Ofcom says platforms 'should not drag their heels' on scam adverts that cost Britain £200 million a year. The legal duty behind that warning became law in January 2024 and will not bind anyone before mid-2027.
Estimated reading time: 6 minutes
In short. Ofcom's 10 July 2026 statement calls on Big Tech to stop being part of a "scourge" of scam adverts that costs UK consumers "over £200million" a year [[1]]. It says its draft Fraudulent Advertising Code means platforms will "for the first time be legally required" to tackle the problem, "when it comes into force" [[1]]. The duty behind that sentence is not new: section 38 of the Online Safety Act became law on 10 January 2024 [[5]], two and a half years before this statement. Ofcom's own Annex 2 says that duty has no effect on any platform until a code exists [[3]], and Ofcom's own target for finishing that code is "mid-2027 at the latest" [[2]] - a gap of close to four years since Parliament said this protection should exist, next to the seventeen months Ofcom took to bring its first illegal content codes into force under the same Act [[6]]. Two documented mistakes: four stars.
On 10 July 2026 Ofcom published a consultation setting out "nearly 40 new safety measures" it wants the largest online platforms to adopt against scam adverts, alongside a public statement announcing them [[1]] [[2]]. The numbers behind the announcement are blunt: "more than £40billion a year is spent on digital advertising across the UK"; "over half (51%) of adults have encountered potentially fraudulent ads online, with over a third (36%) seeing them frequently"; and "an estimated total of over £200million is lost by victims to these kinds of scams in the UK on average each year" [[1]]. Oliver Griffiths, Ofcom's Online Safety Group Director, called the moment overdue: "For too long, victims have been exposed to scam ads online with tech giants simply not doing enough to combat the fraudsters using their platforms" [[1]].
A duty that has existed since January 2024
What the statement says next is the sentence this piece tests: "Ofcom's draft fraudulent advertising code, published today, means Big Tech will for the first time be legally required to put robust measures in place to address scam advertising, when it comes into force" [[1]]. Read on its own, that sentence describes a gap still to close. Read against the Act, it describes a gap that has existed since Parliament passed the duty. Section 38 of the Online Safety Act 2023 requires Category 1 platforms to use "proportionate systems and processes" designed to prevent, minimise and swiftly remove fraudulent advertising [[3]]. The Act received Royal Assent on 26 October 2023 [[4]], and section 38 itself came into force a few weeks later, on 10 January 2024, under a commencement order [[5]]. That clause has sat on the statute book for two years and nine months by the time Ofcom announced the measures meant to give it effect.
Why "for the first time" is accurate, and what it hides
Ofcom's own Annex 2 to the consultation, setting out the legal framework, explains the mechanism directly: "The fraudulent advertising duties apply to providers from the day on which the first relevant code comes into force" (para A2.44) [[3]]. So the statement is not wrong, exactly: no platform can be fined for breaching section 38 until that first code exists. But the sentence is built to read as a gap about to close, not a duty that has sat dormant, by design, since January 2024, while Ofcom's own figures show victims losing £200 million a year in the meantime [[1]]. Ofcom's own consultation page says it plans to publish its Statement on the code "by mid-2027 at the latest" [[2]], and the Annex sets out what happens after that: the draft must be laid before Parliament, which has up to 40 days to object, and if it does not, the code "will come into force 21 days later" [[3]]. On Ofcom's own published timetable, the earliest a platform could face enforcement under section 38 is not "when it comes into force" in any near sense; it is, at best, the second half of 2027, just short of four years after Parliament enacted the duty.
A pace mismatch inside Ofcom's own record
Ofcom has moved faster before. Its first set of codes under the same Act, the illegal content Codes of Practice covering terrorism material, child sexual abuse content and other priority offences, came into force on 17 March 2025 [[6]] - seventeen months after Royal Assent [[4]]. The fraudulent advertising code, covering a single category of harm that Ofcom's own statement calls part of "fraud, the UK's most commonly experienced crime" [[1]], did not reach consultation stage until 10 July 2026, two years and nine months after Royal Assent [[4]] [[2]], and will not reach force, on Ofcom's own timetable, for the best part of another year after that [[2]] [[3]]. Griffiths' own words to industry - "Platforms should not drag their heels - they can start making improvements for their users now" [[1]] - read differently next to a regulatory timetable that has itself taken nearly twice as long as its predecessor to reach the same stage.
The claims, tested
| The document's own words | What the record shows | Verdict |
|---|---|---|
| "Ofcom's draft fraudulent advertising code... means Big Tech will for the first time be legally required to put robust measures in place to address scam advertising, when it comes into force" [[1]] | Section 38 of the Act, creating that exact duty, received Royal Assent 26 October 2023 and came into force 10 January 2024 [[4]] [[5]]; Ofcom's own Annex 2 confirms the duty has no legal effect on any platform until the code exists, and Ofcom does not expect that before "mid-2027 at the latest" [[2]] [[3]] | Technically accurate, framed to read as an imminent step rather than a near four-year wait since the duty was written into law |
| "Platforms should not drag their heels - they can start making improvements for their users now" [[1]] | Ofcom's own first code under the Act, covering illegal content, took seventeen months from Royal Assent to force [[4]] [[6]]; this code has taken at least thirty-three months to reach consultation and will not be in force for close to four years [[2]] [[4]] | The regulator's own pace on this specific duty is the slower of the two it can be measured against |
The mistakes, counted
A near four-year gap is presented as an imminent step forward (1). The statement's central claim, that the draft code will "for the first time" make robust measures "legally required," is the sentence a reader is meant to take as the news. It is accurate about the mechanism, confirmed by Ofcom's own Annex 2 [[3]], but it says nothing about how long that mechanism has already been running. Section 38 has existed in force since 10 January 2024 [[5]], almost exactly the moment Ofcom's own statement implies the obligation is only now arriving. A reader is given the duty's effective date, not its enactment date, and the two are nearly three years apart.
Ofcom's own pace on this duty undercuts its call for speed (2). Griffiths tells platforms not to "drag their heels" on a problem Ofcom's own release puts at £200 million a year [[1]]. Measured against Ofcom's own prior code under the same Act, seventeen months from Royal Assent to force for illegal content [[4]] [[6]], the fraudulent advertising code is running at roughly double that pace end to end, and had not even reached consultation stage by the thirty-three-month mark [[2]] [[4]]. The call for others not to delay sits next to a regulatory timetable, for this exact duty, that the regulator itself has not kept to the standard it set with its first code.
Credit where due
Two things in Ofcom's record check out. First, the mechanism is stated plainly, not buried: Ofcom's Annex 2 sets out in its own numbered paragraph that the duty only binds providers once a code is in force [[3]], rather than leaving that to be inferred. Second, the sequencing has a real justification: section 38 only binds "Category 1" and "Category 2A" services, and Ofcom could not finalise which platforms that covers until its register of categorised services existed; that register was published on 30 June 2026, just ten days before this consultation opened [[7]] [[2]]. Third, a separate line in the statement, that non-paid-for fraudulent content is "already in force" under existing duties, checks out independently: fraud offences under the Fraud Act 2006 sit in Schedule 7 of the Act as priority illegal content [[8]], covered by the illegal content Codes of Practice since 17 March 2025 [[6]]. The gap this piece documents is specifically about paid advertisements, the one slice of fraud content the Act always timed to its own, later code.
Verdict
Four stars, from two documented mistakes. Ofcom's account of the mechanism is accurate: a code must exist before section 38 bites, and Ofcom says so in its own supporting document rather than hiding it. But the public statement about that mechanism reads as momentum where the record shows a multi-year wait, and the regulator's own call for platforms not to delay sits awkwardly next to a timetable, for this specific duty, that has already taken close to twice as long as its first code under the same Act.
The star score counts two documented mistakes. First, Ofcom's July 2026 statement that its draft code means platforms will "for the first time be legally required" to tackle scam adverts "when it comes into force" is accurate on its own terms but describes, without saying so, a duty that has existed in statute since January 2024 and will not bind any platform until a process Ofcom does not expect to finish before mid-2027 at the earliest. Second, Ofcom's own call for platforms "not to drag their heels" sits against a timetable, for this specific duty, that has itself taken roughly twice as long to reach consultation as Ofcom's first code under the same Act took to reach force. Two falls in the 1 to 3 band: four stars; the bands are on the ratings page. This piece makes no finding about the conduct of any named individual; it quotes Ofcom officials directly, on statements they made in Ofcom's own publications. Checked directly against Ofcom's statement, its consultation page, its Annex 2 legal framework, the Online Safety Act 2023 and Ofcom's own compliance timeline, all fetched and read in full 17 October 2026.
Sources
- Big Tech must tackle scourge of scam adverts, says Ofcom, Ofcom, published 10 July 2026
- Consultation: Fraudulent Advertising Codes of Practice, Ofcom, published 10 July 2026, last updated 28 July 2026
- Annex 2: Legal framework - duties of providers and Ofcom in relation to fraudulent advertising, Ofcom, published 10 July 2026
- Online Safety Act 2023, legislation.gov.uk
- Online Safety Act 2023, section 38: Duties about fraudulent advertising: Category 1 services, legislation.gov.uk
- Important dates for Online Safety compliance, Ofcom
- Register of categorised services and list of emerging Category 1 services, Ofcom, published 30 June 2026
- Online Safety Act 2023, Schedule 7: Priority offences, legislation.gov.uk