In brief
- The Protection of Children Codes (Codes) set out safety measures recommended for providers of Part 3 Services (user-to-user or search engine services) to comply with their duties under the Online Safety Act 2024 (OSA) and come into effect from 25 July 2025.
- Services that implement the recommended measures within the Codes will be treated as complying with their relevant duties under the OSA.
- However, service providers are not required to comply with the Codes to meet their OSA duties. They can implement alternative measures, provided they maintain a record of the measures and explain how these meet the duty.
- These Codes come into force ahead of the deadline of 7 August 2025 for certain services to disclose their children's risk assessments (CRAs) to Ofcom.
The Codes
There are two Codes issued by Ofcom (the regulator for the OSA) that set out the safety measures recommended for Part 3 Services, one for user-to-user services and one for search engine services. Where services comply with and implement the recommended measures, the Codes will act as a "safe harbour" and will mean that the services will be treated as having complied with their duties under the OSA in relation to the protection of children from the risk of harm. The Codes do not remove the requirement to complete any of the risk assessments required by the OSA, and services will still be required to complete these and evidence the mitigations that they put in place to reduce risk.
Measures
The Codes set out measures by thematic area, and not all services will need to comply with all measures to benefit from the Codes' safe harbour effect. The Codes are not prescriptive, and services can choose to implement other measures provided they maintain a record of the measures implemented and how they consider these to meet the relevant duty.
Where services do not meet the standard outlined in the Codes and fail to evidence and explain their alternative approaches, it is likely that any Ofcom enforcement will require the implementation of the measures specified in the Codes. As Ofcom continues its enforcement efforts under its powers granted by the OSA, we will gain greater insight into how Ofcom will assess alternative measures to those in the Codes.
CRA disclosure to Ofcom and the public
To comply with their duty in relation to the completion of CRAs, some of the Categorised Services (Category 1 and Category 2A Services) are expected to submit their completed CRA(s) to Ofcom by 7 August 2025.
Categorised Services are considered to be "higher risk" services by Ofcom. Category 1 Services are user-to-user services that have a content recommender system and either (i) more than 34 million UK users, or (ii) have more than seven million UK users and allow those users to forward or share user-generated content. Category 2A Services are search engine services that are not vertical search services and have more than seven million UK users. Category 1 and 2A Services must also publish notices of the findings and conclusions from their completed CRA(s) in a publicly available statement.