On 17 October 2024, nearly a year after the UK's Online Safety Act (OSA) became law, Ofcom published a revised timeline for OSA implementation with a timetable of key milestones. The timeline has shifted in some areas, in most cases slightly, but by a year in relation to duties on categorised services.
Ofcom says: “services will need to act to comply with their duties” from December 2024. The main dates are now:
Phase one: illegal harms
December 2024 – publication of illegal harms statement including illegal harms Codes of Practice and illegal content risk assessment guidance. Also, publication of final enforcement guidance and final record keeping and review guidance.
Mid-March 2025 - all providers must have completed illegal harms risk assessments.
March 2025 – illegal harms safety duties likely to become enforceable around this time after Codes of Practice have passed through Parliament, at which point service providers will need to take steps set out in the Codes (or alternative equivalent measures).
Spring 2025 – further consultation.
Phase two: child safety, pornography, protection of women and girls
January 2025 – final age assurance guidance for publishers of pornographic content and likely enforceability of duties relevant to part 5 providers. Also final children's access assessments guidance.
February 2025 – publication of draft guidance on protecting women and girls.
April 2025 – services likely to be accessed by children to have completed children's access assessments. Also publication of protection of children Codes and risk assessment guidance.
July 2025 – services to have completed children's risk assessments by July 2025 and child protection safety duties likely to become enforceable around this time.
Phase three – categorised services
End of 2024 – government expected to confirm categorisation thresholds.
Summer 2025 – expected publication of register of categorised services with draft transparency notices to be published a few weeks later and final transparency notices shortly after that.
Early 2026 – draft proposals on additional duties on categorised services to be published no later than this time.
Ofcom has also published:
Ofcom is waiting for the government to confirm the categorisation thresholds for Category 1, 2A and 2B services. Ofcom's advice to the government was submitted to the government in March 2024 and recommended:
Category 1: should apply to services which meet either of the following conditions:
- Condition 1 – uses a content recommender system; and has more than 34 million UK users on the user-to-user part of its service, representing around 50% of the UK population
- Condition 2 – allows users to forward or reshare user-generated content; and uses a content recommender system; and has more than 7 million UK users on the user-to-user part of its service representing around 10% of the UK population.
Category 2A: should apply to services which meet both of the following criteria:
- is a search service but not a 'vertical' search service
- has more than 7 million UK users on the search engine part of its service representing around 10% of the UK population.
Category 2B – should apply to services which meet both of the following criteria:
- allows users to send direct messages
- has more than 3 million UK users on the user-to-user part of its service, representing around 5% of the UK population.
It is currently unclear whether these thresholds are likely to change.
What do you need to do?
If you are in scope, check that you are on course to meet the revised timelines. Ofcom's duties and actions tables are a good place to start. You can also find out more about online safety requirements under the OSA and the EU's Digital Services Act here.
