Ofcom's Additional Safety Measures consultation

Last week (30 June 2025), Ofcom launched a long-awaited consultation on additional safety measures to be included in its existing online safety codes of practice on illegal harms and the protection of children. You can read Ofcom’s press release here and access the full set of consultation documents here.

This blog post provides some additional context and an overview of some of the key measures.

Context

It is nearly two years since the Online Safety Act received Royal Assent, in October 2023. While Ofcom moved quickly to publish its first set of proposals on illegal harms for consultation the following month, and its proposals on protecting children in May 2024, there were significant gaps in the protections that might have been expected in the draft codes - not least when comparing the comprehensive assessment of risk undertaken by the regulator with the inclusion of corresponding measures in the draft codes.

Civil society feedback - along with specific suggestions to address the gaps - has been provided to Ofcom in the intervening period; for example, see our responses to the illegal harms and children’s codes respectively. It is notable that Ofcom’s senior leadership is now referring to those published codes as “first edition” codes. This very much reflects the general understanding at the time that the Act was passed that the regime would always need to be iterative: technology does not stop developing and nor will the harms associated with it.

The first edition of the codes allowed Ofcom to go after the low-hanging fruit, getting all regulated services up to a minimum acceptable base level of activity. From our perspective, this unfortunately equated more to a lowest common denominator, with many of the largest and most harmful platforms not being required to go beyond what they already do. Moving to update these baselines in an iterative way is a matter of urgency.

But the reality of this iterative process is that it takes a very long time. The first set of draft measures consulted upon back in November 2023 only came into force earlier this year, in March 2025; the children’s codes measures will only be fully in force later this month, on 25 July 2025. Based on a similar timeline, the measures proposed in this additional consultation will not be in force any earlier than October 2026. In addition to the fact that these additional measures - welcome as they are - by no means cover the spread of identified gaps in the regime, technology will have moved on again by the end of next year and the measures proposed now will need to be supplemented.

In that regard, our recommendations that there should be a measure included in the codes of practice that requires regulated services to take steps to mitigate all the risks identified in their risk assessments, along with a stronger focus (or even a separate, underpinning code) on safety by design remain relevant. We will continue to advocate for their adoption by the regulator as we strongly believe it is in both their interests - and the interests of the users that these codes are intended to protect - to push services harder and faster through a more expansive approach to the codes.

The additional measures

Broadly speaking, the measures on which Ofcom is consulting fall into three buckets:

• Additions or enhancements to existing measures - for example, on proactive technology or on recommender systems.
• Measures to close gaps identified in previous consultations - for example, on livestreaming; and on hash matching for intimate image abuse and terrorist content.
• Responses to new threats - for example, a measure on crisis response protocols; a commitment made by the regulator in response to the aftermath of the Southport murders and subsequent riots last summer.

As well as the detail on the proposed measures, the consultation documents include an overview of the changes to the codes of practice, along with new drafts of each relevant code or document with the proposed changes integrated into them.

We will be publishing further analysis and commentary on the proposals in the coming weeks, before submitting our final response to the consultation.

The deadline for responses to Ofcom's consultation is 20th October.

Also of note is the update to the implementation timeline published by Ofcom alongside the consultation, with further publications expected this month including their report on researcher access to data and the final transparency guidance, and their guidance on super complaints to follow in September.