Ofcom consults on protecting people from illegal harms under the Online Safety Act

Ofcom has published its consultation on protecting people from illegal harms online. This is the first of four major consultations planned by Ofcom over the next 18 months under the Online Safety Act (OSA). 

What's in the consultation?

The consultation focuses on:

• the causes and impacts of illegal harms
• how services should assess and mitigate the risk of illegal harms
• how services can identify illegal content
• Ofcom's approach to enforcement.

As part of this, Ofcom has also published first draft codes of practice and associated guidance which will form the bedrock of compliance with the illegal harms regime. These cover:

• draft service risk assessment guidance
• draft guidance on record keeping and review
• draft illegal content codes of practice for user-to-user and search services
• draft guidance on content communicated ‘publicly’ and ‘privately’ under the Online Safety Act
• draft guidance on judgement for illegal content
• draft enforcement guidance.

Helpfully Ofcom has provided a 15-page at a glance summary containing a useful table, and a summary of each chapter to provide a way in. Measures proposed for services are broken down into which measures are likely to apply to services based on their size, and the level of risk for illegal harms, classified by Ofcom as either low risk, specific risk, or multi-risk. Ofcom proposes defining a service as large where it has an average user base of more than 7 million per month in the UK (roughly 10% of the UK's population).

What to do now

Ofcom anticipates around 100,000 services will need to consider the Online Safety Act. While many of the safety measures will only apply to the larger and higher-risk services, all in-scope services, even the smaller, lower-risk ones, will have a range of obligations, including risk assessment and mitigation, report and complaints and record-keeping. Most businesses will also need to make changes to their terms of service. Ofcom has published an overview and quick guides for online services setting out ‘what you need to know’  to help them understand the first steps. Those impacted by the OSA will need to look at the consultation and associated documents in full - no easy task given they run to over one thousand pages - and may want to consider responding by the deadline of 5pm on 23 February 2024. 

Next steps

Once the consultation closes, Ofcom will consider the responses, review its proposals and publish a statement setting out its final decisions together with final versions of the above guidance and codes of practice. The statement is expected in Winter 2024 and services will then have three months to conduct their risk assessments. The codes of practice will be subject to Parliamentary approval and are expected to come into force by the end of 2024.  As such, in-scope service providers have some time to prepare for compliance around illegal harms, but now that they have more (albeit draft) detail, they can begin a more thorough assessment of what they will need to do. The next phase of consultations will focus on child safety, pornographic content and protecting women and girls, and is expected in December 2023.

Find out more

For more on what is covered by the OSA, see our Interface edition. We'll also be holding a webinar on 5 December when we'll look at the impact of the OSA on affected businesses in light of the Ofcom consultation, as well as in the context of the EU's Digital Services Act. Register your interest here.