Online Safety and Digital Regulation in Action: Key Recent Developments from Ofcom
The UK’s online and digital regulatory landscape continues to evolve at pace. Over recent weeks, Ofcom have announced a series of significant developments which provide a clear indication of the regulator’s priorities and the increasing expectations being placed on online platforms, telecommunications providers and digital service operators. Together, these developments reinforce the growing focus on online safety, fraud prevention and platform accountability.
Protecting children online with appropriate age checks
Ofcom has published a new report showing that age checks are now being deployed at an unprecedented scale. They say that whilst there are positive signs of progress, there is still much more to do and online services need to do better.
Ofcom reports that too many online services still don’t have age checks at all, whilst others have age checks which are not sufficient to comply with the law (the requirement is for highly effective age assurance, meaning they can reliably distinguish between children and adults online) or protect children. The new social media restrictions for under-16s will rely on appropriate age checks, making age assurance requirements even more significant and comprehensive over time. Ultimately, age assurance is likely to need to evolve into a whole-system approach, incorporating checks at operating system, device and app store level.
These developments highlight that age assurance is not a future compliance issue, it is a current operational requirement. Organisations offering online services that may be accessed by children should be reviewing their age assurance approach now.
TikTok is under investigation
Ofcom are investigating whether TikTok’s age checks are effective in preventing children from encountering harmful content.
Services like TikTok must use highly effective age assurance to identify child users so they can protect them from harmful online material. Currently, TikTok uses an ‘age inference’ method, which involves analysing a user’s activity and behaviour to estimate whether or not they are a child. Age inference is not included in Ofcom’s industry guidance as a method considered capable of being highly effective for age assurance purposes. Ofcom’s Age Assurance report also raises serious doubts about the effectiveness of some age inference models.
Ofcom’s investigation will therefore consider whether TikTok’s current method of age assurance is highly effective. The investigation is likely to be closely watched across the sector as it may provide clarity on the standards Ofcom expects when assessing whether age assurance measures are “highly effective” under the Online Safety Act framework.
New rules to stop scam text messages
Ofcom have announced new rules to block, limit and disrupt scam text messages with the aim of reducing fraud and protecting both consumers and businesses. The new rules require mobile network providers to adopt a new, robust approach to identify and disrupt fraudulent text messages.
To disrupt scam messages to individuals, mobile providers must collect information about scam messages, weblinks and phone numbers from their customers and from anti-fraud organisations. They must then block numbers used by scammers and identify and block scam messages in transit. Mobile providers must also set volume limits for pay-as-you-go SIM cards to try and stop bulk scam messages.
To disrupt business messaging scams, mobile operators and ‘aggregators’ that transmit businesses’ mobile messages must:
- Conduct upfront and ongoing customer due diligence checks.
- Prevent use of fake sender names.
- Apply incident management processes where scam activity is identified.
- Block scam messages in transit.
New, strengthened guidance has also been published to crack down on scam calls from abroad which imitate or “spoof” UK mobile numbers. The guidance sets out how telecoms companies should protect people in the UK from international calls that spoof UK mobile numbers, which people are more likely to trust and therefore answer than calls from an unknown international number. Telecoms companies should now withhold the caller ID of calls that appear to come from a UK mobile roaming abroad, unless they can verify its validity.
Published register of categorised services
Under the Online Safety Act, major online platforms, known as categorised services, are required to comply with a range of additional duties depending on the category into which they fall. Categorised services are also subject to increased regulatory scrutiny.
Ofcom has now published a register of categorised services which it will keep under review and update from time to time. Unsurprisingly, Category 1 services, with the most comprehensive additional duties, include Facebook, Instagram, TikTok and X.
Tackling fraud in paid-for advertising
Ofcom has published its proposals for what Category 1 and Category 2A services should do to tackle fraudulent paid-for advertising.
The draft fraudulent advertising code Ofcom is consulting on sets out the steps Ofcom thinks platforms should take to combat fraudulent advertising. The proposals include obligations on certain categorised services to:
- Assess risk and implement robust governance processes.
- Make it harder for fraudsters to open and operate advertising accounts.
- Carry out robust testing of AI ad generation tools made available to advertisers to reduce the risk of misuse.
- Strengthen reporting functions.
Once approved by Parliament, organisations who fail to comply with the Code will face enforcement action, including fines of up to £18 million or 10% of global revenue, whichever is greater.
Additional duties for major online services
Ofcom have published a broader set of draft rules under the Online Safety Act to make Category 1 services more accountable and give their users more control over their experience online. For these services, there are a range of proposed new requirements, including:
- Protecting news, journalism and content of democratic importance.
- Giving adult users more control, including greater control over the content they see and who sees their content.
- Being more accountable, including having clear and accessible terms of service which are consistently enforced, together with straightforward complaints processes.
Key takeaway
These developments demonstrate Ofcom’s increasingly active approach to implementing and enforcing the Online Safety Act, while continuing to strengthen the wider regulatory framework for online and digital safety.
Organisations operating online platforms, advertising services, telecommunications services and digital networks should continue to monitor regulatory developments closely and ensure that their governance, compliance and risk management frameworks evolve in line with regulatory expectations. In particular, organisations should review their approach to age assurance, fraud prevention, platform governance and transparency obligations to ensure they remain prepared for increased regulatory scrutiny and enforcement activity.
How we can help
Our Technology Team advises organisations on a wide range of digital regulation, online safety, data protection and technology law issues. We can help organisations understand and comply with current and upcoming obligations under the Online Safety Act and other digital regulation requirements, review governance frameworks and policies, assess contractual and regulatory risk and respond to emerging regulatory developments. If you would like to discuss how these developments may affect your organisation, please get in touch with Louise Thompson.
This article is for information only and does not constitute legal advice. We recommend seeking professional advice before taking any action on the information provided. If you would like to discuss your specific circumstances, please feel free to contact us on 0800 2800 421.
