Ofcom proposes fraud ad code for major online platforms

Ofcom has proposed new rules that would make major online platforms legally responsible for stronger controls against fraudulent advertising, with penalties of up to £18mn or 10% of global revenue for firms that fail to comply. The UK communications regulator said the measures target a digital advertising market worth more than £40bn a year in the UK, a revenue base dominated by large technology companies that sell online ads.

The regulator said online scam advertising has become a material consumer harm. Ofcom said more than half of adults have seen potentially fraudulent adverts online, while more than a third report seeing them frequently. It estimated that UK victims lose more than £200mn a year on average to these types of scams.

The proposed fraudulent advertising code would set out close to 40 practical steps for large platforms to protect users from scams. Ofcom said the rules would require companies to put “robust measures” in place, marking the first time major platforms would face a specific legal duty under this code to address fraudulent adverts once the regime takes effect.

Online advertising markets work through automated systems that match advertisers with users at scale, using data on audience characteristics, placement and bidding. That structure allows legitimate campaigns to reach consumers efficiently, but it also gives criminals a way to test, target and distribute deceptive promotions through the same channels. Ofcom’s draft code seeks to shift more of the burden onto platforms that control access to ad inventory and user targeting tools.

Ofcom said companies that fall short of their legal duties after the rules come into force could face enforcement action. The regulator said possible sanctions include fines capped at £18mn or 10% of worldwide revenue, whichever is higher.

Oliver Griffiths, Ofcom’s online safety group director, said victims had been exposed to scam adverts online for too long while large technology companies had failed to do enough against fraudsters using their services.

“Platforms should not drag their heels, they can start making improvements for their users now,” Griffiths said. “And sites and apps that fail to meet their legal duties, once in force, can expect to face serious consequences.”

The scale of the problem has also drawn scrutiny of individual platforms. Internal Meta documents seen by Reuters indicated that the social media company serves up to 15bn scam adverts a day and earns $16bn in sales from them, according to the report cited by Finextra.

Ofcom said the code would be updated as online threats change. Some fraud specialists argue that the proposed approach is already too slow for the pace of criminal adaptation.

Jonathan Frost, director of global advisory at BioCatch, said the stronger control point was preventing abuse before it reaches consumers, rather than focusing on how quickly adverts are removed after publication. He said platforms have visibility into targeting patterns and user behaviour, and that data used for advertising could also be used to assess fraud risk.

“Taking down ads after harm has occurred is a game of whack-a-mole,” Frost said. “The real goal must be to deny fraudsters access to consumers in the first place.”

Frost also warned that standards set now may lag the threat environment by 2027, arguing that regulation based on older fraud models risks allowing continued harm as tactics change.

This story draws on original reporting from Finextra Research.