Ofcom publishes Register of Categorised Services

On 10 July 2026, Ofcom published its register of categorised services, setting out which services qualify as Category 1, 2A and 2B services under the Online Safety Act 2023 ("OSA"). Categorised services will now be subject to various additional transparency and accountability duties under the OSA.

Ofcom's categorisation decisions are based on the criteria set out in secondary legislation, which look at the number of monthly active UK users and features of the service, such as whether it uses a "content recommender system" and whether it allows users to forward or share user-to-user content with other users.

What additional duties will apply to categorised services?

Category 1 services, which include services such as Facebook, Instagram, Snapchat and TikTok, will be subject to the most onerous additional duties, including:

• Duties to give users a choice about whether to verify their identity and the type of content they see, including whether they see content from users who have not verified their identity: sections 14 and 15 OSA.
• Duties to protect content of democratic importance, meaning content intended to contribute to democratic political debate. This includes a duty to take into account the importance of the free expression of democratic content when a service makes decisions about taking down or restricting access to such content: section 17 OSA.
• Duties to protect news publisher content. This includes a duty to notify a news publisher user and give it an opportunity to make representations before taking down its content: section 18 OSA (not yet in force).
• Duties to protect journalistic content. This includes a duty to have a dedicated complaints procedure in place for when journalistic content is taken down, and to swiftly action such complaints: section 19 OSA.
• Duties to protect users from fraudulent advertising: section 38 OSA.
• Duties to ensure compliance with the service's terms (including that the service provider takes down user-generated content only if that content does not comply with the terms of service: sections 71 and 72 OSA (not yet in force).
• Duties to provide and publish an annual "transparency report" to Ofcom containing such information as Ofcom requires: section 77 and Schedule 8 OSA.
• Duties to summarise the service's most recent illegal content risk assessment/children's risk assessment in the terms of service: sections 10(9) and 12(14) OSA.

Category 2A and 2B services will also be required to produce annual transparency reports under section 77 OSA. In addition, Category 2A services will be subject to the duty to protect users from fraudulent advertising (section 39 OSA) and additional duties in relation to risk assessments and record keeping under sections 27(9), 29(9) and 34(9) OSA.

Ofcom has also identified a number emerging Category 1 Services, which are services that meet 75% of the user number condition for Category 1 services, and at least one of its functionality conditions. Emerging Category 1 services are not currently subject to the additional duties under the OSA, but may become subject to them in future if they meet the thresholds.

Can services challenge Ofcom's categorisation decisions?

Under section 167 OSA, services may appeal to the Upper Tribunal against Ofcom's categorisation decisions, and they have one month in which to do so. Any additional duties arising from their categorisation will be temporarily suspended pending the determination of the appeal. The Upper Tribunal will decide such appeals by applying judicial review principles. 

Under section 96(6) OSA, service providers included in the register may at any time request removal from the register.  If Ofcom concludes that the service no longer meets the relevant threshold conditions, Ofcom must remove it from the register.

What happens next?

Category 1 and 2A services will need to provide Ofcom with copies of their latest illegal content and children's risk assessment records by October 2026, or confirm that Ofcom already holds an up to date record. By November 2026, Category 1 and 2A services must also publish a summary of their most recent illegal content and children's risk assessments in their terms of service (Category 1) or in a publicly available statement (Category 2A). These records and summaries should reflect how a service has been categorised in the register.

On 10 July, Ofcom also launched a consultation on the additional duties applicable to Category 1 services, as part of which it published a draft Additional Duties Code of Practice for Category 1 Services and various draft guidance on the additional duties. At the same time, it launched a consultation on the fraudulent advertising duties. Both consultations are open until 2 October.