Ofcom has published a consultation on proposed additional duties for Category 1 services under the Online Safety Act 2023.

Ofcom recently published its long-awaited register of categorised services, setting out those services that are subject to additional duties under the Online Safety Act. We have commented here on a separate consultation on additional duties for Category 1, 2A and 2B services relating to fraudulent advertising.

This consultation concerns proposals for a Code of Practice and guidance documents setting out how Category 1 services will be expected to comply with their additional duties relating to user empowerment, user identity verification, news publisher content, journalistic content, content of democratic importance, terms of service, complaints, and freedom of expression privacy impact assessments.

With so much territory to cover, the consultation is unsurprisingly dense, explaining Ofcom’s approach to developing the proposed new rules and guidance, together with the draft guidance and Additional Duties Code of Practice themselves.

Given the scale of the consultation, it is impossible to cover every proposal here. Instead, we highlight some of the measures likely to be of greatest practical significance for Category 1 providers, grouped according to the three volumes in the consultation:

• Enable all registered users – at the earliest possible opportunity – to retain or change the default settings for each feature that allows users to increase control over their content (so-called ‘control features’).
• Have a ‘content determination measure’ to determine whether content is suicide or self-harm content, eating disorder content, and abuse and hate content. All adult users must be given the choice not to encounter, to be alerted to the presence of, and to report such content.
• Implement measures to give all registered adult users the option to block or mute individual user accounts, and to disable comments on their own posts.
• Offer a filter tool to prevent non-verified users from interacting with the content of those that use filter tools.
• Operate and communicate an ‘identity verification scheme’. Ofcom has adopted what it calls a ‘flexible, principles-based approach’ which does not specify what attributes of a user should be checked (and how) but instead sets out the principles that should inform any identity verification process.

• Have effective means of identifying which users qualify as ‘recognised news publishers’ so as to identify ‘news publisher content’.
• Specify in internal policies how the importance of the free expression of journalistic content and content of democratic importance will be taken into account when making decisions about how to treat such content, and whether to sanction users for uploading such content. Individuals working in content moderation should also be trained in how to take into account the importance of freedom of expression.
• Have a dedicated and expedited complaints procedure for journalistic content, and review upheld appeals relating to content of democratic importance to check for patterns of failing to apply policies consistently.
• Carry out freedom of expression and privacy impact assessments by following a proposed four-step approach to ensure that they are structured, evidence-based, clearly documented, and effectively kept under review.

• Ensure terms of service are clear and accessible by considering ‘findability’, layout and formatting, language, and usability.
• Have easy-to-find and easy-to-use systems and processes in place to allow users and affected persons to complain about non-compliance with certain duties, and take appropriate action in response to such complaints.

The consultation closes on 2 October 2026. It, the draft Code of Practice, guidance, and accompanying documents can be found here.