As many of our readers will be aware, the Online Safety Act 2023 (OSA) has a layered approach. This means that all organisations with in-scope services are subject to duties in relation to illegal content and, where applicable, duties to protect children from harmful content.  However, the extent of the duties imposed on a regulated organisation depends on: (i) the size of the relevant part of the service and (ii) the extent of risk to UK users arising from their use of such part of the service.  

Aspects of services with high reach or risk to UK consumers will, if they meet certain thresholds discussed below, be designated as category 1, 2A or 2B services (together Categorised Services) and have additional duties appropriate to reach and risk of such services. 

Under the OSA, Ofcom (the UK regulator appointed by the OSA) was required to research and advise the UK Secretary of State on the threshold conditions for each of the Categorised Services within 6 months of the OSA receiving Royal Assent (i.e. the process by which draft legislation becomes law). The Secretary of State will then consider the research and advice and any recommendations put to it by Ofcom before drafting secondary legislation applicable to the Categorised Services.

On 25 March 2024, Ofcom submitted its research and advice on the threshold conditions it considers are appropriate for designating parts of services as Categorised Services. Once the secondary legislation is passed, those parts of the services designated as Categorised Services will need to comply with various additional obligations, depending on whether they are a Category 1, 2A or 2B service, which focus on safety, transparency and accountability.

In summary, a service which is categorised as:

Ofcom’s findings and recommendations

Category 1 services

Ofcom’s findings: Category 1 services are intended to be applicable to the highest reach user to user services with the highest risk functionalities. Ofcom advised that the features of a service most relevant to content being disseminated quickly, easily and widely are: (i) content recommender systems and (ii) features which allow users to forward and/or re-share content, and that the impact of such features will increase as the userbase increases (i.e. more users = more sharing of content). 

Recommendation: Ofcom advised the Secretary of State that Category 1 services should be those services which:

• use a content recommender system and have more than 34 million UK users on the user-to-user part of the service (i.e. 50% of the UK population); or
• allow users to forward or reshare user-generated content and use a recommender system and have more than 7 million users on the user-to-user part of the service (i.e. 10% of the UK population).

Category 2A services

Findings:  Category 2A services are intended to be applicable to the highest reach search engine services. Ofcom referred to its draft risk assessment for illegal harms report which concluded that vertical search services (i.e. search services which are focussed on a specific topic or type of content) present a lower risk of harm than general (or general downstream) services due to their limited search functionality. Ofcom has therefore recommended that vertical search services are excluded from the Category 2A designation. As with Category 1 services, Ofcom also considered that the larger the number of users of a service, the greater the potential reach of search content.  (i.e. more users = greater potential reach and therefore risk  of harm from search content).

Recommendation: Ofcom has advised the Secretary of State that Category 2A services should be those services which are a search service that is not a vertical service and which has more than 7 million UK users on the search engine part of the service (i.e. 10% of the UK population).  

Category 2B services

Findings:  Category 2B services are intended to be applicable to other services which have potentially higher risk functionalities. Ofcom considered which functionalities of services play a key role in the dissemination of content which is illegal and content  which is harmful to children and advised the Secretary of State that direct messaging is particularly relevant function since it allows users to directly disseminate illegal content and content which is harmful to children to other uses, without other users being able to see or access this content.  As with Category 1 and 2A services, Ofcom also considered that a larger user base is relevant to Category 2B services (i.e. the greater the number of users of a service the more users which may encounter illegal content or content which is harmful to children or which may be targeted by malicious users).  

Recommendation: Ofcom advised the Secretary of State that Category 2B services should be those services which allow users to send direct messages and have more than 3 million UK users on the user-to-user part of the service (i.e. 5% of the UK population).

What can we expect next?

The Secretary of State will now consider the recommendations put to it by Ofcom and put forward draft secondary legislation on Categorised Services. Once passed, Ofcom will gather information from all services regulated under the OSA before publishing a register of Categorised Services (together with a list of emerging Category 1 services). This register will determine which companies will need to comply with the additional duties imposed on Categorised Service under the OSA.

In terms of timing, Ofcom has indicated that (provided the secondary legislation is finalised by this summer), it expects to publish the list of Categorised Services by the end of this year. Ofcom has then advised that it will publish draft proposal regarding the additional duties at the start of 2025.

Ofcom has also announced that it will shortly be publishing a Call for Evidence on the additional duties that will apply to Categorised Services and encourages those companies which believe they have services caught by the thresholds to participate in the Call for Evidence.

Like to hear more on this topic?

We have previously written about the Online Safety Bill here:

• Ofcom publishes illegal content guidance, Ally Clark, Duncan Calow (dlapiper.com)
• Online Safety Bill approved by Parliament and ready for Royal Assent, Ally Clark, Duncan Calow (dlapiper.com)
• Online Safety Bill passed by the House of Lords, Ally Clark, Duncan Calow (dlapiper.com)
• Online Safety Bill: Progress through Parliament & Ofcom Implementation, Elizabeth Bingham, Duncan Calow, Alex Lowe (dlapiper.com)
• Online Safety Bill arrives at the House of Lords, Ally Clark, Duncan Calow (dlapiper.com)
• Further amendments to the Online Safety Bill not ruled out: Parliament battling over the scope and detail of the Online Safety Bill, Ally Clark, Duncan Calow (dlapiper.com)
• The return of the Online Safety Bill, Ally Clark, Duncan Calow (dlapiper.com)