Advertising and the Online Safety Act 2023

This note covers a detailed paper (available as a PDF at the bottom of this page) from Professor Lorna Woods OBE and Dr Alexandros Antoniou which considers how the Online Safety Act 2023 deals with the risks that arise from online advertising and highlights some gaps, in both the legislation itself and the wider regulatory landscape.

Context: the Online Safety Act 2023

The Online Safety Act (OSA) received Royal Assent in October 2023. A number of the major duties that the Act confers upon regulated services - user-to-user (U2U) services and search services - are already (or soon to be) in force, including the illegal harms duties (from March 2025) and the protection of children’s duties (from July 2025). Ofcom has initiated a small number of enforcement actions relating to these duties. The next tranche of Ofcom’s implementation will focus on the OSA duties relating to categorised services, which include duties relating to fraudulent advertising among others. An at-a-glance guide to the duties that fall on the different categories of services is here; and a summary of the implementation timeline can be found here.

Regulation of online advertising

The scale of online advertising fraud and scams is well documented. But the regulation of online advertising is patchy and struggles to address the way in which automated delivery systems are susceptible to misuse. The existing CAP regime - overseen by the Advertising Standards Authority (ASA) but principally self-regulatory - in the online context focuses on advertising content provided on social media, paid-for or boosted spots in search or through other online ad delivery services, and on content posted by influencers. It is an extension of the regime applied to print advertising. There is more detail on how this system works in the attached paper.

Since June 2020, the ASA has operated a Scam Ad Service, which allows users to report fraudulent ads to them, with platforms then notified, though the response rates following these notifications are far from ideal. In 2023, the FCA intervened in relation to misleading financial adverts and the promotion of financial services products. The boundaries between these regulators remain unclear.

Meanwhile, the Online Advertising Programme - which was first consulted upon in June 2022 and designed to look at the online advertising market across the board, though still largely focused on content - has borne little results. Although it was extended by the current Labour Government for a further 12 months until December 2025, this lack of impact shows no sign of changing any time soon.

The OSA fraudulent advertising duties

Despite the scale of the problem and the challenges for existing regulators, the then Government excluded “paid-for advertisements” from the initial draft Online Safety Bill. The OSA’s fraudulent advertising duties were only included in the regime after a successful campaign, involving consumer groups, financial sector organisations and mental health charities, backed by the City of London Police and with pressure brought to bear directly on the Government from the FCA. While the introduction of the OSA duties relating to fraudulent adverts are welcome, the scope of the related responsibilities is unclear and definitional problems in the legislation itself may well impact on the duties’ effective enforcement. The timeframe for their implementation is also a concern.

The duties and their implementation

The duties are contained in Chapter 5 of Part 3 to the OSA: they apply to two categories of regulated services - category 1 (large user-to-user platforms) and category 2A (large search services); the threshold definitions for these two categories have been set out in regulations by DSIT, based on Ofcom’s advice, which came into force in February 2025. (Ofcom’s advice on these thresholds was itself contentious as it excluded “small but risky” platforms - see our briefing here - and the Government’s regulations are now subject to a legal challenge.) Ofcom has indicated that it will not consult on the related draft codes of practice any earlier than January 2026. The outcome of the legal challenge may delay this further. This means that the duties themselves are unlikely to be in force until the first half of 2027.

The scope of the duties

This is the primary focus of the full paper. In summary, there are a number of potential concerns:

• Chapter 5 imposes different obligations in relation to fraudulent ads on U2U services from search.
• The content to which these Chapter 5 duties about fraudulent ads apply is narrower than the content covered by the duties in the other parts of Part 3. This leaves a potential gap in protections and enforcement relating to advertising.
• Small U2U and search services are not covered by the Chapter 5 duties. This could lead to significant gaps in fraudulent ad protections, including for children.
• Paid-for adverts are included in the U2U (Part 3) provisions but are not included in the search (Part 3) provisions.
• Definitions are unclear in the Act itself: a “user” (for the purposes of “user-generated content”) could include advertisers uploading content to a service as well as individual users generating their own text or image-based content; the ‘service’ (for the purposes of sharing the content that is regulated by the Act) could include the advertising delivery service as well as the user interface. Different interpretations of these terms have significant implications for the scope of the duties.
• Under the most expansive interpretation of “user” and “service”, all advertising linked to Schedules 5-7 comes into scope of the illegal content duties but only for U2U services as well as the content listed at section 40 (“fraud etc. offences”) coming into the scope of specific fraudulent ad duties for U2U and search services.
• Under the most expansive interpretation, obligations would apply to advertising content on U2U already as the general rules are already in force (or shortly to be in force in respect of content harmful to children).