Ofcom has also published details of its regulatory approach and timelines regarding the new legislation.
The Online Safety Act 2023 has finally received Royal Assent, after completing the parliamentary process in September.
The Act imposes on duties on social media regarding the content they host. These duties include:
In addition to protecting children, the Act also aims to empower adults to have enhanced control of what they see online. It provides three layers of protection for internet users which aim to:
If social media platforms do not comply with these rules, Ofcom has power to issue fines of up to £18 million or 10% of their global annual revenue, whichever is higher.
The Act also aims to address violence against women and girls. Through the Act, it will be easier to convict someone who shares intimate images without consent and new laws will further criminalise the non-consensual sharing of intimate deepfakes.
The change in laws also now make it easier to charge abusers who share intimate images. Criminals found guilty of this base offence will face up to six months in prison, but those who threaten to share such images, or shares them with the intent to cause distress, alarm or humiliation, to obtain sexual gratification, could face up to two years in prison.
Most of the Act's provisions come into force in two months' time.
Ofcom has announced that it will give guidance and set out codes of practice on how in-scope companies can comply with their duties, in three phases, as set out in the Act.
Phase one: illegal harms duties
It will publish draft codes and guidance on these duties for consultation on 9 November 2023, including:
Following consultation, Ofcom plans to publish a statement on its final decision in Autumn 2024. the codes of practices will then be submitted to the Secretary of State for Science, Innovation and Technology, and subject to approval, laid before Parliament.
Phase two: child safety, pornography and the protection of women and girls
Child protection duties will be set out in two parts: guidance on age assurance, which will be relevant to all services in scope of Part 5 of the Online Safety Act, and codes of practice relating to protection of children.
Alongside this, Ofcom plans to consult on:
It expects to publish draft guidance on protecting women and girls by Spring 2025, when it will have finalised its codes of practice on protection of children.
Phase three: transparency, user empowerment, and other duties on categorised services
A small proportion of regulated services will be designated Category 1, 2A or 2B services if they meet certain thresholds set out in secondary legislation to be made by the government. The final stage of implementation focuses on additional requirements that fall only on these categorised services. Those requirements include duties to:
Ofcom will issue a call for evidence on these duties in early 2024 and a consultation on draft transparency guidance in mid-2024.
Ofcom must produce a register of categorised services. It will advise the UK government on the thresholds for these categories in early 2024, and the government will then make secondary legislation on categorisation, which is currently expected by summer 2024. Assuming this is achieved, Ofcom will: