On this page · 13 sections
- The 2027 timetable at a glance
- Who is categorised
- Transparency reports: what Ofcom can require
- Category 1 duties under consultation: what to build
- What already applies to every regulated service
- The under-16 social media ban runs on a separate track
- Enforcement and money
- UK and Vermont side by side
- Decision table: what your service should do in 2027
- Worked example: a UK marketplace approaching the thresholds
- Implementation checklist for 2027
- How eCorpIT can help
- References
Summary. The Online Safety Act 2023 reaches its third phase in 2027. Ofcom's register, published on 10 July 2026 and updated on 28 September 2026, lists 10 Category 1 services (Facebook, Instagram, Pinterest, Reddit, Roblox, Snapchat, TikTok, WhatsApp, X and YouTube), 4 Category 2A search services including ChatGPT Search, 25 Category 2B services and 4 services on the emerging Category 1 list. Quora moved from Category 1 to 2B in September. Every categorised service must publish its first transparency report in 2027. Draft transparency notices go out from 25 November 2026, with comments due by 20 January 2027. Consultations on Category 1 duties and a fraudulent advertising code closed on 2 October 2026; Ofcom plans final terms of service guidance in early 2027 and all final statements by mid-2027 at the latest. Separately, regulations for an under-16 social media ban are due before the end of 2026, with the rules expected from spring 2027. Fines reach £18 million or 10% of qualifying worldwide revenue, whichever is greater.
About this article. For product, data, trust and safety and compliance teams at services with UK users. We checked every date, threshold and duty against Ofcom's register, roadmap, consultations, bulletins and fees pages, the Act and SI 2025/226, GOV.UK announcements and the Vermont statute, as they stood on 12 November 2026. This is general information, not legal advice, and Ofcom revises its timetable often, so confirm decisions with your own counsel. Researched with AI assistance and reviewed by our editorial team.
The 2027 timetable at a glance
Most 2027 items are by dates, not fixed days, so plan to the earliest plausible point.
| When | Milestone | Who it affects |
|---|---|---|
| 28 September 2026 | Register updated: Quora moved from Category 1 to Category 2B | Categorised services |
| September 2026 to March 2027 | 2026/27 fee invoices (issued in October) payable, with instalments for bills over £75,000 | Fee-liable providers |
| 29 October 2026 | Ofcom reports on children's use of app stores and on age checks at 16 | App stores, social media |
| 25 November 2026 to 20 January 2027 | Draft transparency notices sent to providers; consultation on Ofcom's impact assessment | All categorised services |
| By the end of 2026 | First regulations for the under-16 social media ban to be laid; Ofcom's Additional Safety Measures statement | Social media; all regulated services |
| Early 2027 | Final statement on terms of service guidance | Category 1 |
| Spring 2027 | Under-16 social media restrictions expected to apply | Social media and some other services |
| During 2027 | First transparency reports, on dates set in each notice | All categorised services |
| By mid-2027 at the latest | Final codes and guidance on Category 1 duties and fraudulent advertising | Category 1 and 2A |
Sources: Ofcom's roadmap, register, October 2026 bulletin and app stores report, and the government's July 2026 announcement. The roadmap excludes the age-based restrictions announced on 15 June 2026. For US state deadlines alongside, see our US and UK compliance calendar for 2027.
Who is categorised
Categorisation depends only on UK user numbers and features; Ofcom's FAQs say being on the register does not mean a service is risky. User numbers are the monthly mean over the six months before the month Ofcom's assessment starts.
| Category | Threshold condition (SI 2025/226) | On the register, 12 November 2026 |
|---|---|---|
| Category 1 (user-to-user) | Over 34 million average monthly UK users plus a content recommender; or over 7 million plus a recommender and resharing | 10: Facebook, Instagram, Pinterest, Reddit, Roblox, Snapchat, TikTok, WhatsApp, X, YouTube |
| Category 2A (search) | Search engine with over 7 million users, excluding narrow vertical search | 4: Google Search, Bing, ChatGPT Search, Facebook Feed Deep Dive |
| Category 2B (user-to-user) | Over 3 million users plus private direct messaging | 25, including Airbnb, Discord, eBay, Etsy, Fortnite, iMessage, Indeed, Quora, Steam, Twitch, Uber Eats, Vinted, Xbox |
| Emerging Category 1 (no extra duties) | At least 75% of a Category 1 user threshold (25.5 million or 5.25 million) plus the matching feature condition | 4: iMessage, Messenger, Threads, Wikipedia |
Thresholds: SI 2025/226; entries: Ofcom's register. Four points matter for product teams.
- AI search is in. ChatGPT Search and Facebook's Feed Deep Dive sit in Category 2A for their search engines only. Ofcom says this is not a finding that the extra duties cover the whole chatbot or feed.
- Marketplaces and games are in. Any service with more than 3 million UK users and private messaging can reach Category 2B, which is why eBay, Vinted and Steam appear.
- The register moves. On 28 September 2026 Ofcom reassessed Quora under section 96(7) and moved it to Category 2B. Ofcom will also assess fast-growing services as they near the thresholds.
- There are exits and appeals. Under section 96 a provider can ask to be removed if its service has changed. Appeals against inclusion go to the Upper Tribunal within one month, with the duties suspended meanwhile; emerging-list decisions can be judicially reviewed within three months.
Wikipedia's operator lost its High Court challenge to the threshold regulations on 11 August 2025 and did not appeal. Wikipedia is on the emerging list, not in Category 1.
Transparency reports: what Ofcom can require
Section 77 requires Ofcom to give every Category 1, 2A and 2B provider an annual notice. The provider must report the specified information in the specified format, submit it to Ofcom and publish it by the notice's dates, and it must be complete and accurate in all material respects. Category 1 and 2B notices cover only user-to-user matters, Category 2A notices only search matters. Ofcom issued its final transparency guidance on 21 July 2025, and its roadmap says all categorised services must publish their first reports in 2027.
The first round now has dates. From 25 November 2026 Ofcom will send each categorised provider a draft notice and invite comments on the information, format and publication timeframe, alongside a consultation on its impact assessment; both close on 20 January 2027. That is the moment to argue scope and format, so line up data owners now.
Part 1 of Schedule 8 lists 20 matters Ofcom can ask user-to-user services about. In engineering terms they fall into five data domains:
- Prevalence and reach: incidence and spread of illegal and harmful content, and how many users met it.
- Reporting and moderation: user reporting, detection, takedown and how terms are applied.
- Algorithms: how ranking and recommendation systems promote or restrict such content.
- Safety measures: code measures, CSEA reporting, identity verification, child protections and media literacy.
- Governance: risk assessment at design, update and operation stages, and co-operation with UK public bodies.
The practical task is clear even before the final notice: a governed metrics layer producing UK-only counts of reports, actions, appeals, response times and exposure estimates, with definitions that stay stable year to year. EU Digital Services Act reporting pipelines can be reused, but UK scoping, content categories and formats will differ.
Category 1 duties under consultation: what to build
Ofcom's draft Additional Duties Code and guidance for Category 1 services closed for comments on 2 October 2026; the statement is due by mid-2027. One duty is already live: carrying out and publishing freedom of expression and privacy impact assessments began when the register was published. For the rest, the duties take effect 21 days after Ofcom issues the final code following the Parliamentary process, and Ofcom expects simple measures such as blocking, muting and comment controls quickly.
User empowerment
Category 1 providers must assess how likely adult users are to encounter relevant content: suicide, self-harm, eating disorder, and hateful and abusive content. Under the draft guidance, the first assessment is due within three months of the final guidance, or of becoming Category 1 later. The draft code then proposes controls: default settings for control features (measure ADU A1), options to remove the content from feeds or be warned about it, for example by blurring, reporting of specific relevant content (ADU A5), blocking and muting other users, and disabling comments.
User identity verification
Section 64 requires Category 1 providers to offer every adult UK user the option to verify their identity, unless verification is already needed to use the service, and says the process need not involve documents. Ofcom's draft guidance builds the scheme on four principles: relevance, reliability, inclusivity and clarity. Providers must also let adults filter out content from unverified accounts and stop those accounts seeing their posts. Where these take longer to build, Ofcom expects a credible, fully resourced plan.
Terms of service and complaints
Sections 71 to 74 require clear, accessible terms, consistent enforcement, and easy reporting and complaints when users think a provider is not keeping its commitments. For automated moderation, the draft guidance suggests balancing precision (the share of flagged items that are true positives) and recall (the share of true positives that get flagged), with quality checks against benchmarks.
News, journalistic and democratic content
Providers must usually notify a recognised news publisher and let it respond before acting on its content. The draft code adds an expedited complaints route for journalistic content and reviews of upheld complaints, so that protections for content of democratic importance apply across a wide range of political opinion.
Fraudulent advertising (Category 1 and 2A)
The draft fraudulent advertising codes cover paid-for adverts, not user-generated content or ordinary search results. Ofcom's summary table lists 34 proposed measures (its announcement says nearly 40): governance, a fraud indicator assessment, advert moderation, complaints with a trusted flagger channel, advertising libraries, testing of advert-generation tools, terms of service, account integrity (advertiser checks, financial services verification, account security, takeover reporting and advertiser bans) and account appeals.
What already applies to every regulated service
Categorisation adds duties; it does not replace the baseline. All in-scope user-to-user and search services have carried illegal content duties since 17 March 2025, and services likely to be accessed by children have carried children's duties since 25 July 2025, including highly effective age assurance where required. Since 7 April 2026, user-to-user services must report detected and unreported child sexual exploitation and abuse content to the National Crime Agency; search services follow later.
Hash matching for intimate image abuse entered the illegal content codes on 30 September 2026, and crisis response measures on 2 November 2026. Ofcom's roadmap reports investigations into nearly 100 services. Its October bulletin adds that new legislation requires intimate images shared without consent to be taken down within 48 hours, and that Ofcom will consult with a view to that duty applying in 2027.
The under-16 social media ban runs on a separate track
On 15 June 2026 the government announced that social media platforms will be barred from offering services to under-16s, following Australia's model. It named Snapchat, TikTok, YouTube, Instagram, Facebook and X as examples, said it does not intend to cover messaging services such as WhatsApp, and will also restrict livestreaming and contact from strangers on a wider range of services, including games. The rules will come through secondary legislation under the Children's Wellbeing and Schools Act.
On 15 July it added, for 16 and 17 year olds, a default overnight curfew from midnight to 6am with notifications off, and autoplay and personalised feeds off by default; teenagers can change these settings. The first regulations are due before the end of 2026, with the measures expected in spring 2027.
On 29 October 2026 Ofcom named four methods it considers capable of being highly effective at checking whether a user is 16 or over: photo ID matching, digital ID services, banking-based checks and facial age estimation backed by a challenge age. It will consult on guidance once the regulations are laid. Its app stores report, published the same day, found that the stores it examined rely on self-declared ages; app stores are not regulated under the Act. For the platform side of age checks, see our age assurance engineering service.
Enforcement and money
Schedule 13 sets the maximum penalty at the greater of £18 million or 10% of qualifying worldwide revenue for the most recent complete accounting period.
Fees are separate. A provider with qualifying worldwide revenue of £250 million or more (a threshold still subject to Parliament) pays an annual fee, unless its UK referable revenue is below £10 million. For 2026/27, based on 2024 revenue, Ofcom set the tariff at 0.02232% and issued invoices in October 2026. They are payable until March 2027, with instalments for bills over £75,000. As an illustration, a provider with £300 million of qualifying worldwide revenue would owe £300 million times 0.02232%, which is £66,960, below the instalment threshold. The 2027/28 notification window closed on 30 September 2026, and Ofcom expects to publish that year's tariff in March 2027 and issue invoices from April.
UK and Vermont side by side
Many apps serve both markets. Vermont's Age-Appropriate Design Code (Act 63 of 2025) applies from 1 January 2027 and works very differently. Our Vermont design code guide covers it in depth.
| Item | UK Online Safety Act | Vermont Age-Appropriate Design Code |
|---|---|---|
| Who is in scope | All user-to-user and search services with UK links; extra duties only for categorised services | Businesses in Vermont earning most revenue online whose service minors are reasonably likely to access, including a 2% audience test |
| Age assurance | Highly effective age assurance where children's duties require it; age checks at 16 for the planned ban | Attorney General rules must put user privacy and accessibility ahead of accuracy |
| Feeds | Children's codes now; personalised feeds off by default for 16 and 17 year olds under the planned rules | Personal data may not select or rank media for minors unless they expressly ask |
| Night-time | Planned default curfew from midnight to 6am for 16 and 17 year olds | No push notifications to minors from midnight to 6am, and none by default |
| Enforcement | Ofcom; up to £18 million or 10% of qualifying worldwide revenue | Attorney General; violations are unfair and deceptive acts |
Sources: the Act, the government's July announcement and Act 63. The overlap is large: private defaults, limited personalisation for minors, quiet hours and data-minimising age assurance. One age-signal and policy service with UK and US rules on top beats two separate builds. For US age-signal sources, see our guides to app store age laws and California's AB 1043.
Decision table: what your service should do in 2027
| If your service... | Then in 2027... |
|---|---|
| Is on the register as Category 1 | User empowerment assessment within three months of final guidance; optional identity verification and unverified-user filter; terms and complaints rework; fraud advert controls |
| Is Category 2A (including AI search) | Transparency reporting on search information; fraud advert measures for paid search |
| Is Category 2B | Transparency data pipeline; comments on the draft notice by 20 January 2027 |
| Is on the emerging Category 1 list | Track UK users against 7 million and 34 million; model adding recommenders or resharing |
| Has 2 to 3 million UK users with messaging | Model when you cross 3 million |
| Is not categorised | Keep risk assessments current; check fee liability and the under-16 rules |
Section 75's deceased child user duties cover all three categories but had not been brought into force when we checked.
Worked example: a UK marketplace approaching the thresholds
Take a hypothetical UK resale marketplace with buyer-seller messaging and 3.4 million average monthly active UK users. It exceeds 3 million and offers private messages, so it meets the Category 2B threshold; once Ofcom registers it, a transparency notice follows.
For 2027 the team plans a personalised feed of listings (a content recommender) and a share button (a forward or share function). Forecasts put UK users at 5.6 million by the end of 2027.
- Emerging list: 5.6 million is above 5.25 million (75% of 7 million), so with both features the service would join the emerging Category 1 list: no new duties, but closer scrutiny.
- Category 1: above 7 million users with both features, it would face user empowerment, identity verification, terms of service and fraudulent advertising duties.
- Without sharing: the lower Category 1 route does not apply, so Category 1 would need more than 34 million users with a recommender.
The penalty ceiling scales too: with £300 million of qualifying worldwide revenue, 10% is £30 million, above £18 million, so the ceiling is £30 million. Real penalties are set case by case.
The point is not to avoid useful features but to price them: a share button that tips the service into Category 1 at 7 million users brings a known build list, so model it before launch.
Implementation checklist for 2027
- Confirm your status on the register and file any section 96 removal request with evidence.
- Track UK monthly active users on the six-month averaging basis, against 3, 5.25, 7, 25.5 and 34 million.
- Build a transparency metrics layer for UK reports, actions, appeals, response times and exposure estimates.
- Document algorithms that rank or restrict content, ready for Schedule 8 questions.
- Respond to your draft transparency notice on scope, format and timing by 20 January 2027.
- Category 1: plan user empowerment assessments and controls, optional identity verification with an unverified-user filter, and specific terms tested against automated moderation.
- Category 1 and 2A: map advertiser onboarding, account integrity and ad libraries to the fraud codes.
- Keep risk assessments current, including the cyberflashing and serious self-harm priority offences added in December 2025.
- Check fee liability for 2027/28 and plan instalments where available.
- Watch the under-16 regulations due before the end of 2026 and Ofcom's guidance consultation that follows.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our data and analytics services team can build a UK transparency metrics layer from your event and moderation data and track your user counts against the categorisation thresholds, with your counsel making the legal calls. Talk to us at /contact-us/.
Last updated: 12 November 2026.
