Ofcom's consultation on new priority offences - serious self-harm and cyberflashing

This explainer sets out the scope and objective of Ofcom's consultation on new priority offences. We will publish our analysis on the proposals and a full consultation response in due course. The consultation closes on 24 April.

Ofcom is consulting on changes to its suite of existing Online Safety Act (OSA) regulatory documents to take account of the fact that two new criminal offences have been made priority offences under the OSA. These offences are:

• Encouraging or assisting serious self-harm (section 184)
• Cyberflashing (“sending etc photograph or film of genitals”; section 187)

Ofcom notes that some of the changes reflect statutory requirements, others are because they “have discretion in terms of how we update our regulatory documents and guidance to cover the new priority offence”.

The consultation does not equate to a full consultation on updated codes of practice measures; indeed, Ofcom notes that it may have to do a further consultation soon in light of legislative changes contained in the Crime and Policing Bill (currently at 'ping-pong'stage in Parliament).

Documents provided as part of the consultation include an overview/narrative document setting out the updated offences and the proposed changes to the relevant regulatory documents, along with the consultation questions. There are also a number of annotated (track change) versions of, or extracts from, the existing regulatory documents showing how Ofcom proposes to update them to take account of the new offences. These include:

• risk assessment guidance
• risk register and risk profile extracts;
• illegal content judgements guidance; and
• updated codes of practice for user-to-user and search services (these last two documents also contain track changes relating to new proposals from last year’s consultation on additional safety measures which have not yet been applied to the codes).

The final statement and updated documents relating to this consultation are expected in “summer 2026”.

What is Ofcom proposing?

Self harm

• Combining the new priority self-harm offence with encouraging or assisting suicide to create a single kind of illegal harm, ‘suicide and self-harm’.
• Updating the User-to-User Risk Profile to include the risk factors most strongly associated with suicide and self-harm.
• Updating the Codes to apply existing measures, where relevant, to self-harm in the same way as to the other kinds of illegal harm.
• Applying measures that specifically apply to suicide content or services at risk of suicide to self-harm content and relevant services at risk of self-harm.
• Updates to the suicide and selfharm chapters of the Register of Risks and the Illegal Content Judgements Guidance (‘ICJG’)

Cyberflashing

• Including cyberflashing as a new, and separate, kind of illegal harm.
• Updating the User-to-User Risk Profile to include the risk factors most strongly associated with cyberflashing.
• Updating the Codes to apply existing measures, where relevant, to cyberflashing in the same way as the other kinds of illegal harm.
• Applying measures relating to blocking and muting (ICU J1) to relevant services at risk of cyberflashing.
• Updates to the cyberflashing sections of the Register of Risks and the ICJG.

Ofcom provides a table detailing the proposed changes to each document and is seeking views via the consultation on each individual change.

The main consequential impact of the changes is that providers will need to update their risk assessments and, if the relevant risks and characteristics are identified, “apply the measures recommended in the Codes to mitigate the risks of cyberflashing and suicide and self-harm or take alternative effective measures to manage these risks”.

Note however that the changes to the actual risk assessment guidance for services are minimal (eg updating all the references to “17” kinds of illegal harm to “18" (to take account of the new cyberflashing offence) and adding “and self-harm” to the mentions of the suicide offence). It is the risk factors and risk profile documents, which services need to use to inform their risk assessment, where the substantive changes are proposed.

We will publish our analysis on these proposed changes shortly.