United Kingdom

[GB] Ofcom proposes new fraudulent advertising duties for major online platforms and search engines

IRIS 2026-8:1/26

Alexandros K. Antoniou

University of Essex

The UK’s online safety regulator, Ofcom, has proposed nearly 40 measures requiring the largest social media and search services to strengthen their systems against paid fraudulent advertising. The draft codes of practice would implement the additional duties in sections 38 and 39 of the Online Safety Act 2023 (OSA) for Category 1 and Category 2A services respectively. Their central feature is a shift from post-publication removal towards controls spanning advertiser access, ad creation and placement. The proposals cover advertiser verification, account security, moderation, complaints, governance and advertising technology.

The OSA duties apply only to "categorised" services, identified under statutory thresholds set by the government and implemented by Ofcom. Category 1 covers large user-to-user platforms meeting specified user numbers, a content recommender system and content sharing criteria; Category 2A covers qualifying search engines, sites or apps with more than seven million UK users. The fraudulent advertising duties sit alongside existing OSA requirements tackling fraudulent user-generated content. The new regime addresses paid advertisements specifically. Ofcom estimates UK digital ad spend at over GBP 40 billion a year and reports that 51% of adults have seen potentially fraudulent ads on social media, search, or video-sharing services, with estimated losses exceeding GBP 200 million annually.

For Category 1 platforms, section 38 requires proportionate systems and processes designed to prevent UK users encountering fraudulent advertisements and to remove them swiftly once identified. Section 39 performs the corresponding role for Category 2A search services in relation to paid advertisements encountered in or via search results. The draft codes mirror one another but adapt their measures according to how each category delivers advertising. Providers implementing the recommended measures will be treated as complying with the corresponding duties, although the OSA permits alternative measures where providers can demonstrate equivalent compliance (Draft Category 1 Code, paragraphs 1.6-1.9; Draft Category 2A Code, paragraphs 1.6-1.9).

The proposed controls begin before an advert reaches users. Platforms would be expected to assess indicators of fraudulent advertising, including advertisement content, advertising account behaviour, targeting practices, complaints, moderation outcomes, information from intermediaries and referrals from law enforcement or trusted flaggers. That assessment would feed into documented advertising policies and moderation functions for reviewing, swiftly removing suspected scams. Providers would also establish performance targets, resource moderation appropriately and train staff (Draft Category 1 Code, FAU B1 and C1-C7; Draft Category 2A Code, FAS B1 and C1-C7).

A separate group of measures targets the accounts behind advertisements. Ofcom proposes checks to establish whether advertisers are connected with businesses they claim to represent, alongside strengthened account security and tools for reporting account takeovers. Providers would be expected to ban advertisers responsible for fraudulent ads and address attempts to return through new accounts. Financial services advertising receives distinct treatment: platforms should verify, before adverts for banking or investment services reach UK users, whether the advertiser is legally permitted to promote the service, including checks against the Financial Conduct Authority’s Financial Services Register and Warning List (FAU H1-H5; FAS H1-H5).

The proposals also address newer advertising tools. Where Category 1 or Category 2A providers make "advertisement generation" tools available, the draft codes recommend structured testing to identify whether those tools can be misused to generate fraudulent advertising. The codes additionally envisage record keeping around testing and internal oversight. The proposed fraud controls therefore extend beyond scam adverts themselves to automated and AI-supported tools used to create them (FAU F1; FAS F1).

Reporting and external intelligence form another part of the proposed system. Users should have accessible mechanisms for reporting suspected fraudulent ads, while designated trusted flaggers would have dedicated channels. Complaints would require "appropriate action" and providers would operate appeal procedures for challenged decisions concerning advertisements or advertising accounts. The codes also provide for advertising libraries and transparency in terms of service (for Category 1 services) or publicly available statements (for Category 2A services) about proactive technologies used for complying with the fraudulent advertising duties (FAU D1-D7, E1 and G1-G2; corresponding FAS measures).

The draft framework also places responsibility at organisational level. Recommended governance measures include annual compliance reviews by the service’s senior governance body, allocation of individual responsibility, written statements of responsibilities, internal assurance, conduct standards and training. Where platforms rely on advertising intermediaries and lack sufficient control to implement measures directly, separate provisions require "reasonable endeavours" to secure implementation through those relationships (FAU A1-A6 and K1; FAS A1-A6 and K1).

Taken together, the draft codes address the advertisements and the systems through which advertisers obtain and retain access. Final decisions are expected in 2027. Ofcom nevertheless said that "platforms should not drag their heels", noting that in-scope firms can begin strengthening protections for users "now". Both codes require parliamentary approval before taking effect. When in force, non-compliance with the relevant duties may lead to enforcement, including penalties of up to GBP 18 million or 10% of qualifying global revenue, whichever is greater.