Ofcom has published an update on its progress to bring the Online Safety Act 2023 into effect. The Act means that companies that operate a wide range of online services are legally responsible for keeping people, especially children, safe online. Online platforms and services will soon have new duties to protect UK users by assessing risks of harm, and taking steps to address those risks. All in-scope services with a significant number of UK users, or targeting the UK market, are covered by the new rules, regardless of where they are based.
Ofcom consulted on illegal harms online in November 2023. In December 2023 it published draft guidance for online pornography services about how they should use highly effective age assurance so that children are not normally able to encounter pornographic material. In May 2024, Ofcom published proposals for how services should approach their new duties relating to content that is harmful to children.
From December 2024, services will need to act to comply with their duties. Ofcom will be publishing Codes of Practice and guidance on how in scope companies can comply with their duties.
Phase one: illegal harms
Ofcom will publish its Illegal Harms statement in December 2024. This will include the first edition of the Illegal Harms Codes of Practice and the illegal content risk assessment guidance. All providers of services in scope of the Act must complete their assessments by mid-March 2025. Once the Codes of Practice have passed through Parliament, service providers will need to take the steps set out in the Codes or use other effective measures to protect users and Ofcom can take enforcement measures against organisations that do not comply. Ofcom expects that the illegal harms safety duties will become enforceable around March 2025.
In December, Ofcom will also publish its final enforcement guidance, and final record keeping and review guidance. It also plans to consult further, building on the foundations established in the first Codes. in spring 2025.
Phase two: child safety, pornography and the protection of women and girls
In January 2025 Ofcom will issue its final age assurance guidance for publishers of pornographic content. It expects these duties to become enforceable around the same time and will start to monitor compliance.
It will also publish its final children’s access assessments guidance in January 2025. Service providers will then have three months to complete the children’s access assessment process. Services likely to be accessed by children must then carry out a children’s risk assessment within three months of Ofcom publishing its Protection of Children Codes and risk assessment guidance in April 2025. Those services should prepare to complete their children’s risk assessments by July 2025. Ofcom expects that the child protection safety duties will become enforceable around July 2025.
In February 2025, Ofcom will publish draft guidance on protecting women and girls, containing advice on content and activity which disproportionately affects women and girls, and on assessing and reducing the risk of harm to them.
Phase three: categorisation and additional duties for categorised services
A small proportion of regulated services will be designated Category 1, 2A or 2B services if they meet certain thresholds set out in secondary legislation to be made by the government. Ofcom’s final stage of implementation focuses on additional requirements that fall only on these categorised services. These categorised services will be required to comply with a range of additional requirements, depending which category they are in.
The next stage is for the government to confirm the thresholds for categorisation in secondary legislation, which it expects to take place by the end of 2024. Ofcom has reprioritised its work on the duties on categorised services with the aim of ensuring of delivering it delivers most quickly in the areas that it expects to be particularly beneficial in protecting users once the thresholds are confirmed. Ofcom expects to:
- publish the register of categorised services in summer 2025,
- issue draft transparency notices within a few weeks of publication of the register, and to issue final transparency notices soon after, and
- publish draft proposals regarding the additional duties on categorised services no later than early 2026.
