Ofcom has unveiled its latest timetable for rolling out the remaining phases of the Online Safety Act 2023, setting out when to expect new codes, guidance, statutory reports, and advice for the Secretary of State.
One headline is that we can expect the final guidance on protecting women and girls online on 25 November.
The government isn’t happy with the revised timetable. Secretary of State Liz Kendall has expressed her “deep disappointment in the delays to the overall implementation of additional duties on categorised services that have been set out in Ofcom’s roadmap”. She also says in a letter to Ofcom that “we should not be willing to accept delay: the Online Safety Act was a long time coming and people across the country have been waiting too long for the protections it brings”. She also reminds Ofcom that “delays in implementing duties, such as user empowerment, could hinder our work to protect women and girls from harmful content and protect users from antisemitism”.
So what’s the new timetable?
The rest of 2025
Safer online experiences for women and girls: As mentioned above, Ofcom has been consulting on ways to improve online safety for women and girls, with final guidance set for release on 25 November 2025. 18 months later, it will assess how well providers are protecting these groups.
Supporting bereaved families: In December, Ofcom will consult on draft guidance for platforms about sharing information on a deceased child’s online activity. These duties, relevant only to categorised services, are expected to take effect in late 2026.
Coroners’ investigations: December will also see updated guidance on data preservation and information notices to support coroners investigating a child’s online activity.
Industry fees: providers with “qualifying worldwide revenue” above a threshold (to be set by the Secretary of State for Science, Innovation and Technology) will soon be required to pay fees. Once the regime is in force, platforms will have four months to submit revenue data for the 2026/27 charging year.
What’s coming in 2026?
Super-complaints: after a consultation in September 2025, Ofcom will publish final guidance in February 2026, explaining how eligible entities can raise issues affecting multiple services or, in exceptional cases, a single service.
Technology notices: by April 2026, Ofcom will issue advice and final guidance on requiring providers to use accredited technology to detect and prevent child sexual exploitation, abuse, and terrorism content. Accreditation of technologies will follow the Secretary of State’s publication of minimum standards.
Media literacy: Ofcom’s draft recommendations on promoting media literacy were published in September 2025. Final recommendations are expected in spring 2026, aiming to help users gain digital confidence and critical skills.
Service categorisation: Following a legal challenge, Ofcom will invite representations from services it believes meet the categorisation thresholds in early 2026. The categorisation register and consultation on additional duties—covering fraudulent advertising, terms of service, user empowerment, ID verification, news and journalistic content, and content of democratic importance—will be published around July 2026. Final policy statements will follow by mid-2027, with some released earlier where possible.
Transparency reporting: Ofcom’s final guidance was issued in July 2025. Once the categorisation register is published, categorised services will be required to publish transparency reports by summer 2027, giving users insight into safety measures. Ofcom will begin publishing its own summary reports from 2028.
Age assurance: by July 2026, Ofcom will report on how services use age assurance and its effectiveness, following a recent call for evidence.
Additional safety measures: Ofcom is considering responses to its June 2025 consultation on new safety measures, including preventing illegal content from going viral and enhancing protections for children during livestreams. A statement is expected by autumn 2026.
Content harmful to children: Ofcom will review and report on the incidence and severity of harmful content for children in October 2026, advising on potential changes to priority content categories.
Online Information Advisory Committee: the Committee will publish its first statutory report by 1 November 2026, along with updates on individual projects.
2027 and beyond
App stores: by January 2027, Ofcom will report on children’s use of app stores, assessing their role in exposing children to harmful content and the effectiveness of age assurance measures. This will inform decisions on whether app store providers should be brought under the Act’s scope.
Ongoing activities
Ofcom has already completed key codes and guidance, set up its fees, super-complaints, and transparency reporting functions, and is driving compliance with core requirements. The government has announced new “priority” offences, including content encouraging self-harm, cyberflashing, and certain types of online pornography. Ofcom is working to implement these changes swiftly.
In early December, Ofcom will publish a report summarising the industry response since the Act’s duties came into force, along with its headline online safety priorities for 2026.
Although the government has expressed its disappointment at the Ofcom timetable, there are limits on what it can really do. The Secretary of State has the power to issue strategic guidance to inform the way Ofcom exercises its discretion in performing its online safety function, but this does not change Ofcom’s powers or legal obligations.
