Page 20 - The Katten Kattwalk - Summer 2025 - Issue 29

Byte-Sized Protection: Keeping Kids Safe Online,
One Risk Assessment at a Time (continued)
pornography). Ofcom has made this clear by citing
evidence that children may be attracted to dating
and pornography services. Unless platforms have
implemented “highly effective age assurance,” Ofcom
expects the risk assessment to determine that it is
likely for children to access the platform.
The Children’s Risk Assessment (Deadline of
July 24, 2025)
The Children’s Risk Assessment must be conducted
every 12 months by all platforms likely to be accessed
by children. It categorizes harmful content to children
into three categories:
1. Primary Priority Content (PPC): i) pornography;
ii) content that encourages, promotes or provides
instructions for suicide; iii) content of the same for
deliberate self-injury; and iv) content of the same
for behaviors associated with an eating disorder.
(Four types of PPC)
2. Priority Content (PC): eight types of content as
outlined by the Ofcom guidance, similar to the 17
priority illegal harms, such as abuse, hate, bullying
and violence. (Eight types of PC)
3. Non-Designated Content (NDC): content which
presents material risks of significant harm to
children in the United Kingdom, such as body-
shaming or body-stigmatizing content, or content
promoting depression, hopelessness and despair
(at least two types of NDC, as identified by Ofcom). Children’s Risk Assessment. Ofcom still expects a
Platforms must then conduct a risk assessment on i)
the likelihood of a child encountering the harm, and
ii) the impact to children from the kind of content,
for each of the four PPCs, eight PCs and at least
two of the NDCs identified by Ofcom, as well as any
additional NDCs identified by the platform.
Non-Designated Content
Identifying and assessing NDC may be challenging as
they are non-specific, and Ofcom expects platforms
to be able to review their services in-depth and to
identify NDC. This means platforms cannot rely on
Ofcom to outline the risks they need to consider and
20 katten.com/fashionlaw
must identify and assess additional risks unique to
their platforms. Platforms are likely to require expert
help in assessing these risks.
Platforms are also under an obligation to report
identified NDC to Ofcom at nondesignatedcontent@
ofcom.org.uk. While there is no specified timeframe
for reporting, it is likely that newly identified NDC
would have arisen at the most recent Children’s Risk
Assessment and should be reported accordingly upon
conclusion of the assessment.
The Children’s Risk Assessment and the
Illegal Harms Risk Assessment
The Children’s Risk Assessment employs the same
methodology as the Illegal Harms Risk Assessment in
terms of how they are conducted. The methodology
should have been in place for all platforms from
March 16, 2025. Platforms are expected to have
evidential input into the risk assessment, such as core
inputs of user data and incident reviews, as well as
enhanced inputs, such as product testing data and
consultations.
The same record-keeping requirements also apply,
so the information captured in the Children’s Risk
Assessment should largely be the same as that in the
Illegal Harms Risk Assessment.
There is an inevitable overlap of the risks considered
in the Illegal Harms Risk Assessment and the
separate risk assessment of the risks and harms,
but specifically in the context of protecting children
online. However, both sets of risk assessments should
work alongside each other to outline risks specific to
illegal harms and/or the protection of children.
The Protection of Children Code
Similar to the recommended measures of the illegal
content code of practice, Ofcom has published 70
recommended measures for user-to-user services and
search services to implement following completion
of the Children’s Risk Assessment. The recommended
measures under the Protection of Children Code
are broadly similar to the illegal content code, such