Ofcom’s Online Saftey Act comes into force
December 16, 2024

Tech firms are now legally required to start taking action to tackle criminal activity on their platforms in the UK, and make them safer by design.
Ofcom has published its first-edition codes of practice and guidance on tackling illegal harms (four months ahead of schedule) – such as terror, hate, fraud, child sexual abuse and assisting or encouraging suicide – under the UK’s Online Safety Act.
The Act places new safety duties on social media firms, search engines, messaging, gaming and dating apps, and pornography and file-sharing sites. Before the media regulator can enforce these duties, it is required to produce codes of practice and industry guidance to help firms to comply, following a period of public consultation.
Platforms will now have three months to carry out risk assessments identifying potential harms on their services, or they could be fined up to 10 per cent of their global turnover.
Dame Melanie Dawes, Ofcom’s Chief Executive, commented: “For too long, sites and apps have been unregulated, unaccountable and unwilling to prioritise people’s safety over profits. That changes from today. The safety spotlight is now firmly on tech firms and it’s time for them to act. We’ll be watching the industry closely to ensure firms match up to the strict safety standards set for them under our first codes and guidance, with further requirements to follow swiftly in the first half of next year. Those that come up short can expect Ofcom to use the full extent of our enforcement powers against them.”
Ofcom advises that the first set of codes and guidance, which sets up the enforceable regime, is a foundation on which it will build. The regulator is already working towards an additional consultation on further codes measures in spring 2025. This will include proposals in the following areas:
- blocking the accounts of those found to have shared CSAM;
- use of AI to tackle illegal harms, including CSAM;
- use of hash-matching to prevent the sharing of non-consensual intimate imagery and terrorist content; and
- crisis response protocols for emergency events (such as last summer’s riots).
The current codes and guidance are part of a much wider package of protections – 2025 will bring more consultations and duties coming into force, including:
- January 2025: final age assurance guidance for publishers of pornographic material, and children’s access assessments;
- February 2025: draft guidance on protecting women and girls; and
- April 2025: additional protections for children from harmful content promoting, among other things – suicide, self-harm, eating disorders and cyberbullying.
The Act also enables Ofcom to make a provider use (or in some cases develop) a specific technology to tackle child sexual abuse or terrorism content on their sites and apps.
Lina Ghazal, Head of Regulatory Affairs from the online safety experts at Verifymy, commented: “The implementation of the UK’s Online Safety Act (OSA) is set to bring in dramatic changes to the online ecosystem in a bid to keep children safe online. Adult sites are the first in Ofcom’s spotlight as they will be required to effectively verify the age of every user, starting January 2025. Many popular platforms have worked closely with Ofcom over the last two years to get ready for this change. However, there will be many still scrambling to comply and others resigned to test how serious Ofcom is about enforcement. Ofcom’s arsenal is significant – including hefty fines, cutting payment and revenue streams and blocking access for UK users. The challenge will be how swiftly and effectively they can tackle non-compliance, particularly with the majority of sites being based outside of the UK.”
“For consumers of adult content, new age verification hurdles will likely come as a surprise. The majority of porn viewers will be unaware of these changes until the expected barrage of awareness campaigns from various stakeholders in the sector begin. There is likely to be concern around the types of age assurance they can use, particularly those using ID or financial information, as well as the safety and privacy of any information shared.”
“The industry will need to reassure users that information will not be shared with adult entertainment sites, that it is only used to confirm whether they are of the correct age, and that it will be immediately deleted by verification providers once authentication is complete. We expect many sites will also opt for methods with the lowest possible friction, such as email-based age estimation. Users are sure to be put off by clunky or onerous systems and will inevitably gravitate to those with the smoothest user experience.”
“The conversation over the next few weeks is likely to be confused as these new measures play out, but it’s crucial for both adult sites and their users that they adapt quickly to the new realities of the OSA and its impact on accessing adult content online. As encouraged recently by Technology Secretary Peter Kyle, the regulator has a key role to play in fostering a level playing field and ensuring the effective implementation of the OSA,” Ghazal concluded.