Guidance

Explanatory Memorandum: Draft amendments (No. 2) to the Illegal content Codes of Practice for user-to-user services and Draft amendments to the Protection of Children Code of Practice for user-to-user services

Published 18 June 2026

1. Introduction

1.1 This Explanatory Memorandum has been prepared by the Department for Science, Innovation and Technology and is laid before Parliament by Command of His Majesty.

2. Declaration

2.1 Kanishka Narayan MP, Parliamentary Under-Secretary of State for AI and Online Safety confirms that this Explanatory Memorandum meets the required standard.

2.2 Vita Maynard, Deputy Director for Information Resilience and Public Safety at the Department for Science, Innovation and Technology, confirms that this Explanatory Memorandum meets the required standard.

3. Contact

3.1 Toby Zambardino at the Department for Science, Innovation and Technology can be contacted by email at: osaimplementation@dsit.gov.uk with any queries regarding the instruments. Alternatively, the department can be contacted by telephone: 020 7215 5000.

Part One: Explanation, and context, of the Instruments

4. Overview of the Instruments

What do the amendments to the codes of practice do?

4.1 The Online Safety Act 2023 (“the OSA”) imposes duties on providers of regulated user‑to‑user services to take proportionate steps to protect users from illegal content and activity (“the illegal content duties”, section 10 of the OSA) and to protect children from harm (“the protection of children duties”, section 12 of the OSA). As per section 3 of the OSA, an internet service is a user-to-user service if content that is generated directly on the service by a user of the service, or uploaded to or shared on the service by a user of the service – may be encountered by another user (or other users) of the service.

4.2 Section 41 of the OSA requires Ofcom to prepare and issue codes of practice describing recommended measures that providers can take to comply with those duties. Ofcom issued its first illegal content codes of practice for user‑to‑user services and search services in relation to (i) terrorism, (ii) child sexual exploitation and abuse (‘CSEA’), and (iii) other illegal content duties in March 2025 and its first protection of children codes of practice for user‑to‑user services and search services in July 2025.

4.3 The amendments to the codes of practice introduce new recommended measures for user-to-user services to meet their existing illegal content and protection of children duties in relation to periods of heightened public safety threat. The amendments set out the recommendation that relevant services have dedicated structures and processes in place for responding to crisis incidents, open dedicated channels for law enforcement to communicate with them during these incidents, and conduct a post-crisis analysis covering the key actions they have taken in response to the threat and assessing their effectiveness. The amendments to the codes recommend that these steps are taken in the event of an extraordinary public safety threat resulting or caused, in whole or in part, by an increase in content that is illegal or harmful to children.

Where do the amendments to codes of practices extend to, and apply?

4.4 The extent of the instruments (that is, the jurisdiction(s) which the instruments form part of the law of) is England and Wales, Scotland, and Northern Ireland.

4.5 The territorial application of the instruments (that is, where the instruments produce a practical effect) is England and Wales, Scotland, and Northern Ireland.

5. Policy Context

What is being done and why?

5.1 The OSA established a regulatory framework for user‑to‑user services and search services. As part of this framework, the OSA places duties on providers to protect users from illegal content and, in the case of user‑to‑user services, to reduce the risks of illegal activity being facilitated by their services. These are referred to as the “illegal content safety duties” and are set out in sections 10 (user‑to‑user services) and 27 (search services) of the OSA. The OSA also places duties on providers to protect children from encountering harmful and age-inappropriate material. These are referred to as the “protection of children duties” and are set out in sections 12 (user‑to‑user services) and 29 (search services) of the OSA. The purpose of these duties is to require providers to take responsibility for protecting UK‑based users from illegal content and activity, and that which is harmful to children, encountered on or facilitated through their services.

5.2 The OSA establishes Ofcom as the independent regulator for this regime. Ofcom is responsible for producing codes of practice under section 41 of the OSA and its subsequent amendments, setting out recommended steps that providers can take to comply with their statutory duties. These steps are not mandatory in themselves, and providers may choose alternative measures, provided they can demonstrate equivalent effectiveness and therefore compliance with the duties. However, where a provider follows all relevant measures set out in a code of practice, it will be treated as having complied with the corresponding duties (section 49(1) of the OSA).

5.3 The first Ofcom codes of practice for the illegal content safety duties came into force in March 2025. These comprised two separate instruments: the Illegal Content Codes of Practice for User‑to‑User Services and the Illegal Content Codes of Practice for Search Services. Together, these codes introduced a set of core, cross‑cutting safety measures intended to apply across different types of illegal harm, alongside additional measures targeted at specific priority harms such as child sexual abuse material, terrorism and fraud. The first Ofcom codes of practice for the protection of children duties then came into force in April 2025, again consisting of separate instruments relating to codes for user-to-user services and search services respectively. These introduced additional measures intended to protect children from harmful content whilst preventing access altogether to the most harmful content types including pornography, suicide, self-harm and eating disorder content.

5.4 Following the implementation of the first codes, Ofcom brought forward proposals for additional safety measures across both the illegal content codes and the children’s safety codes. Ofcom launched a consultation on these proposed additional measures in June 2025. The consultation covered a range of interventions intended to strengthen protections against specific harms, including measures addressing the role online services can play in exacerbating public safety threats during crisis periods.

5.5 Following the public disorder after the Southport murders in 2024, there has been significant Government, parliamentary and stakeholder interest in ensuring that services take effective action to address the role online activity on user-to-user services can play in offline violence, disorder, and illegal activity during periods of heightened vulnerability and public safety incidents. In light of this, Ofcom decided to expedite the development of measures recommended to improve services’ response to public safety-based crisis incidents, as defined in paragraph 5.6.

5.6 The expedited measures recommend that certain user‑to‑user services deploy a number of steps during an extraordinary situation in which there is a serious threat to public safety in the UK resulting from, caused by, or likely to cause an increase in relevant illegal content or content harmful to children. These steps include:

5.6.1 preparing and applying a written internal protocol for identifying and responding to a crisis and managing and mitigating associated risks arising from the content in question, including the use of the service for the commission or facilitation of a priority offence;

5.6.2 conducting and recording a post-crisis analysis, covering the key actions taken and assessing their effectiveness; and

5.6.3 setting up a dedicated communication channel allowing law enforcement to contact them on matters related to the crisis.^{[footnote 1]}

5.7 Under their crisis response protocol, relevant services should establish and monitor indicators that a crisis is occurring or is likely to occur and stand up these measures once the service has determined this is the case. The measures apply to large user-to-user services that have assessed themselves as being medium risk in relation to illegal harms from terrorism, hate, harassment, stalking, threats and abuse, and foreign interference, and user-to-user services of any size that are high risk. They will also apply to large user-to-user services that are medium risk in relation to children’s exposure to hate, abuse, and violence content, and services of any size that are high risk. Smaller user-to-user services are therefore in scope where the risk of harm is sufficiently high.^{[footnote 2]}

5.8 To give effect to these recommended measures, Ofcom has drafted amendments to the illegal content and protection of children codes of practice for user‑to‑user services. These amendments consolidate the existing illegal content and protection of children measures with the crisis response measures, ensuring that providers can refer to a single, coherent set of recommended steps for complying with their existing duties. In line with the statutory process set out in the OSA, Ofcom submitted the draft amendments to the codes of practice to the Secretary of State for laying in Parliament.

What was the previous policy, how is this different?

5.9 Prior to these amendments, the user-to-user codes of practice did not contain recommended measures to apply specifically during exceptional periods of heightened public safety risk. The amendments therefore strengthen the existing regulatory framework by setting clearer expectations around steps platforms should take in response to these periods of heightened risk.

6. Legislative and Legal Context

How has the law changed?

6.1 The OSA established the statutory regulatory framework under which Ofcom must issue codes of practice describing measures recommended for compliance with providers’ illegal content and protection of children duties. These duties apply to user‑to‑user services under sections 10 and 12 of the OSA.

6.2 Sections 49 and 50 of the OSA set out the legal effect of codes of practice. A provider which takes the measures recommended in a code of practice for the purpose of complying with a relevant duty is treated as complying with that duty. A failure to act in accordance with a code of practice does not of itself give rise to legal liability, but a court or tribunal must take account of a provision of a code of practice where it is relevant to a question in proceedings and was in force at the relevant time. Ofcom must similarly take relevant provisions of a code of practice into account when exercising certain statutory functions.

6.3 The amendments to the codes of practice introduce additional recommended measure relating to public safety crises to ensure services respond effectively to any increases in illegal content or content harmful to children. The amendments do not create new statutory duties, but updates Ofcom’s recommended compliance measures within the existing legislative framework.

Why was this approach taken to change the law?

6.4 This is the only possible approach to making the necessary changes.

6.5 Section 41 of the OSA places a duty on Ofcom to prepare and issue codes of practice and permits the updating of codes of practice for the illegal content duties. Where Ofcom prepares a draft code of practice or draft amendments to an existing code, section 43 of the OSA requires Ofcom to submit the draft to the Secretary of State. Under section 44 of the OSA, the Secretary of State has a limited power to direct Ofcom to modify a draft code of practice for specified public policy reasons. In this instance, the Secretary of State has considered the draft amendments and does not intend to issue a direction under section 44. Accordingly, and in line with section 43(2) of the OSA, the Secretary of State is laying the draft amendments to the codes of practice before Parliament for scrutiny.

7. Consultation

Summary of consultation outcome and methodology

7.1 Ofcom consulted on the draft amendments to the illegal content codes of practice as a part of a package of proposed amendments between June and October 2025 (the ‘additional safety measures consultation’).^{[footnote 3]} Ofcom is planning to issue its final decision on this package of amendments in autumn 2026, but has expedited its decision in relation to the crisis response measures.

7.2 Approximately 50 stakeholders commented on the proposed measures via the consultation. Ofcom has taken into account these comments. Non-confidential consultation responses are published on the consultation website.^{[footnote 4]}

7.3 There was broad support for the proposed measures from a variety of stakeholders. Some stakeholders raised some concerns, in particular in relation to the breadth (or lack of) and/or specificity of the definition of the circumstances in which a crisis situation warranting these measures is met and the associated implementation timelines.

7.4 The issues raised and Ofcom’s response to them is included in detail in Ofcom’s regulatory Statement ‘Crisis Response Protocol’ published on 9 June.^{[footnote 5]}

8. Applicable Guidance

8.1 Pre-existing statutory Guidance was published by Ofcom under section 193 of the OSA to assist providers in identifying illegal content, including terrorism, hate, harassment, stalking, threats and abuse, and foreign interference (the Illegal Content Judgements Guidance^{[footnote 6]}. This is in addition to statutory guidance in relation to content harmful to children, including guidance on judgments on hate, violence, and abuse content, published under section 53 of the Act.^{[footnote 7]} These provide services with guidance on how to identify and make judgements on the content covered by these new measures.

Part Two: Impact and the Better Regulation Framework

9. Impact Assessment

9.1 Ofcom has a duty under section 7 of the Communications Act 2003 to carry out impact assessments when preparing a Code under section 41 of the OSA. The assessment must include an assessment of the likely impact of implementing the proposal on small businesses and micro businesses.

9.2 Ofcom has discretion as to the substance and form of an impact assessment. The impact assessments for these amendments to the Codes are included in Chapter 3 and Annex 3 of Ofcom’s Statement (i.e. the document published on its website which sets out its reasoning in full).^{[footnote 8]}

9.3 Ofcom has considered how the measures will reduce the risk of harm it has identified and how effectively it will do this. In doing so, it has drawn upon evidence from a range of stakeholders of the role certain types of illegal content and content harmful to children can play in exacerbating both online and offline risks during crisis periods, demonstrating the potential need for additional mitigations beyond business-as-usual activity. Ofcom’s crisis definition and the proposed measures reflect evidence that certain online harms can intensify during crises and contribute to environments where risks escalate rapidly, posing a wider threat to public safety.

Impact on businesses, charities and voluntary bodies

9.4 The impact on businesses is that if businesses providing online user-to-user services and search services comply with the measures in the Codes then they are considered to be compliant with the relevant illegal content safety duties to which the measure applies. Service providers can take alternative measures to comply and must keep a record of the measures and explain how the relevant safety duties have been met.

9.5 The impact on business, charities or voluntary bodies will vary depending on whether they provide services within scope of the OSA and whether they identify risks which bring them within scope of the measures. Ofcom’s Statement sets out why it considers this measure to be proportionate, in light of the risk posed by these services. Ofcom has assessed the impact of the measures for all providers in scope and concluded that the measures are proportionate.

9.6 The amendments may impact small or micro businesses where they are high risk for the aforementioned types of priority offence content and content harmful to children, but the approach taken does not include measures that impact small or micro businesses disproportionately. The OSA confers duties on regulated user-to-user services regardless of their size. The impact on businesses of any size depends on whether they assess as having risks on their services, as described in paragraph 5.7. The decision to not exempt small and micro businesses was taken because of the importance of addressing the risk of these content types in contributing to acute public safety threats in the UK.

9.7 There is no, or no significant, impact on the public sector. Paragraphs 9 and 10 of Schedule 1 to the OSA exempt services provided by public bodies and services provided by persons providing education or childcare from being regulated. The amendments also do not place additional duties on Ofcom beyond its existing statutory functions, and therefore do not have implications for Ofcom’s funding or wider role.

10. Monitoring and review

What is the approach to monitoring and reviewing the amendments to the codes of practice?

10.1 Pursuant to section 47 of the OSA, Ofcom must keep the codes under review. Ofcom will evaluate compliance with the regime and the impact of its guidance and codes. Ofcom’s monitoring and evaluation work includes assessing whether its interventions are leading to changes in services’ systems and processes, a safer online life for users, particularly children, and unintended consequences that need mitigation.

10.2 Ofcom’s monitoring and evaluation programme involves establishing an evidence base which would allow us to monitor whether life online in the UK is getting safer and to evaluate to what extent this is due to the impact of the Act. Ofcom will evaluate data from a range of sources, including its own research (such as its Online Experiences Tracker), and data collected from law enforcement, civil society groups, industry, and academia.

10.3 It is also important that Ofcom understands the impact of regulation under the OSA in specific areas. This could include, for example, the impact on businesses’ costs, particularly for small and micro businesses.

10.4 Additionally, Ofcom aims to understand the impact of discrete changes made by regulated services on safety outcomes, and will work with services to incentivise them to embed evaluation into their product development. Its Economics Discussion Paper Evaluating online safety measures^{[footnote 9]} sets out how a widely used evaluation framework could be applied to assess the impact and effectiveness of online services’ safety measures.

10.5 The instrument does not include statutory review clauses; section 47 of the OSA requires Ofcom to keep the codes under review.

Part Three: Statements and Matters of Particular Interest to Parliament

11. Matters of special interest to Parliament

11.1 The amendments to the Illegal Content Codes of Practice for User-to-User Services duties follows other amendments laid on 1 June 2026 relating to hash-matching for non-consensual intimate images. As these amendments do not apply to measures services are taking in response to non-consensual intimate images, they represent distinct amendments that relate to distinct, different aspects of services’ duties in relation to illegal content.

12. European Convention on Human Rights

12.1 As the instruments are subject to negative procedure and do not amend primary legislation, no statement is required.

13. The Relevant European Union Acts

13.1 The instruments are not made under the European Union (Withdrawal) Act 2018, the European Union (Future Relationship) Act 2020 or the Retained EU Law (Revocation and Reform) Act 2023 (“relevant European Union Acts”).

1. https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/statement-crisis-response-protocol?language=en ↩

2. https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/statement-crisis-response-protocol?language=en ↩

3. https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/online-safety-additional-safety-measures ↩

4. https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/online-safety-additional-safety-measures ↩

5. https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/statement-crisis-response-protocol?language=en ↩

6. https://www.ofcom.org.uk/siteassets/resources/documents/online-safety/information-for-industry/illegal-harms/illegal-content-judgements-guidance-statement-updated-30-july-2025.pdf?v=403556 ↩

7. https://www.ofcom.org.uk/siteassets/resources/documents/consultations/category-1-10-weeks/statement-protecting-children-from-harms-online/main-document/guidance-on-content-harmful-to-children.pdf?v=395445 ↩

8. https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/statement-crisis-response-protocol?language=en ↩

9. https://www.ofcom.org.uk/siteassets/resources/documents/research-and-data/economic-discussion-papers-/evaluating-online-safety-measures.pdf?v=360945 ↩