult on this regime in October 2024 and will submit its advice to the Secretary of State in April 2025, with the aim of implementing the fees regime (through secondary legislation) by the 2026/27 financial year.

What's next?

As mentioned, Ofcom's immediate priority is finalising the illegal harms codes and guidance by the end of this year (see above for further detail).

Ofcom has published a helpful page listing all of its upcoming actions and consultations relating to the Online Safety Act here.

Where can I read more?

• To keep on top of latest developments in relation to the Online Safety Act (and digital regulation more generally), click 'Subscribe' on the top right-hand corner of this page.
• For an easily-digestible overview of specific aspects of the OSA and the Codes of Practice and guidance published by Ofcom to date, see our 'Your questions answered' series on the OSA.
• For insights on online safety developments both in the UK and around the world, visit our Global Online Safety Hub