Today, the Online Safety Act received Royal Assent, meaning Ofcom’s (Office of Communications) powers as online safety regulator have officially commenced.

Ofcom is now moving quickly to implement the new laws and have today published their regulatory approach and timelines. They also set out how they will drive change in line the with aims of the Act and support services to comply with their new legal obligations.

The Online Safety Act makes companies that operate a wide range of popular online services legally responsible for keeping people, especially children, safe online. Services must do this by assessing and managing safety risks arising from content and conduct on their sites and apps.

Services in scope of the new rules include user-to-user services such as social media photo and video-sharing services, chat and instant messaging platforms, online and mobile gaming, as well as search services and pornography sites.

Ofcom’s role

Our focus will be on the services and features that pose the greatest risk of harm to UK users. This will involve ongoing regulatory supervision of the largest and riskiest services.

Importantly, they will not be instructing firms to remove particular pieces of content or take down specific accounts. Instead, Ofcom will be tackling the root causes of online content that is illegal and harmful for children, by seeking systemic improvements across the industry – thereby reducing risk at scale, rather than focusing on individual instances.

Ofcom will need to strike an appropriate balance, intervening to protect users from harm where necessary, while ensuring that regulation appropriately protects privacy and freedom of expression, and promotes innovation.

How Ofcom will drive change

Ofcom expect industry to work with them and they expect change. Specifically,  Ofcom will be focused on ensuring that tech firms:

• have stronger safety governance, so that user safety is represented at all levels of the organisation – from the Board down to product and engineering teams;
• design and operate their services with safety in mind;
• enable users to have more choice and control over their online experience; and
• are more transparent about their safety measures and decision-making to promote trust.

Where Ofcom identify compliance failures, they can impose fines of up to £18m or 10% of qualifying worldwide revenue (whichever is greater).

Dame Melanie Dawes, Ofcom’s Chief Executive, said: “These new laws give Ofcom the power to start making a real difference in creating a safer life online for children and adults in the UK. We’ve already trained and hired expert teams with experience across the online sector, and today we’re setting out a clear timeline for holding tech firms to account.

“Ofcom is not a censor, and our new powers are not about taking content down. Our job is to tackle the root causes of harm. We will set new standards online, making sure sites and apps are safer by design. Importantly, we’ll also take full account of people’s rights to privacy and freedom of expression. We know a safer life online cannot be achieved overnight; but Ofcom is ready to meet the scale and urgency of the challenge.”

Implementation roadmap

The new laws will roll out in three phases as follows, with the timing driven by the requirements of the Act and relevant secondary legislation:

Phase one: Illegal content

Ofcom is publishing their first consultation on illegal harms – including child sexual abuse material, terrorist content and fraud – on 9 November 2023. This will contain proposals for how services can comply with the illegal content safety duties and draft codes of practice.

Phase two: Child safety, pornography, and protecting women and girls

Ofcom first consultation, due in December 2023, will set out draft guidance for services that host pornographic content. Further consultations relating to the child safety duties under the Act will follow in Spring 2024, while they will publish draft guidance on protecting women and girls by Spring 2025.

Phase three: Additional duties for categorised services

These duties – including to publish transparency reports and to deploy user empowerment measures – apply to service which meet certain criteria related to their number of users or high-risk features of their service. Ofcom will publish advice to the Secretary of State regarding categorisation, and draft guidance on their approach to transparency reporting, in Spring 2024.

Subject to the introduction of secondary legislation setting the thresholds for categorisation, Ofcom expect to publish a register of categorised services by the end of 2024.

Further proposals, including a draft code of practice on fraudulent advertising and transparency notices will follow in early and mid-2025 respectively, with our final codes and guidance published around the end that same year.

More detailed information (PDF, 1.3 MB) about the different implementation phases is available.

Source: Ofcom