Quick guide to illegal content codes of practice

Under the Online Safety Act, providers of regulated user-to-user and search services have duties to keep people safe from illegal harm.

From 17 March 2025, providers will need to take the safety measures set out in the Codes of Practice or use other effective measures to protect users from illegal content and activity.

Our Codes of Practice were issued on 24 February. This page gives a quick introduction to the measures we have recommended in our first codes.

Put measures in place to protect users from online harm

The illegal content safety duties, and those relating to reporting and complaints, focus on keeping people safe online. It’s about making sure you have the right measures in place to protect people from harm that could take place on your service.

Illegal content safety duties for user-to-user services

If you are the provider of a user-to-user service, you must:

• take proportionate steps to prevent your users encountering illegal content
• mitigate and manage the risk of offences taking place through your service
• mitigate and manage the risks identified in your illegal content risk assessment
• swiftly remove illegal content when you become aware of it, and minimise the time it is present on your service
• explain how you’ll do this in your terms of service
• allow people to easily report illegal content and operate a complaints procedure

Illegal content safety duties for search services

If you are the provider of a search service, you must:

• take proportionate steps to minimise the risk of your users encountering illegal content via search results
• mitigate and manage the risks identified in your illegal content risk assessment
• explain how you’ll do this in a publicly available statement
• allow people to easily report illegal content and operate a complaints procedure

You can decide for yourself how to meet the specific legal duties; you can apply the measures that apply to your service set out in Ofcom’s Codes of Practice or you can take alternative measures. If you take alternative measures to the ones we recommend, you must also maintain a record of what you have done and how you consider that they fulfil the relevant duties.

Our Codes of Practice set out a range of measures in areas including content moderation, complaints, user access, design features to support and protect users, and the governance and management of online safety risks.

Some measures are targeted at addressing the risk of certain kinds of illegal harms. For example, our Codes of Practice include measures to tackle online grooming. Other measures help to address a variety of illegal harms such as child sexual abuse material (CSAM) and fraud.

Your safety measures will depend on your service

The Act is clear that the safety measures that providers put in place should be proportionate. Different measures in the Codes of Practice would apply to different services based on factors such as:

• the type of service you provide (user-to-user or search);
• the features and functionalities of your service;
• the number of users your service has; and
• the results of your illegal content risk assessment.

Some measures will apply to all services. For example, these include naming a individual accountable for online safety compliance and ensuring your terms of service (or publicly available statements) are clear and accessible.

Some measures apply to large services

Certain measures may apply to services of differing sizes or risk levels, such as the measures to apply specific automated tools to detect and remove child sexual abuse material from user-to-user services and to ensure that users do not encounter it in or via search services.

In our Codes of Practice, we have defined a large service as a service which has an average user base of 7 million or more per month in the UK. This is equivalent to approximately 10% of the UK population. A user does not need to be registered with the service, or post anything. Just viewing content is enough to count as using that service.

These services may need to put in place more measures, such as providing training for staff working in content moderation.

This is because, generally, providers of large services putting in place these measures will have the most benefits for the most number of users – so it’s proportionate to ask them to do more.

Other measures apply to services that are medium or high risk

Your illegal content risk assessment must set out if your service has a negligible, low, medium, or high risk of each kind of priority illegal content. These risk levels must accurately reflect the risks on your service, and we've provided guidance on this.

Some measures apply based on the specific risk level:

• If your service is low or negligible risk for all kinds of priority illegal content, you are a 'low risk service;' and the minimum number of measures apply.
• If your service is medium or high risk for one kind of illegal harm, we  call it a ‘single-risk’ service, and more measures may apply.
• If your service is medium or high risk for two or more kinds of illegal harm, we  define it as a ‘multi-risk’ service, and further measures may apply.
• Safety measures focused on specific kinds of illegal harm (like child sexual exploitation and abuse and terrorism offences) only apply to services that are medium or high risk for those specific harms.

Subscribe for updates on online safety

Subscribe for updates on any changes to the regulations and what you need to do. You'll also be the first to know about our new publications and research.