Key Takeaways from Ofcom’s Consultation on Fraudulent Advertising Codes of Practice

On 10 July 2026, Ofcom published a consultation on its draft Fraudulent Advertising Codes of Practice, the latest package of implementation documents for categorised services under the Online Safety Act 2023 (“OSA”).

Background

The OSA imposes duties on a range of online services, including social media platforms, search engines, and sites that host user-generated content, with the aim of improving user safety across those platforms. Highest risk services are subject to more stringent measures and this latest consultation relates to enhanced obligations that apply to certain Category 1 and Category 2A services displaying paid-for advertisements.

What are the proposals?

The draft codes contain a substantial package of recommended measures covering the lifecycle of online advertising, with a focus on governance, systems and accountability. Ofcom sets out the measures it considers are capable of satisfying the statutory duties under the OSA. Providers remain free to adopt alternative measures but will then need to demonstrate that those measures achieve compliance with the legislation. The proposals can broadly be grouped into three themes: (1) governance and risk management; (2) ensuring account integrity; and (3) moderation and enforcement.

Governance and risk management

Measures include regular review of risk assessments, internal responsibility allocation, and maintenance of appropriate policies and procedures for managing fraudulent advertising risks. This reflects a wider trend where Ofcom expects compliance to be embedded within organisational governance rather than addressed through isolated moderation decisions.

The draft codes also propose that platforms should undertake a “fraud indicator assessment” to evaluate risk by tracking characteristics suggesting individual advertisements and accounts pose a material risk of fraud.

As the use of generative AI has assisted the proliferation of fraudulent advertisements, Ofcom has also proposed that where AI ad-generation tools are made available to advertisers, online services should seek to test those tools and mitigate foreseeable risks that they facilitate fraudulent advertising.

Ensuring account integrity

Among the proposed measures are recommendations for advertiser verification, strengthening account integrity using robust assessments on account creation, steps to prevent account compromise, and identification of repeat offending advertisers.

Online services should also provide an effective appeal process for advertisers subject to account restrictions. The draft codes are clearly grounded in preventative measures rather than simply taking a reactive approach.

Moderation and enforcement

Ofcom suggests that online services set up publicly available advertising libraries, containing information about live advertisements while those ads are live on the service and for a year after. The rationale is that this will improve transparency and facilitate the interrogation of suspected fraudulent advertising.

The draft codes also recommend that platforms have effective mechanisms for detecting potentially fraudulent advertisements, acting on reports of fraudulent ads, removing fraudulent content and taking appropriate actions against advertisers who are repeat offenders. Ofcom’s proposals aim to make the reporting of fraudulent advertisements easier, by ensuring reporting systems are “easy to find, easy to access and easy to use”.

Three key takeaways:

1. Expanded responsibility

   The draft codes reinforce the widening scope of platforms' responsibilities under the OSA. They place greater responsibility on in-scope services to assess, prevent and mitigate the risk of fraudulent advertising throughout the advertising lifecycle. This reflects Ofcom's expectation that platforms should play a more active role in reducing the prevalence of online fraud.

2. An emphasis on proactivity

   A key theme running throughout the draft codes is an emphasis on prevention. Online services are encouraged to identify and address fraud risks before they materialise. This represents a shift away from post-publication moderation towards the establishment of preventative controls within platform operations.

3. Governance and compliance systems take centre stage

   The draft codes highlight that effective compliance is increasingly about demonstrating robust governance and systems. Ofcom expects providers to have appropriate policies and procedures, clear accountability structures, regular risk assessments and effective oversight of fraudulent advertising risks. For in-scope services, this could entail substantial investment and significant training of personnel responsible for overseeing the online service’s advertising ecosystem, as Ofcom seeks to embed accountability for fraudulent advertising at all stages.

Consultation timetable

The consultation closes on 2 October 2026. Ofcom intends to consider stakeholder responses before publishing its final Statement, which is currently expected in mid-2027.