The Online Safety Act transparency-reporting duty applies to providers of , , and services after an Ofcom notice, not to every regulated service.
Use the notice and to identify the required information, reporting period, publication method, deadline, and accountable data owners. Keep this process separate from ad hoc Ofcom information notices.
Sections 77 and 78 and establish annual transparency reporting for , , and services. The duty to produce a particular report starts with an Ofcom for that categorised service. The notice controls the requested information, reporting period, format, working-day deadline, submission, and publication method. A voluntary report or response to a separate Ofcom information notice is not the section 77 report.
1
Section 1
Who reports, and what can Ofcom require?
Section 77 applies only to a provider of a service entered on Ofcom's register as , , or . Ofcom must give a separate notice for each categorised service, even where one provider operates several. Providers should use the register updated on 28 September 2026 to confirm the exact service, provider, category, and regulated part rather than report at group or brand level by default.
Ofcom published the first register on 30 June 2026 and most recently updated it on 28 September 2026. The register identifies the services subject to the transparency regime, but it does not supply the reporting fields or deadline. Ofcom first shares a draft notice so the provider can make written representations, then issues the final notice that creates the report-specific requirements.
limits the subjects Ofcom may request. and 2B notices can require user-to-user information about the listed matters; notices can require search-engine information. For a combined service listed in both Category 2A and Category 1 or 2B, Ofcom may require both. If the combined service is listed only in Category 2A, the notice can require only search-engine information.
Possible subjects include the incidence and dissemination of illegal or child-harmful content, assumed user exposure, reports and complaints, moderation and ranking systems, algorithms, risk assessment, safety measures, age assurance, CSEA reporting, user support, media literacy, and cooperation with public bodies. The list is a legal ceiling, not a requirement to report every item in every cycle; the final notice selects the information for that service.
For each reported figure, retain the numerator, denominator, population, time zone, date range, inclusion and exclusion rules, deduplication logic, source system, query version, owner, and known limitation. Explain material changes in methodology or coverage instead of presenting unlike periods as a trend.
Ofcom's final guidance is regulator guidance under section 78, not the notice itself. It explains how Ofcom will choose information, engage with providers, use reports, and enforce the framework. The Act, , the categorisation register, and the final notice control the binding obligation.
Trigger: confirm the service's register entry, then log receipt and effective requirements of its final Ofcom notice.
Scope: map each requested item to the , 2A, or 2B service part and the applicable matter.
Control: convert each notice item into a definition, source system, calculation, owner, reviewer, approval, submission field, and publication field.
Outcome: submit and publish a complete, accurate, standalone report in the format, manner, and number of working days specified.
Final section 78 guidance on annual reports, separate service notices, category-specific Schedule 8 information, combined services, provider engagement, compliance, and enforcement.
Primary legislation showing the transparency-reporting chapter and Schedule 8 information topics.
CHAPTER 5 Transparency reporting
2
Section 2
Who owns the report, and what evidence proves it is complete and accurate?
Assign one accountable report owner and a data owner for every notice item. Safety and product teams define the underlying operation; data and engineering reproduce the metric; privacy and security review disclosure risks; legal checks the notice and statutory basis; communications controls the published version. Ofcom's final guidance expects appropriate governance and sign-off by an appropriately senior accountable person.
The evidence pack should contain the notice and any pre-notice engagement, service and reporting-period scope, notice-to-field matrix, data dictionary, source-system map, query or calculation, extract, reconciliation, limitation note, reviewer sign-off, senior approval, submitted report, published report, URL, publication date, and any correction. Keep the pack at the same service-part level as the notice.
Name the accountable owner, metric owner, calculation reviewer, legal reviewer, privacy reviewer, and publication approver.
Freeze or version the query, data extract, definitions, evidence cut, submitted report, and publication copy.
Reconcile totals across related metrics and explain known mismatches, sampling, estimates, and unavailable fields.
Record Ofcom submission and public publication separately, then preserve any corrected version, reason, approval, and replacement date.
Official expectations for completeness, material accuracy, quality assurance, governance, senior sign-off, submission, publication, and advance preparation.
Primary legislation showing the transparency-reporting chapter and Schedule 8 information topics.
SCHEDULE 8 Transparency reports by providers of Category 1 services, Category 2A services and Category 2B services
3
Section 3
Which service and data boundaries cause reporting errors?
A notice attaches to one categorised service, not automatically to every product operated by the provider. For a combined service, check whether the register and notice cover the user-to-user part, the search engine, or both. Keep unrelated functions out of the denominator unless the notice includes them.
Check whether a metric can be compared across the entire reporting period. Acquisitions, launches, taxonomy changes, model changes, duplicate accounts, automated-versus-human actions, restored content, changed age-assurance methods, and incomplete historical logging can break comparability. State the break and its effect instead of silently combining unlike data.
Do not omit a requested item because it is difficult to obtain. Escalate the gap during Ofcom's engagement process, document available and unavailable data, and follow the final notice. Providers remain responsible for complete and materially accurate reports, and Ofcom says foreseeable data or resourcing failures are unlikely to excuse non-compliance.
Distinguish users, accounts, active users, impressions, pieces of content, reports, complaints, decisions, and enforcement actions.
State whether figures are exact, sampled, estimated, deduplicated, or produced from incomplete coverage.
Explain a definition, service-boundary, or methodology change beside the affected figures and avoid an unsupported year-on-year comparison.
Keep the final Ofcom guidance, the final service notice, separate information notices, draft consultations, and voluntary-report standards labelled by legal status.
Official rules and guidance for service-specific notices, combined-service boundaries, engagement, complete and accurate information, and foreseeable readiness gaps.
Primary legislation showing the transparency-reporting chapter and Schedule 8 information topics.
SCHEDULE 8 Transparency reports by providers of Category 1 services, Category 2A services and Category 2B services
4
Section 4
What is the reporting sequence?
Before the final notice, preserve data readiness and use Ofcom's engagement process to clarify service boundaries, feasibility, definitions, and likely reporting burden. After receipt, parse every requirement into a reporting matrix: requested item, matter, reporting period, regulated part, definition, source, calculation, limitation, owner, reviewer, approval, submission instruction, and publication instruction.
Run a dry close using the same extraction and approval path. Resolve missing ownership and inconsistent definitions, freeze the reporting cut, reproduce and reconcile the figures, complete the narrative, obtain senior sign-off, submit to Ofcom, and publish the standalone report exactly as the notice directs. The deadline is the number of working days in the notice; the Act does not supply one universal date for every provider.
If an error is found, preserve the original, assess materiality, notify the accountable owner and Ofcom where appropriate, correct the public and submitted versions through a controlled process, and record what changed. Failure to report, missed notice items, wrong format, late submission or publication, and material inaccuracy can lead to enforcement.
Maintain a notice-to-field matrix, controlled data dictionary, service-boundary record, and reporting calendar.
Test extraction, reconciliation, senior sign-off, Ofcom submission, public publication, and correction before the live deadline.
Track open data gaps with an owner, interim explanation, decision, and escalation date.
Repeat annually when Ofcom issues the next notice, and update the process after a register change, final-guidance change, service redesign, methodology change, or material reporting error.
Final section 78 guidance on annual reporting cycles, notice content, category and combined-service scope, engagement, quality assurance, submission, publication, and enforcement.
Final section 78 guidance on annual reports, separate service notices, category-specific Schedule 8 information, combined services, provider engagement, compliance, and enforcement.
Official expectations for completeness, material accuracy, quality assurance, governance, senior sign-off, submission, publication, and advance preparation.
Show 2 more
Official rules and guidance for service-specific notices, combined-service boundaries, engagement, complete and accurate information, and foreseeable readiness gaps.
Final guidance for pre-notice engagement, annual cycles, working-day deadlines, standalone reports, completeness, accuracy, governance, submission, publication, and enforcement.