Ofcom's consultation on the Online Safety Act's identity verification duty closes at five o'clock this evening. Three years after Parliament created that duty, it still is not law.
Estimated reading time: 7 minutes
In short. Ofcom's consultation on guidance for the Online Safety Act's user identity verification duty closes today, 2 October 2026, at five o'clock. Its own Overview document tells stakeholders that "providers also have a duty to offer adult users the option to verify their identity on the service" (page 1) [2]. Legislation.gov.uk's own record for that duty, section 64 of the Online Safety Act 2023, carries a single commencement note: "S. 64 not in force at Royal Assent, see s. 240(1)" [4], and none of the seven commencement orders made under the Act since 2023 brings it into force. Two documented mistakes: four stars.
Five o'clock this evening is the deadline. Ofcom's consultation page states it plainly: "Consultation closes: 2 October 2026 at 5pm" [1]. What closes is the chance to comment on how the UK's biggest online services should implement a right that sat near the centre of the public argument over the Online Safety Act: the option for adult users to verify who they are, and for everyone else to filter out anyone who has not.
That right is section 64 of the Act. Its operative line is short: "A provider of a Category 1 service must offer all adult users of the service the option to verify their identity (if identity verification is not required for access to the service)" [4]. The verification itself can be as light as the provider chooses, the Act says it "may be of any kind" and "need not require documentation to be provided" [4], but the duty to offer it at all sits in statute, passed by Parliament, written down, numbered.
This site has already torn down a neighbouring part of the same Category 1 machinery: the register naming which platforms actually count as Category 1 took 902 days to appear after its own section of the Act commenced, leaving the general user-empowerment duty in section 15 bound to nobody in the meantime [7]. Section 64 is a different and, on the Act's own public record, a more basic problem than a late register. The register existed in law and simply had no names on it. Section 64 itself has never been switched on at all.
The duty the consultation assumes is live
Ofcom's Overview document for this consultation describes section 64 as a present fact. "Providers must also offer users tools to control their exposure to this content and to unverified users. Providers also have a duty to offer adult users the option to verify their identity on the service" (page 1) [2]. The accessible chapter summary says the same thing in different words: the duties "require providers to give adult users the option to both verify their identity to the service, and to filter out non-verified users of that service" (page 6) [3]. Neither document, in the parts put out for public consultation, tells a reader that section 64 itself has no commencement date.
Legislation.gov.uk's own annotation for the section says so directly. Under section 64's text sits one line, headed "Commencement Information": "I1 S. 64 not in force at Royal Assent, see s. 240(1)" [4]. Section 240(1) is the general switch: "this Act comes into force on such day as the Secretary of State may by regulations appoint" [4]. Seven sets of regulations have pulled that switch since Royal Assent on 26 October 2023, most recently the Online Safety Act 2023 (Commencement No. 7) Regulations 2026, made 9 March 2026, which brought a list of other provisions into force on 7 April 2026: sections 66, 69, 100(6)(a)(iii), 104(13)(a)(xii), 120(2)(a), 199 to 203, 204(2) to (4), 205 and one schedule paragraph [6]. Section 64 is not on that list, or on any of the six before it. Its own page carries no second commencement annotation. By the plainest reading of the Act's own public register, the duty this consultation exists to help providers comply with is not yet one they have to comply with.
Ofcom's own clock started first
The gap is not only in the duty on providers. Section 65 gives Ofcom its own separate duty, to write the guidance this consultation is drafting: "OFCOM must produce guidance for providers of Category 1 services to assist them in complying with the duty set out in section 64(1)" [5]. Unlike section 64, section 65 has a second commencement annotation: "I2 S. 65 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(r)" [5]. Ofcom's own obligation to produce this guidance has run since 10 January 2024, nearly two years and nine months before the first public consultation on it closes.
The timetable from here is Ofcom's own. "The consultation closes on 2 October 2026 and following this we will consider responses, which will inform our final decisions. We will publish a statement setting out our final decisions and the next steps, which we plan to do by mid-2027" (page 4) [2]. A statement is not a code in force. Ofcom's two earlier codes under this Act, on illegal content and on protecting children, each needed a further round through Parliament after their statements before they carried legal weight. If the pattern holds, the earliest a Category 1 service could face an enforceable identity verification duty is sometime after mid-2027, roughly four years after Parliament wrote section 64 into law.
The claims, tested
| Ofcom's own words | What the record shows | Verdict |
|---|---|---|
| "Providers also have a duty to offer adult users the option to verify their identity on the service" (page 1) [2] | Legislation.gov.uk's own annotation for section 64 reads "not in force at Royal Assent, see s. 240(1)", with no later commencement order added in three years [4] | A duty described as current that the statute's own public record does not yet recognise as current |
| The consultation closes today and a decision statement is promised "by mid-2027" (page 4) [2] | Ofcom's own duty to write this guidance, section 65, has been in force since 10 January 2024 [5] | Close to three years passed between Ofcom's duty to write the guidance starting and the first public chance to comment on a draft ending |
| Seven commencement orders have been made under the Act since Royal Assent, most recently in April 2026 [6] | None of the seven brings section 64 into force [4] | The gap is not a one-off oversight; it has persisted across every scheduled update to the Act's commencement since the law was passed |
The mistakes, counted
A duty described as live in a public consultation document is not yet in force (1). Both the Overview and the accessible chapter summary tell readers that providers "have a duty" to offer identity verification, with no caveat that section 64 itself still carries only its original "not in force at Royal Assent" annotation and no later commencement order [2] [4].
Ofcom's own clock on this guidance ran for nearly three years before the public got a say (2). Section 65 put Ofcom under a duty to write this guidance from 10 January 2024; the first consultation on a draft did not close until 2 October 2026, with a final decision not promised until mid-2027 [5] [2].
Credit where due
Ofcom is not hiding the eventual timetable, even if it is not connecting it to section 64's commencement status. Page 4 of the Overview states the mid-2027 target for a final decision in plain terms, rather than leaving stakeholders guessing [2]. The substance of the proposals also shows real thought about a genuine trade-off: the draft User Identity Verification Guidance proposes four principles, relevance, reliability, inclusivity and clarity, aimed at stopping providers from either skipping verification or imposing an invasive one-size-fits-all scheme on everyone [2]. A duty this open to being done badly, forcing documents on people who cannot or should not produce them, is one worth getting right rather than rushing, even if getting it right has taken years.
Verdict
Four stars, from two documented mistakes. Nothing here alleges Ofcom broke any deadline; section 65 sets no date by which the guidance must be published, so the delay is not a breach, only a long one. What the Act's own public record shows is a regulator consulting the country, today, on how to help providers comply with a duty its own consultation describes as already theirs, when that duty has not been switched on once in the three years since Parliament created it.
The star score counts two documented mistakes against the Act's own public commencement record: the consultation's Overview and accessible chapter summary each describing the section 64 identity verification duty as one providers "have", with no note that section 64 remains uncommenced three years after Royal Assent; and the near three-year gap between section 65 putting Ofcom under its own duty to write this guidance (10 January 2024) and the first public consultation on a draft closing, with a final decision not promised until mid-2027. Two falls in the 1 to 3 band: four stars; the bands are on the ratings page. This piece makes no finding about the quality of Ofcom's proposals themselves, which are open for consultation, only about the consultation's own description of a duty that has not commenced. Checked against legislation.gov.uk's revised text of the Online Safety Act 2023, current to 1 and 2 October 2026 respectively, and all seven commencement orders made under the Act since Royal Assent.
Sources
- Giving users more choice, control and trust in their online experience (consultation), Ofcom, published 10 July 2026
- Overview: Giving users more choice, control and trust in their online experience (PDF), Ofcom, 10 July 2026
- Summary of each section: Giving users more choice, control and trust in their online experience (PDF), Ofcom, 10 July 2026
- Online Safety Act 2023, Section 64: User identity verification, legislation.gov.uk, revised text current to 1 October 2026
- Online Safety Act 2023, Section 65: OFCOM's guidance about user identity verification, legislation.gov.uk
- The Online Safety Act 2023 (Commencement No. 7) Regulations 2026, made 9 March 2026
- "Ofcom finally named Facebook, TikTok, X and eight others as the platforms too big to leave unwatched. The rules that naming was meant to trigger will not exist until 2027.", Tracked Changes, 14 September 2026