OSA Phase 3: register of categorised services and related duties

This explainer from Prof Lorna Woods provides a high-level overview of the various documents published by Ofcom as part of the third phase of Online Safety Act implementation. We will be publishing commentary and analysis on the various proposals over the coming weeks, prior to submitting a full consultation response ahead of the deadline of 2 October.

Ofcom has today (10 July 2026) published a set of documents that mark the start of the bringing in to force of the final stage of the Online Safety Act (OSA) Part 3 regime. These publications relate to the additional duties that apply to “categorised services” – that is services that fall within categories set out in the Online Safety Act: Category 1 (user-to-user services); Category 2A (search services); and Category 2B (user-to-user services). The rather odd numbering seems to reflect the fact that the duties on Cat 2A and Cat 2B were, in the original draft of the Bill, broadly similar relating essentially to transparency, whereas the Cat 1 services were subject to additional safety duties. Changes during the course of the legislative process – notably the introduction of the obligations in relation to fraudulent advertising – blurred this boundary so we are now left with just some odd numbering. For reference, here is a table summarising all the duties imposed by the OSA on regulated services, including categorised services.

The publication marks the start of a period of consultation on the additional requirements which will be imposed on categorised services which will end on 2 October.

The documentation can be separated into three strands:

• the register of categorised services, which underpins this part of the regime by identifying the services that are subject to extra duties and which Ofcom is under a duty by virtue of s 95 OSA to publish;
• the proposed rules in relation to fraudulent advertising
• the proposed additional safety duties in relation to Cat 1 services – these are all that is left of the protections to adults when the Truss/Sunak regimes removed the category of harmful to adults from the Online Safety Bill.

The transparency requirements are not dealt with in this consultation; Ofcom has already consulted on and published their final guidance on the transparency reports. The obligation to publish reports could not kick in, however, until the register of categorised services was published. So, even though Cat 2B services are not impacted by the additional safety rules, the publication of the register starts the clock ticking for the production of their transparency reports. Ofcom has also consulted on the deceased child duties under s 75 OSA, which also apply to categorised services. Again, these obligations were dependent on the publication of the register.

Register of Categorised Services

The register of categorised services is divided into four sections, identifying Cat 1, Cat 2A, Cat 2B and emergent Cat 1 services respectively. Ofcom notes

“We provided services providers with our provisional decisions in March 2026 and invited representations from providers. We have taken providers’ representations into account before finalising our decisions. We have issued service providers with our final decisions, which set out our full assessment of their services against the categorisation threshold conditions.”

Category 1 services (which are user-to-user services) are:

• Facebook
• Instagram
• Pinterest
• Quora
• Reddit
• Roblox
• Snapchat
• Tiktok
• WhatsApp
• X
• YouTube

Wikipedia, which brought a judicial review action last year against the criteria used to determine the thresholds of the various categories, is not listed here, nor as a category 2B service. Instead, it is listed in the emergent Cat 1 register: this section suggests services do not have to go through Cat 2B before they become Cat 1. (Their response, and details of their legal challenge, is here.) Note also that Wikipedia is listed for the purposes of the EU’s Digital Services Act as a “very large online platform” (VLOP), and thereby subject to extra duties under that regime. Some of the porn sites, listed by Ofcom as Cat 2B, are also VLOPs.

Four search services are listed under Cat 2A: Google, Bing, ChatGPT search and Facebook's Feed Deep Dive. The Cat 2B list covers a wide range of services, from Mumsnet, Twitch and Discord to Airbnb, Uber Eats and Autotrader via Pornhub. It is notable that gaming platforms are listed (both as Cat 1 and Cat 2B).

Fraudulent Advertising

Chapter 5 to Part 3 OSA contain the duties about fraudulent advertising which are applicable to Cat 1 and Cat 2A services. No risk assessment is required under these provisions, so the document refers to mitigation measures to be taken – and like the other OSA codes, safe harbour will apply. The consultation documents are voluminous - literally.

1. Volume one provides context, with Volumes 2-4 explaining Ofcom’s reasoning for its various proposals, as well as the text of those proposals.
2. Volume two focuses on governance and control mechanisms, specifically expecting that governance arrangements include senior oversight and accountability for compliance with the duties. There are specific proposals with regards to how to assess evidence around fraud as well as “testing advertisement tools”. There is also consideration of how to deal with the situation where providers use advertising intermediaries to place paid-for advertisements on their service.
3. Volume three concerns account integrity. Essentially, this introduces proposals so that regulated services take “sufficiently robust steps” in relation to three aspects of account integrity: that those opening and operating accounts are not bad actors; that bad actors receive an appropriate ban, and that suspected account takeover can be quickly and easily reported. Ofcom also envisages an appeals mechanism.
4. Volume four deals with moderation, including a requirement for ad libraries.

Then there are the annexes, the first of which is the consultation response form, followed by an annex explaining the legal framework and statutory tests. The draft codes themselves are found in Annex 4 for Cat 1 services (user-to-user) and Annex 5 for Cat 2A (search services). These replicate the proposals found in the earlier volumes. Annexes 6-8 contain an equality impact assessment, a glossary and details on economic analysis respectively. Annexes 9-11 include the proposed changes to the Illegal Content Judgments Guidance which Ofcom is obliged to provide to help services understand when content triggers these duties.

In sum, if you want to see the duties themselves, just look at Annexes 4 and 5, but if you want to know why Ofcom is suggesting a particular measure, go to the relevant volume. Questions about thresholds – that is, what will trigger the rules - should be answered by Annexes 9-11.

Additional Safety Duties for Cat 1 Services

The OSA added three sets of protections: two for adult users from harmful content (user empowerment tools/identity verification (ss 14-16 and 64), and enforcement of terms of service (s 72)); and one relating to public interest content of various sorts (ss17-19).

Additionally, the cross-cutting duties in relation to freedom of expression and privacy carry extra obligations for Cat 1 services. Unlike the fraudulent advertising obligations, the user empowerment provisions do include a requirement to carry out an assessment. As with the fraudulent advertising consultation, Ofcom has published a number of volumes.

1. Volume one sets the context and approach
2. Volume two deals with user empowerment and identity verification
3. Volume three bundles together the other public interest issues
4. Volume four deals with terms of service.

Ofcom has published a draft code together with a range of guidance documents, for example guidance identifying the sorts of content that triggers the user empowerment duties or the public interest content duties (eg news publisher content), as well as how to do a freedom of expression/privacy impact assessment. Further, the OSA requires Ofcom to provide guidance on terms of service: Ofcom's draft guidance covers providing clear, accessible and sufficiently detailed terms of service; acting in accordance with terms of service; and operating clear, accessible and transparent complaints procedures.

The proposed codes and guidance can be found under that heading on the consultation site – the explanation for the choices can be found in the various volumes, so those just wanting to know what is proposed rather than why, need not consider Volumes 1-4. The Consultation questions and answer sheet can be found in the Annexes.

Ofcom's consultation on the above proposals closes on 2 October 2026.