Ofcom’s approach to implementing the Online Safety Act: A timeline
Since October 2023: What we know so far
The Online Safety Act (OSA) received Royal Assent in October 2023 and mandates social media platforms and search engines to take action against illegal and harmful content, with a particular focus on protecting children.
The Act mandates a "duty of care" for online service providers, particularly those catering to children. This includes protecting them from harmful content, such as violent or self-harm-promoting material. The Act sets out obligations for highly effective age assurance to be implemented for all sites and apps that display or publish pornographic content - they must ensure that children are not able to encounter pornography on their service. Additionally, other user-to-user services that allow pornographic content on their service must also do similar, implementing highly effective age assurance to prevent children from encountering it.
To achieve this, the Act emphasises robust age assurance measures. Providers must implement age verification or estimation (or both) to ensure children don't encounter inappropriate content. While the Act allows flexibility in the chosen methods, they must be highly effective at keeping children safe.
October 2024: An update from Ofcom on progress since the Online Safety Act became law
The Act places a legal obligation on companies providing a wide range of online services to ensure the safety of their users, particularly children. The rules apply to all in-scope services with a significant UK user base or target the UK market, regardless of the company's location, and these businesses must now take proactive steps to assess and mitigate risks to UK users.
So far, Ofcom’s steps to enforcing the Act have consisted of:
November 2023:
- Ofcom started with a consultation on illegal harms online
December 2023:
- Ofcom releases draft guidance outlining how online pornography services should implement highly effective age assurance to prevent children from accessing explicit content.
May 2024:
- Ofcom released proposals detailing how services should meet their new responsibilities concerning harmful content to children.
Starting in December 2024, online services must take action to meet their legal obligations.
Ofcom will publish Codes of Practice and guidance to support companies that fall under the Act in complying with these requirements. If you operate an online service, you must prepare to take the necessary steps as these duties come into force.
Ofcom has provided a countdown to a safer life online, explaining the important milestones. However, a breakdown of the key 3 phases can be found below:
Phase one: illegal harms
Ofcom will publish several key documents related to illegal harms and online safety. Key dates and actions are as follows:
December 2024: Publication of the Illegal Harms statement, including:
- First edition of the Illegal Harms Codes of Practice
- Guidance on illegal content risk assessment
- Final enforcement guidance
- Final record-keeping and review guidance
March 2025:
- Service providers must complete their illegal content risk assessments by this deadline.
- Illegal harms safety duties are expected to become enforceable. Providers must follow the Codes of Practice or apply other effective measures to protect users, and Ofcom empowered to enforce compliance.
Spring 2025: Ofcom to launch a new consultation building on the foundations established in the first Codes.
Phase two: child safety, pornography and the protection of women and girls
Key timings and actions:
January 2025:
- Final age assurance guidance for publishers of pornographic content will be issued.
- Enforcement of duties for part 5 providers (pornography) begins.
- Final guidance on children’s access assessments will be published, and service providers will have three months to complete them.
April 2025:
- Protection of Children Codes and risk assessment guidance published.
- Services likely accessed by children must conduct children’s risk assessments within three months (by July 2025).
February 2025:
- Draft guidance on protecting women and girls will be published, addressing content and activities that disproportionately impact them.
July 2025: Child protection safety duties expected to become enforceable.
Phase three: categorisation and additional duties for categorised services
A small number of regulated services will fall into Category 1, 2A, or 2B if they meet thresholds set out in secondary legislation by the Government. These services will face extra requirements focused on increasing safety, transparency, and accountability.
Key timings and actions:
End of 2024: Government to confirm thresholds for categorised services.
Summer 2025: Publish register of categorised services.
Following Summer 2025: Issue draft transparency notices within a few weeks of the register's publication, followed by final notices shortly after.
Early 2026: publish draft proposals regarding the additional duties on categorised services
How can Verifymy support?
Verifymy offers a wide range of age estimation and age verification solutions. We can supply highly effective age assurance solutions, which will be required by the Act to prevent minors from seeing what is termed “Primary Priority Content”, such as suicide and self-harm information as well as pornography.
We can also help estimate users’ ages to protect them from other “Priority Content,” which includes bullying and harmful challenges.
Our email address age estimation solution uses just an email address to determine the age of users online to a very high degree of accuracy. It's not just an age assurance tool; it's a game-changer in simplifying age check processes and ensuring age-appropriate experiences online. It can be deployed in the background with no user interaction required, eliminating the hassle of age verification for your entire user base and minimising any business disruption.
Get in touch to learn more.