Ofcom's crisis moderation rules take effect for large UK platforms

What took effect on 2 November

The amended Illegal Content Codes and Protection of Children Code were released on 12 October, three weeks before they came into force.

Covered services must keep a written crisis protocol setting out how they monitor warning indicators and judge whether a crisis is under way. They must send in a senior response team "as soon as reasonably practicable" once they decide a crisis is occurring or likely to occur, according to Reclaim The Net's account of the paperwork. Large platforms must also open a dedicated channel for law enforcement, and no court order is needed to activate it. None of this has to be published, so the decision-making framework stays closed to users and outside observers, Gadget Review reported.

Reclaim The Net notes that a platform can follow the protocol in full without telling anyone it did so.

Ofcom defines a crisis as an extraordinary situation posing a serious threat to public safety in the UK, highly likely to have caused, or resulted from, a significant rise in relevant illegal content. Local, regional or overseas events can qualify. Ofcom cites the 2024 Southport murders in its rationale, noting that online content fuelled violent riots afterwards, according to its published statement.

The 7 million figure is the dividing line for the medium-risk tier. Services below it escape the medium-risk tier unless Ofcom rates them high-risk, which pulls in smaller forums, messaging apps, dating apps, games, marketplaces and some AI tools.

Ofcom finalised the crisis protocol on 9 June, the same day riots spread through Belfast after a stabbing on the Shankill Road, Reclaim The Net reported.

Why the trigger point worries critics

Platforms can switch the protocols on before a crisis is confirmed. The threshold is "likely to occur", so warning signals rather than an observable event can set the machinery going, Gadget Review reported. Ofcom accepts that "a higher risk of false positives is likely to be proportionate", according to Reclaim The Net's reading of the regulator's paperwork. Lawful speech, accurate reporting or eyewitness footage could be restricted while an event is still unfolding. Ofcom's answer is that crises are rare, so intervention will be rare too.

Content in scope includes terrorism, hate, harassment, stalking, threats and abuse, foreign-interference material and content harmful to children.

The government has said the steps are not mandatory in themselves. A platform that follows them will be treated as having complied with the law, which leaves anyone choosing another route to prove to Ofcom that their method is equally effective. Ofcom also says the measures do not let it declare a crisis and do not introduce emergency powers. The precise legal limits on what police can request through the new channel are not fully established in Ofcom's public materials, Gadget Review reported.

The enforcement backdrop

The crisis rules arrive while the shape of Ofcom's powers is still being fought over. On 30 October the High Court let Ofcom demand data from Meta, WhatsApp and X, a judgment that strengthens its data-gathering powers but does not authorise emergency content shutdowns, Reclaim The Net reported. Meta, TikTok and X are separately challenging information notices issued in February, in a three-day hearing that began on 5 October. A witness statement from X called the notice "the most burdensome information request X has received from any regulator in any jurisdiction", Reuters reported.

Ofcom says it narrowed the scope of its requests before implementation, and that Parliament gave it the job of regulating an industry unregulated for more than 20 years.

Meta is also contesting the fine formula at the High Court, arguing that penalties should rest on UK revenue rather than worldwide earnings. Meta's challenge, filed as claim AC-2025-LON-004500, targets the regulations that operationalise the ceiling. Under the current rules Ofcom can fine up to 10% of qualifying worldwide revenue or £18 million, whichever is greater.

Gadget Review notes that Ofcom gains no power to declare a crisis or order content removed; the platforms make the operational calls.

Ofcom's own verdict on progress has been blunt. Oliver Griffiths, its group director for online safety, told the Lords communications committee that Ofcom was "underwhelmed" by the Act's overall effect so far. Ofcom said the legislation would not be fully operational until the middle of 2027. He also warned that the government's planned under-16 social media ban could stretch resources without extra staff and funding.

What happens next

Ofcom plans to publish a revised roadmap by the end of the year and is in talks with the government about funding and sequencing. The final duties for categorised services are not expected to be fully in force until around the middle of 2027.

Other pieces are still moving. The consultation on scam ad measures closes in October, with final decisions not expected until next year, The Guardian reported. Ofcom's investigation into whether Meta completed illegal-content and children's risk assessments before launching Instagram Instants, reported in October, is still open.

How often platforms will actually trigger the protocols is unknown. They need not publish them, and Ofcom cannot declare a crisis itself.