As we get closer to the Online Safety Act biting, Ofcom has published a revised compliance timetable and a variety of consultations and the government has published its Statement of Strategic Priorities.
Revised compliance timetable
On 17 October 2024, nearly a year after the UK's Online Safety Act (OSA) became law, Ofcom published a revised timeline for OSA implementation with a timetable of key milestones. The timeline has shifted in some areas, in most cases slightly, but by a year in relation to duties on categorised services.
Ofcom says: “services will need to act to comply with their duties” from December 2024. The main dates are now:
Phase one: illegal harms
December 2024 – publication of illegal harms statement including illegal harms Codes of Practice and illegal content risk assessment guidance. Also, publication of final enforcement guidance and final record keeping and review guidance.
Mid-March 2025 - all providers must have completed illegal harms risk assessments.
March 2025 – illegal harms safety duties likely to become enforceable around this time after Codes of Practice have passed through Parliament, at which point service providers will need to take steps set out in the Codes (or alternative equivalent measures).
Spring 2025 – further consultation.
Phase two: child safety, pornography, protection of women and girls
January 2025 – final age assurance guidance for publishers of pornographic content and likely enforceability of duties relevant to part 5 providers. Also, final children's access assessments guidance.
February 2025 – publication of draft guidance on protecting women and girls.
April 2025 – services likely to be accessed by children to have completed children's access assessments. Also, publication of protection of children Codes and risk assessment guidance.
July 2025 – services to have completed children's risk assessments by July 2025 and child protection safety duties likely to become enforceable around this time.
Phase three – categorised services
End of 2024 – government expected to confirm categorisation thresholds.
Summer 2025 – expected publication of register of categorised services with draft transparency notices to be published a few weeks later and final transparency notices shortly after that.
Early 2026 – draft proposals on additional duties on categorised services to be published no later than this time.
In relation to categorised services, Ofcom has also published:
Ofcom is waiting for the government to confirm the categorisation thresholds for Category 1, 2A and 2B services. Ofcom's advice to the government was submitted to the government in March 2024 and recommended:
Category 1 should apply to services which meet either of the following conditions:
- Condition 1 – uses a content recommender system; and has more than 34 million UK users on the user-to-user part of its service, representing around 50% of the UK population; or
Category 2A should apply to services which meet both of the following criteria:
- is a search service but not a 'vertical' search service; and
Category 2B should apply to services which meet both of the following criteria:
- allows users to send direct messages; and
It is currently unclear whether these thresholds are likely to change.
Statement of Strategic Priorities
On 20 November 2024, the government published its draft Statement of Strategic Priorities (SSP). Ofcom must have regard to these when carrying out its regulatory functions, including enforcement and will be required to report back to the Secretary of State on the actions it has taken against the priorities. The draft priorities are:
- transparency and accountability
The reports against the SSP will help inform government action on online safety. The priorities will now be finalised with the input of online safety experts and campaigners ahead of Ofcom's starting to enforce the first safety duties under the OSA from Spring next year.
Further recent consultations
On 17 October 2024, Ofcom published information about steps it will take to issue information notices to relevant providers for categorisation under the OSA. Ofcom will begin engaging with providers it believes meets thresholds for categorisation once those categories have been decided and relevant secondary legislation has been laid in Parliament. At this point Ofcom will begin issuing draft information notices to providers it believes meet the thresholds. Providers are not required to respond to draft notices but Ofcom encourages all providers who receive them to engage with Ofcom, particularly if they have concerns or questions.
An impact assessment published by DSIT on 23 October 2024 calculated that the UK's online safety regime will offset regulatory costs to business and government if it prevents 1.3% of online harms. While the largest services will pay for the regulators' expenses, the assessment is that the highest costs will relate to content moderation. The assessment estimates the costs to business at around £2.8 billion for the first ten years with a further £0.2 billion of government costs.
On 24 October 2024, Ofcom launched a consultation on its fees and penalties under the Online Safety Act. The consultation sets out proposals for the definition and threshold of qualifying worldwide revenue (QWR), exemptions from the fees regime, Ofcom's approach to the Statement of Charging Principles, details which have to be supplied for fees notification, and proposals for QWR when setting maximum penalties. The consultation is open until 17:00 on 9 January 2025.
Ofcom is proposing the QWR threshold be in the range of £200-500 million with £250 million being its preferred threshold. It expects there will eventually be between 20 to 40 organisations paying fees. Ofcom also proposes an exemption based on UK referrable revenue – revenues from provision of regulated services to the UK user base – of less than £10 million in the relevant qualifying period. It expects that the percentage of QWR to be paid will be in the region of 0.02% of QWR. Ofcom does not expect to vary fees by the type of service or take anything other than QWR into account.
On 28 October 2024, Ofcom published a call for evidence on researchers' access to information from regulated online services under the Online Safety Act. Under the OSA, Ofcom is required to report on how and to what extent independent researchers can access information about online safety measures from providers of regulated services. Ofcom is seeking evidence and input on:
- How and to what extent independent researchers currently access information from providers of regulated services (albeit these have not yet been determined).
- The challenges that currently constrain information sharing for these purposes.
The consultation closes on 17 January 2025.
On 20 November 2024, the government announced the launch of a study to explore the effects of smartphone and social media use on children and to boost the evidence base around online harms and help direct future government action.
What do you need to do?
If you are in scope, check that you are on course to meet the revised timelines. Ofcom's duties and actions tables are a good place to start. You can also find out more about online safety requirements under the OSA and the EU's Digital Services Act here.
