The Online Safety Act gives Ofcom powers to require and obtain information it needs to exercise, or decide if to exercise, its online safety duties and functions. Following consultation, it has issued its final guidance about how and when it might use these powers. The guidance takes effect immediately.
The guidance is not binding and is intended to be flexible to allow it to consider the individual circumstances in which it might use its powers. It also sets out the factors that Ofcom may consider when deciding whether to exercise its powers. In addition, it explains the legal duties imposed on regulated services and other third parties in relation to information gathering and sets out Ofcom’s expectations about how services or other third parties should respond when it seeks information.
Ofcom says that there was broad support for its draft Guidance. However, it has addressed some feedback in the final guidance. The key changes are:
- It provides more information about the protections the Act provides in relation to Ofcom’s disclosure to overseas regulators.
- It provides further detail about when and how it will use its powers to require tests or demonstrations, including the use of datasets for this purpose, and other general mechanics of some of the powers, such as remote viewing. It also provides further detail about its approach to user privacy and the security of stakeholders’ systems.
It has also:
- Made some minor changes to the Guidance on the Coroner’s Information Notice Power based on its recent experience of exercising this power.
- Made certain changes to mirror the approach taken in its General Policy on Information Gathering, which it published in December 2024.
Failure to comply with a request for information (information notices) from Ofcom in an accurate, complete, and timely way will have consequences for firms. It could result in tech companies facing fines of up to £18m or 10% of their worldwide revenue – whichever is higher. Or, in the most extreme cases, there could be criminal liability.
In 2024, Ofcom fined TikTok, under the separate rules governing video-sharing platforms, for failing to respond to a request for information about its parental controls. Its investigation into OnlyFans’ compliance with a request for information remains ongoing.
