The Online Safety Act 2003 (“OSA”) became law in October 2023, with the majority of the duties coming into effect in phases during the course of 2025. The OSA places duties on in-scope services to protect UK users from illegal harms and to protect children from online harm. Additional duties apply to services if they meet certain threshold conditions. The OSA includes a system for categorising online services – as Category 1, 2A or 2B - based on key characteristics, including user numbers and functionality.
As part of its phased implementation of the OSA, Ofcom has in the past few weeks issued draft information notices to online service providers to request information to enable Ofcom to assess if and how the service should be categorised. Once issued in final form, these information notices will be formal requests for data, helping Ofcom gather the necessary information to determine which services fall into specific categories based on user numbers and functionality. This categorisation process is key for identifying which services need to meet additional duties for categorised online services.
Categorisation Process
- Draft information notices: Ofcom has started issuing draft information notices to relevant providers. Ofcom generally issues information notices in draft form initially to ensure that the notice is appropriately worded, targeted and sufficiently clear for the recipient to respond to within the proposed timeframe. While it is not mandatory to respond to a draft information notice, Ofcom encourages providers to engage, especially if they have any questions or concerns.
- Final information notices: Once the secondary legislation completes the legislative process, Ofcom will send out final information notices. Providers are legally required to comply with the final notice, supplying the data specified for categorisation.
- Assessment and publication: With the data collected, Ofcom assesses and categorises services. Ofcom is expected to publish the register of categorised services in summer 2025, ensuring transparency and accountability.
Additional Duties of Categorised Services
The categorisation process is a crucial step in the implementation of the OSA as it will enable online services to understand which, if any, additional duties they will need to comply with.
Online services may be grouped into one of three main categories[1], each with specific additional duties:
| Category | Criteria | Additional Duties |
| Category 1 | Applies to services that either: - use a content recommender system and have more than 34 million UK users on the user-to-user part of its service (around 50% of the UK population); or
- allow users to forward or reshare user-generated content, use a content recommender system, and have more than 7 million UK users on the user-to-user part of its service (around 10% of the UK population).
| - Transparency reporting
- Enhanced requirements on risk assessments and record keeping
- Additional terms of service duties
- Protections for news publisher and journalistic content, and content of democratic importance
- Providing user empowerment features
- Providing user identity verification options
- Prevention of fraudulent advertising
- Disclosure of information about use of the service by a deceased child user
|
| Category 2A | Applies to search services that: - are not 'vertical' search services; and
- have more than 7 million UK users (around 10% of the UK population).
| - Transparency reporting
- Enhanced requirements on risk assessments and record keeping
- Prevention of fraudulent advertising
- Disclosure of information about use of the service by a deceased child user
|
| Category 2B | Applies to services that: - allow users to send direct messages; and
- have more than 3 million UK users on the user-to-use part of the service (around 5% of the UK population).
| - Transparency reporting
- Disclosure of information about use of the service by a deceased child user
|
Penalties
Failure to comply with Ofcom's information notices can lead to significant penalties under the OSA, including substantial fines. Non-compliance can also lead to criminal liability for named senior managers.
For more detailed information, please visit the Ofcom website and for a broader outlook on the OSA in 2025, you can read more in this Law-Now article. If you are keen to find out more about how to best prepare for the OSA, please contact one of the CMS team.
Co-authored by Florentina Terholli, Associate at CMS.
[1] Implementing the Online Safety Act: Additional duties for ‘categorised’ online services - Ofcom
Social Media cookies collect information about you sharing information from our website via social media tools, or analytics to understand your browsing between social media tools or our Social Media campaigns and our own websites. We do this to optimise the mix of channels to provide you with our content. Details concerning the tools in use are in our Privacy Notice.