Ofcom's approach to implementing the Online Safety Act

26 October 2023

Ofcom has set out our plans for putting online safety laws into practice, and what we expect from tech firms, now that the Online Safety Act has passed.

The Act makes companies that operate a wide range of online services legally responsible for keeping people, especially children, safe online. These companies have new duties to protect UK users by assessing risks of harm, and taking steps to address them. All in-scope services with a significant number of UK users, or targeting the UK market, are covered by the new rules, regardless of where they are based.

While the onus is on companies to decide what safety measures they need given the risks they face, we expect implementation of the Act to ensure people in the UK are safer online by delivering four outcomes:

  • stronger safety governance in online firms;
  • online services designed and operated with safety in mind;
  • choice for users so they can have meaningful control over their online experiences; and
  • transparency regarding the safety measures services use, and the action Ofcom is taking to improve them, in order to build trust.

We are moving quickly to implement the new rules

Ofcom will give guidance and set out codes of practice on how in-scope companies can comply with their duties, in three phases, as set out in the Act.

Phase one: illegal harms duties

We will publish draft codes and guidance on these duties on 9 November 2023, including:

  • analysis of the causes and impacts of online harm, to support services in carrying out their risk assessments;
  • draft guidance on a recommended process for assessing risk;
  • draft codes of practice, setting out what services can do to mitigate the risk of harm; and
  • draft guidelines on Ofcom’s approach to enforcement.

We will consult on these documents, and plan to publish a statement on our final decisions in Autumn 2024. The codes of practices will then be submitted to the Secretary of State for Science, Innovation and Technology, and subject to their approval, laid before Parliament.

Phase two: child safety, pornography and the protection of women and girls

Child protection duties will be set out in two parts. First, online pornography services and other interested stakeholders will be able to read and respond to our draft guidance on age assurance from December 2023. This will be relevant to all services in scope of Part 5 of the Online Safety Act.

Secondly, regulated services and other interested stakeholders will be able to read and respond to draft codes of practice relating to protection of children, in Spring 2024.

Alongside this, we expect to consult on:

  • analysis of the causes and impacts of online harm to children; and
  • draft risk assessment guidance focusing on children’s harms.

We expect to publish draft guidance on protecting women and girls by Spring 2025, when we will have finalised our codes of practice on protection of children.

Phase three: transparency, user empowerment, and other duties on categorised services

A small proportion of regulated services will be designated Category 1, 2A or 2B services if they meet certain thresholds set out in secondary legislation to be made by Government. Our final stage of implementation focuses on additional requirements that fall only on these categorised services. Those requirements include duties to:

  • produce transparency reports;
  • provide user empowerment tools;
  • operate in line with terms of service;
  • protect certain types of journalistic content; and
  • prevent fraudulent advertising.

We now plan to issue a call for evidence regarding our approach to these duties in early 2024 and a consultation on draft transparency guidance in mid 2024.

Ofcom must produce a register of categorised services. We will advise Government on the thresholds for these categories in early 2024, and Government will then make secondary legislation on categorisation, which we currently expect to happen by summer 2024. Assuming this is achieved, we will:

  • publish the register of categorised services by the end of 2024;
  • publish draft proposals regarding the additional duties on these services in early 2025; and
  • issue transparency notices in mid 2025.

Read the full update

Ofcom's approach to implementing the Online Safety Act (PDF, 1.3 MB)

Dull Ofcom o roi’r Ddeddf Diogelwch Ar-lein ar waith (PDF, 1.4 MB)

Rate this page

Was this page helpful?