What's the issue?

The UK's Online Safety Act (OSA) was passed on 26 October 2023 and regulates user-generated online content, with a focus on illegal content and content that is harmful to children. Over the course of 2024, the timeline shifted slightly as discussed here, but Ofcom moved towards an operational regime with a multitude of consultations and draft legislation, particularly towards the end of 2024.

What's the development?

The compliance preparations ramped up significantly towards the end of last year. The culmination of these efforts for many of those in scope came on 16 December 2024, when Ofcom published its Statement on protecting people from illegal harms online. This is a decision on the Illegal Harms Codes and guidance which set out what user-to-user and search service providers need to do to comply with their illegal harms safety duties under the UK's Online Safety Act. Read more here.

On 20 November 2024, the government published its draft Statement of Strategic Priorities (SSP). Ofcom must have regard to these when carrying out its regulatory functions, including enforcement, and will be required to report back to the Secretary of State on the actions it has taken against the priorities. The reports against the SSP will help inform government action on online safety. The priorities will now be finalised with the input of online safety experts and campaigners ahead of Ofcom's starting to enforce the first safety duties under the OSA.

On 16 January 2025, Ofcom published its Age Assurance and Children's Access Statement under the Online Safety Act alongside:

• Guidance on highly effective age assurance and other Part 5 duties – this is guidance for pornography providers to help comply with s81 OSA duties, particularly to ensure that they use age verification or estimation (together age assurance) measures to prevent children from normally being able to encounter pornographic content

• Guidance on highly effective age assurance – this is for user-to-user and search services to help them implement highly effective age assurance (HEAA) to comply with their OSA obligations. Only services which do so are likely to be able to determine that children cannot access their services.

• Children's Access Assessments Guidance – for user-to-user and search services to help them comply with the requirement to assess whether children can access their services.

Relevant obligations are summarised in quick guides which are helpful starting points:

• Quick guide to children's access assessments

• Quick guide to highly effective age assurance.

On 16 January 2025, Ofcom also opened a new age assurance enforcement programme, focusing initially on Part 5 services that display or publish their own pornographic content. It will be contacting a range of adult services to advise them of their new obligations and it says it will not hesitate to take action and launch investigations against services that do not engage or ultimately comply.

Secondary and related legislation

Legislation was also introduced and in some cases finalised in December 2024. The Online Safety Act 2023 (Commencement No 4) Regulations 2024 were made on 10 December 2024 and bring into force sections of the OSA relating to pornography providers on 17 January 2025.

The draft Online Safety Act 2023 (Category 1, Category 2A and Category 2B Threshold Conditions) Regulations 2025 were laid before Parliament in December 2024. These are important as they will define the thresholds at which services become categorised and therefore subject to additional obligations under the OSA. The proposed thresholds have changed since Ofcom published its initial views in October 2024 and are now as follows:

Category 1: thresholds are met by a regulated user-to-user service where, in respect of the user-to-user part of the service it:

• has an average number of monthly active UK users of more than 34 million and uses a content recommender system, or 

• has an average number of monthly active UK users that exceeds 7 million, uses a content recommender system, and provides a functionality for users to forward or share regulated user-generated content on the service with other users of that service.

Category 2A: thresholds are met by a search engine of a regulated search service or a combined service where it has an average number of monthly active UK users exceeding 7 million and is not a search service which:

• only enables a user to search selected websites or databases in relation to a specific topic, theme or genre of search content and

• is facilitated by means of an arrangement between the provider of a regulated search service or combined service with one or more entities, which relies on an application programming interface or other technical means to present search results to users.

Category 2B: threshold conditions are met by a regulated user-to-user service where, in respect of the user-to-user part of that service, it has an average number of monthly users exceeding 3 million and provides a functionality for users to send direct messages to other users of the same service which is designed so that messages cannot be encountered by any other users of that service unless further action is taken by the user who sent or received the message.

The draft Regulations also explain what is meant by a recommender system and how to determine the number of active UK users. The register of categorised services will be published in summer 2025 with proposals on additional duties for categorised services due not later than early 2026.

The draft Data (Use and Access) Bill also proposes some amendments to the OSA in relation to research information and information accessible to coroners on the death of a child. Finally, on 7 January 2025, the government confirmed it will introduce further offences around sexually explicit deepfakes and taking intimate images without consent or installing equipment with intent to commit such offences although this will not be within the OSA itself.

What does this mean for you?

This is where the OSA regime takes off in earnest for in-scope service providers.

• Illegal harms duties - in-scope providers must assess the risk of illegal harms on their services by 16 March 2025. The Codes of Practice are expected to complete the Parliamentary process in time for the 17 March 2025 deadline at which point the illegal harms safety duties become enforceable by Ofcom. This means that providers need to take the safety measures set out in the Codes or use other effective measures to protect users from illegal content and activity. If services take alternative measures, the onus will be on them to demonstrate these are sufficient to achieve compliance, so, for the vast majority of in-scope services, the Codes of Practice and related regulatory documents and guidance will be the easiest route to compliance. Ofcom is "ready to take enforcement action if providers do not act promptly to address the risk on their services".

• Children's access assessments – all in-scope user-to-user and search services (Part 3 services) must carry out a children's access assessment to determine whether or not their service or part of it is likely to be accessed by children. These must be completed by 16 April 2025. Unless the services are using HEAA. Ofcom anticipates most of these services will have to conclude they are likely to be accessed by children within the meaning of the OSA. They will then need to comply with the children's risk assessment and safety duties.

• Measures to protect children on social media and other user-to-user services – Ofcom will publish its Protection of Children Codes and risk assessment guidance in April 2025. Services likely to be accessed by children will then need to conduct a children's risk assessment within three months ie by July 2025 and then implement protective measures in line with the Protection of Children Codes.

• Services that allow pornography – Part 5 services which publish their own pornographic content including some Generative AI tools must take immediate steps to introduce age checks and introduce HEAA by 17 January 2025. Services that allow user-generated pornographic content (Part 3 services) must have HEAA in place by July 2025.

The government has said it will keep the new online safety rules under review, particularly in relation to social media platforms and children. Appearing on the Laura Kuensberg Show on 12 January 2025, Peter Kyle, SoS for Science, Innovation and Technology, described the Online Safety Act as an inherited landscape "where we have seen a very uneven, unsatisfactory legislative settlement". He stopped short of committing to changing it or publishing further online safety legislation, but said he was open-minded on the subject. He did, however, say that the OSA contained some "very good powers" which he plans to use to tackle online safety concerns.