Online Safety Act: Ofcom consults on fraudulent advertising codes

The question

What will Ofcom expect large platforms and search services to do (operationally and at governance level) to prevent UK users encountering paid‑for fraudulent adverts under the Online Safety Act 2023 (OSA).

The key takeaway

Ofcom’s draft Fraudulent Advertising Codes (Codes) propose almost 40 measures that Category 1 and 2A “categorised services” (Providers) will need to meet, spanning governance, advertiser integrity, moderation, reporting and transparency (including ad libraries and AI tool testing). They aim to prevent, detect and rapidly remove paid-for fraudulent ads, supporting compliance with the OSA.

The background

Ofcom is the online safety regulator and is consulting on draft codes aimed at tackling fraudulent advertising on certain large Providers as part of the wider OSA package of measures. With online advertising being the second most common way fraudsters reach victims, Ofcom’s view is that platforms need to invest more leadership attention and controls. With UK digital ad spend surpassing £40.5bn in 2025 (IAB UK, Digital Adspend 2025), the proposals apply to paid‑for advertising content only, and not user‑generated content or non‑sponsored search results.

The development

The draft Codes adopt a layered “safety by design” approach across governance, account integrity and moderation:

• Governance includes: an annual senior-body review; a named individual accountable for fraudulent advertising compliance; written responsibilities; internal assurance; and a code of conduct and training.
• Account integrity includes: undertaking a “fraud indicator assessment” at least every 12 months; verifying that advertisers represent the businesses claimed; confirming financial services advertisers are legally permitted (for example by the Financial Conduct Authority); stronger security against account takeover; and banning advertisers posting fraudulent content.
• Moderation includes: rapid takedown; fast-track reporting for expert flaggers (including law enforcement); an ad library (with API) of live adverts; testing AI ad tools for misuse; and a requirement to use “all reasonable endeavours” to achieve equivalent controls where intermediaries are involved.

  Consultation on the Codes is currently open and closes on 2 October 2026, with further consultation on pro-activity technology to filter fraudulent ads expected in Autumn 2026. A final statement on the Codes is expected in 2027.

Why is this important?

For enterprise platforms, the draft Codes signal a shift towards demonstrable end‑to‑end controls across onboarding, account security, ad review, reporting and transparency, underpinned by senior governance and independent assurance. The proposed ad library is likely to be a major engineering and data‑governance workstream (with the public repository, API, defined metadata, daily updates and retention requirements).

With potential fines for breach up to £18m or 10% of qualifying worldwide revenue (whichever is greater) upon implementation, compliance is critical.

Any practical tips?

Providers should:

• run a structured gap analysis against the proposed measures, identifying required product, policy and operational builds
• map paid-for ad surfaces and ad pathways to confirm what is in scope and where they have sufficient control to implement measures, including via intermediaries
• (where financial services ads are carried) design a scalable permissions-verification workflow, with clear exception and appeals handling, aligned to publication requirements, and
• assess feasibility, privacy/security and resourcing impacts of an ad library with an API and one-year retention.

Autumn 2026