In brief
- The Government has published details of the super-complaints regime under the Online Safety Act 2023, to commence on 31 December 2025, allowing eligible entities to flag systemic failings to the regulator, Ofcom.
- After consultation, the eligibility criteria for submitting a complaint are broader, and simpler, to include multiple voices while still allowing Ofcom to focus its resources.
- Eligible entities can submit only one complaint every six months, although they can withdraw and replace it within six months.
- There is no longer a need to pre-notify Ofcom of a forthcoming complaint, although it might be helpful in some cases.
- Ofcom will produce and consult on guidance later this year.
- The impact on regulated service providers is unclear, but they are likely to receive requests for information from Ofcom in relation to their internal practices, incidents of harm and risk assessments, and may be subject to enforcement.
The super-complaints regime under the Online Safety Act 2023 (OSA) will come into force on 31 December 2025, allowing "eligible entities" to flag systemic failings to the regulator, Ofcom. Since the Government published its response to the consultation on its initial proposals, and laid before Parliament draft regulations, we have more clarity on exactly which entities will have scope to complain, and how. Overall, the post-consultation regime is simpler, and the eligibility criteria broader, which should enable a wide range of complaints while still allowing Ofcom to focus its resources.
No individual right to complain under OSA
Although individual users can bring contractual claims under the OSA, they cannot directly sue regulated services for breach of their duties. The super-complaints regime is therefore a crucial aspect of the OSA's overall reporting and redress mechanisms, designed to help Ofcom plug gaps in compliance and tackle persistent harms. It allows representative bodies, such as charities, to group individual concerns about features of regulated services, or conduct by regulated providers, which are causing significant harm or having a significant adverse impact, including on the right to freedom of expression.
The Government expects super-complaints to cover issues across multiple services and processes or, in exceptional circumstances, on one service. Reporting under the new regime is voluntary and, according to the Written Statement published alongside the Regulations, the scheme is designed to impose "no significant burden" on complainants.
Eligibility criteria
While most super-complaints regimes depend on a pre-designated list of complainants set out in secondary legislation, the OSA requires Ofcom to assess complainants' eligibility every time they wish to complain. However, one welcome change for complainants post-consultation is that entities deemed eligible within the last five years will now benefit from an expedited assessment, providing their circumstances are unchanged.
The eligibility criteria, as set out in the Regulations, are as follows:
- The entity is a body representing the interests of users of services regulated by the OSA, or members of the public, or a particular group of users or members of the public.
- The entity's composition and arrangements for its governance and accountability are such that it can be "relied upon to act independently from regulated services". It might still receive funding from these services or have representatives from the services involved in governance, and this alone will not preclude it from submitting a super-complaint.
- The entity routinely contributes significantly, as an expert, to public discussions about any aspect of online safety matters.
- The entity can be relied upon to have "due regard" to any guidance (relating to the OSA) published by Ofcom.
Crucially, there are now fewer eligibility criteria, focused on testing the quality of the proposed complaint, the motivation behind it and the supporting evidence. Some stakeholders raised concerns during the consultation that the criteria were too onerous and would exclude smaller, niche or less well-resourced groups who were otherwise valuable complainants. The criteria now include newer organisations with expertise in online safety matters but not necessarily longstanding experience; entities no longer need a "strong track record" of publishing high-quality research and analysis, and of collaborating with other organisations. Clearly, the Government recognises the value of including multiple voices in upholding the aims of the OSA.
Procedural requirements and timings
The key features of the scheme are as follows:
- After a mixed response in consultation, the Government has scrapped the need for entities to pre-notify Ofcom of their intention to make a super-complaint. Organisations can still pre-notify Ofcom – which could reduce the time needed to complete the substantive assessment – but are not required to do so.
- Ofcom will determine the eligibility of an entity within 30 days, or 15 days if the entity was deemed eligible within the past five years and their circumstances have not changed. It must then consider and respond to the complaint in writing within 90 days. Ofcom can only 'stop the clock' in certain circumstances, for example if additional information is required and the complaint cannot be progressed without it.
- Eligible entities must ensure that evidence supporting the complaint is current, objective, and relevant.
- Entities can submit only one complaint every six months, though they can now withdraw a complaint under consideration and submit a new one within six months, if necessary.
- Ofcom will have the power to reject complaints in specific circumstances, for example if the matter is already being considered by another court or regulator, or if a complaint merely repeats the substance of a recent complaint. However, Ofcom will now be able to accept part of a complaint, where online safety matters can easily be separated from material being considered by another regulator.
Risks to regulated service providers
The super-complaints regime, while beneficial to individual rights including freedom of speech, is intended to increase Ofcom's ability to identify and enforce against perceived harms and risks under the powers designated under the OSA. It is not yet clear, in practical terms, how this will impact regulated service providers.
It is likely that regulated service providers will be subject to requests for information from Ofcom in relation to their internal practices, incidents of harm and the details (or copies) of their risk assessments. Where Ofcom deems super-complaints to be admissible it is likely that it will result in either (i) enforcement against entities complained of who are not complying with the OSA or Ofcom's guidance, or (ii) updates to Ofcom's guidance to clarify expectations and acceptable conduct in relation to the harm complained of.
Next steps
The super-complaints regulations will commence on 31 December 2025. Ofcom will produce guidance, which it will consult on later in the year, to support organisations on the process of submitting a super complaint, including on how to cover multiple topics in a single complaint, and when to consider pre-engaging with Ofcom.
The impact of the regulations will be monitored as part of the broader review of the OSA’s regulatory framework. The Secretary of State will carry out a review between two and five years after the full implementation of Part 3 of the OSA, which will be between 2027 and 2030, ensuring that the regulations remain effective and relevant.