Update: How Ofcom is preparing to regulate online safety

Online safety Illegal and harmful content Information for industry
Published: 15 June 2023
Last updated: 12 October 2023

Today we have published this update on how Ofcom is preparing to regulate online safety, including expected timescales and what's changed since we published our roadmap.

With the Online Safety Bill at the final stages of the parliamentary process, here is a summary of the main developments in Ofcom’s preparations for our new role as regulator since we published our roadmap to regulation in July 2022.

We will still take a phased approach to codes and guidance consultations, but timings have changed

We still plan to publish our codes and guidance in three phases. However, the estimated timings for these that we set out in the roadmap have been revised. Our previous working assumption was Royal Assent in early 2023. That is now likely to be autumn 2023.

Once Ofcom’s powers commence, we will start publishing our three phases of consultations. We set out below those milestones that will be of particular interest to services that are likely to be in scope of regulation. Here are our latest plans for what these will include and timings for publication.

Phase one: illegal harms duties

Our previous commitment was to publish our first draft codes of practice within 100 days of our powers commencing. As we have had more time to prepare these, we now expect to publish the codes very shortly after commencement. These will set out measures that regulated services can take to mitigate the risk of illegal harm.

We will also publish:

  • a register of risks relating to illegal content, and risk profiles of service characteristics that our assessment has found to be associated with heightened risk of harm;
  • draft guidance to services on how to conduct their own risk assessments and on how services can identify illegal content;
  • draft guidance on record keeping; and
  • Ofcom’s draft enforcement guidelines.

Phase two: child safety duties and pornography

Child protection duties will be set out in two parts. First, online pornography services and other interested stakeholders will be able to read and respond to our draft guidance on age assurance from autumn 2023 (subject to the final shape of the Bill and the timing of Royal Assent). This will be relevant to all services in scope of Part 5 of the Online Safety Bill.

Secondly, regulated services and other interested stakeholders will be able to read and respond to draft codes of practice relating to protection of children, around six months after our powers commence.

Alongside this, we expect to consult on:

  • a register of risks and risk profiles relating to harms to children; and
  • draft risk assessment guidance focusing on children’s harms.

Phase three: transparency, user empowerment, and other duties on categorised platforms

A small proportion of regulated services will be designated Category 1, 2A or 2B services if they meet certain thresholds set out in secondary legislation to be made by Government. Our final stage of implementation focuses on additional requirements that fall only on these categorised services. Those requirements include duties to:

  • produce transparency reports;
  • provide user empowerment tools;
  • operate in line with terms of service;
  • protect certain types of journalistic content; and
  • prevent fraudulent advertising.

Ofcom must produce a register of these categorised services. We will advise Government on the thresholds for these categories, and Government will then make secondary legislation on categorisation. Industry and other stakeholders will have the opportunity to provide us with information and evidence to feed into our advice or Government through a call for evidence we will publish in summer 2023.

We are then aiming to send our advice to Government around six months after Royal Assent. We will publish the register of services as soon as possible after Government passes secondary legislation on categorisation.

We’ll consult with industry and other stakeholders on the substance of the overall duties for categorised services once our powers commence. We’re aiming to consult on our transparency guidance in the period between Royal Assent and Ofcom finalising the register of services, to allow us to launch our transparency regime as soon as possible. We’ll then consult on the remaining codes and guidance after the register is published. In preparation, we are planning to publish a further call for evidence in autumn 2023 on the duties that apply to categorised services.

Our new Online Safety Group

Ofcom launched a new Online Safety Group (OSG) on 1 April 2023, with Gill Whitehead appointed as Group Director. The group benefits from a wide range of expertise including people who worked at the biggest tech companies and experts in specific harms.

The OSG brings together several teams:

  • The policy development team is made up of policy experts in online harms and mitigations. They lead the work to develop, consult, and refine policy positions which establish the steps services should take to make users safe online.
  • The strategy delivery team ensures that our online safety work has a clear strategic focus and the cross-cutting operational coordination required to deliver against our priorities. It also leads on the partnerships strategy and engagement with non-regulated stakeholders such as civil society and law enforcement.
  • The new supervision team will lead Ofcom's engagement with online services, looking to drive improvements in how the most impactful services protect their users, and ensuring smaller services understand and can comply with the new regulations.
  • The technology policy and trust and safety technology teams are made up of subject matter experts who provide Ofcom with the evidence and understanding of how new and emerging technologies impact online safety. These teams also offer technical expertise, consultancy and guidance to colleagues across the group.

The OSG is also responsible for Ofcom’s regulation of video-sharing platforms (VSPs). Our broad aims in delivering the VSP regime are to raise standards, address non-compliance, increase transparency, and prepare for the future regime. Our first VSP report outlines the progress made in our first year and our strategy for the second year.

We will publish more updates if there are any significant changes to the timings or approach set out above.

You might've missed...

Since publishing our roadmap in July 2022, we have published several documents related to our online safety work – as well as announcements about enforcement action, international cooperation and more. Here are some examples:

Back to top