Online Safety Act: Ofcom issues draft information notices for categorisation
The Online Safety Act 2003 (“OSA”) became law in October 2023, with the majority of the duties coming into effect in phases during the course of 2025. The OSA places duties on in-scope services to protect UK users from illegal harms and to protect children from online harm. Additional duties apply to services if they meet certain threshold conditions. The OSA includes a system for categorising online services – as Category 1, 2A or 2B - based on key characteristics, including user numbers and functionality.
As part of its phased implementation of the OSA, Ofcom has in the past few weeks issued draft information notices to online service providers to request information to enable Ofcom to assess if and how the service should be categorised. Once issued in final form, these information notices will be formal requests for data, helping Ofcom gather the necessary information to determine which services fall into specific categories based on user numbers and functionality. This categorisation process is key for identifying which services need to meet additional duties for categorised online services.
Categorisation Process
- Draft information notices: Ofcom has started issuing draft information notices to relevant providers. Ofcom generally issues information notices in draft form initially to ensure that the notice is appropriately worded, targeted and sufficiently clear for the recipient to respond to within the proposed timeframe. While it is not mandatory to respond to a draft information notice, Ofcom encourages providers to engage, especially if they have any questions or concerns.
- Final information notices: Once the secondary legislation completes the legislative process, Ofcom will send out final information notices. Providers are legally required to comply with the final notice, supplying the data specified for categorisation.
- Assessment and publication: With the data collected, Ofcom assesses and categorises services. Ofcom is expected to publish the register of categorised services in summer 2025, ensuring transparency and accountability.
Additional Duties of Categorised Services
The categorisation process is a crucial step in the implementation of the OSA as it will enable online services to understand which, if any, additional duties they will need to comply with.
Online services may be grouped into one of three main categories[1], each with specific additional duties:
| Category | Criteria | Additional Duties |
| Category 1 | Applies to services that either:
|
|
| Category 2A | Applies to search services that:
|
|
| Category 2B | Applies to services that:
|
|
Penalties
Failure to comply with Ofcom's information notices can lead to significant penalties under the OSA, including substantial fines. Non-compliance can also lead to criminal liability for named senior managers.
For more detailed information, please visit the Ofcom website and for a broader outlook on the OSA in 2025, you can read more in this Law-Now article. If you are keen to find out more about how to best prepare for the OSA, please contact one of the CMS team.
Co-authored by Florentina Terholli, Associate at CMS.
[1] Implementing the Online Safety Act: Additional duties for ‘categorised’ online services - Ofcom
