OSA categorisation: Who has been named and what’s coming next?

Last week Ofcom published its register of categorised services, naming those platforms subject to additional obligations under the Online Safety Act (OSA) rulebook. To accompany this decision, Ofcom has published two new consultations on certain duties categorised services are required to comply with. Ofcom’s categorisation decisions had been expected last summer but were delayed following a legal challenge by the foundation behind Wikipedia, which also pushed back the publication of the relevant codes and guidance.

While much of the focus has been on potential amendments to the OSA regime arising from the new UK social media ban proposals, these developments are a timely reminder that the existing OSA regime is not yet fully implemented, with significant work still remaining for both Ofcom and providers of in-scope services.

The categorisation register: who’s in, and who’s on notice

Ofcom’s new register distinguishes between three categories of services, in accordance with the OSA and the criteria set out in accompanying regulations (summarised below):  

Category 1  

This category captures regulated user-to-user services with more than 34 million UK users a month and that use a content recommender system; or more than 7 million UK users a month and that use both a content recommender system and that facilitate the sharing of user generated content.

The list includes major platforms such as Facebook, Instagram, TikTok, YouTube, WhatsApp and Reddit. These platforms are subject to the most extensive additional requirements. Notably, Wikipedia hasn’t been included in the list of Category 1 services, however, it remains on Ofcom’s watch list of ‘emerging Category 1 services’ alongside others such as iMessage and Threads, on the basis that they nearly fulfil the Category 1 requirements (these services reach at least 75% of the user threshold and one of the functionality requirements).

Category 2A  

This category captures regulated search services or combined services (regulated user-to-user services with a public search engine), which have more than 7 million UK users a month (subject to exemptions for vertical search engines). 

The list includes large search services, such as Google Search, Bing, ChatGPT Search and Facebook’s Feed Deep Dive AI Search Assistant. Ofcom has made clear that it is the search functionality of the ChatGPT Search and Feed Deep Dive tools that these rules apply to, rather than the underlying ChatGPT/Facebook services. This is consistent with Ofcom’s November 2024 open letter, which stated that AI-powered services enabling users to search across multiple websites may constitute a “search service” under the OSA (see our blog post).

Category 2B 

Category 2B captures regulated user-to-user services with more than 3 million UK users a month and that facilitate direct messaging between service users.

A wide-ranging list of services fall within this category, including Airbnb, Discord and Strava.

Consultations on categorised service duties 

Alongside the register, Ofcom has launched two consultations on guidance materials relating to the additional duties that apply to categorised services. 

Additional duties for Category 1 services 

Ofcom is consulting on a new code of practice and a suite of new guidance materials relating to the additional duties on Category 1 services, including: 

• User empowerment: Providers must give adult users tools to manage their exposure to harmful content (including suicide, self-harm, eating disorders, hateful, and abusive content). Tools include content filters, warnings, comment controls, blocking/muting functions, and controls on interactions with unverified users. The focus is offering choice, not mandating use.
• User identity verification: Providers must offer adult users the option to verify their identity (to potentially provide for the filtering-out of non-verified accounts). The guidance provides four principles to guide the adoption of service-specific verification schemes: relevance, reliability, inclusivity, and clarity.
• Protection for news, journalistic and democratic content, freedom of expression and privacy impact assessments: Providers must safeguard recognised news publisher content, ensure consistent and fair moderation decisions, and assess the impact of measures on freedom of expression and privacy.
• Terms of service and complaints: Providers must clearly explain their rules, enforce them consistently, and operate accessible reporting and complaints mechanisms. 

Ofcom has published a helpful overview document summarising the new materials, which are spread across 15 documents.

Fraudulent Advertising Code for Category 1 and 2A services 

Ofcom has also published for consultation a draft Fraudulent Advertising Code of Practice for Category 1 and Category 2A services, which sets out 40 new measures for how platforms should protect their users from scams.

What’s next? 

Both consultations are open until 2 October 2026, with Ofcom committing to publish the final versions by mid-2027 at the latest, but earlier where possible. While some obligations (e.g. duties around freedom of expression and privacy) started applying to categorised services as soon as the registers were published on 10 July, many of the most significant ones, such as those relating to user empowerment or fraudulent advertising, won’t start applying until the relevant codes of practice are finalised and in force.

Ofcom has faced criticism for the delay in finalising these key aspects of the OSA regime, including from Government. However, the delays are perhaps unsurprising given that Parliament left many of the most complex and controversial questions, including precisely which services should be subject to the enhanced categorised-service duties, to be worked through by Ofcom. The Wikimedia Foundation's challenge to the categorisation regulations, and the subsequent debate about whether Wikipedia should be captured as a Category 1 service, illustrates the difficulties involved. With the exact scope of the UK’s social media ban and functionality restrictions for 16- and 17-year-olds yet to be determined, there is a risk that this period of uncertainty, challenge and delay could start all over again. However, Ofcom is already closely engaging with the Government on the ban, including about the impact on its workload alongside OSA implementation, giving some hope that lessons have been learnt from the first phase of rollout.