The UK's largest internet service providers will start collecting the details of customers who unlawfully download films, music and TV programmes early next year, in order to send them warning letters under a code of practice proposed today by the media regulator Ofcom.

The draft Ofcom code was immediately denounced by the UK's second largest ISP as a "bureaucratic dog's breakfast".

Any internet user who receives three letters in the space of 12 months faces having their personal details handed over to the owner of the copyrighted material so they can be sued.

The draft code of practice, which Ofcom was ordered to draw up by the controversial Digital Economy Act, was immediately attacked by TalkTalk, the UK's second largest ISP.

"Ofcom's draft code of practice is a valiant attempt to implement the Digital Economy Act's proposals, but we think it has the potential to turn into a bureaucratic dog's breakfast," said a TalkTalk spokesman. "As the code stands, millions of customers would be at risk of being falsely accused of copyright infringement, being falsely put on to an 'offenders' register' and so potentially taken to court. There is little in the draft code about protecting customers from receiving misleading or bullying letters."

TalkTalk is also worried about the lack of consideration of data protection issues and there is little in the draft code about how the regulator will ensure customers can access fair and just appeals. "The draft code exempts smaller ISPs and mobile operators, which seems arbitrary and could lead to market distortion," the spokesman added. "Finally, the way Ofcom has designed the rules may kill off public Wi-Fi networks."

Consumer and citizens' rights groups, meanwhile, called for the fair treatment of customers accused of copyright infringement using filesharing networks.

"Consumers face considerable confusion while Ofcom tries to work out how to implement new laws under the Digital Economy Act," said Robert Hammond, head of post and digital communications at Consumer Focus. "The aim should be to encourage suspected copyright infringers to use legal alternatives and achieving this rests on the process of notification being seen by consumers as fair and helpful."

Jim Killock, executive director of the Open Rights Group warned that "letters being sent out could cause a lot of worry and fear". "People may feel they are under surveillance," Killock said.

"This is another extremely rushed process, forced by the Digital Economy Act's absurd timetables. There are huge unanswered questions, not least whether innocent people will have to pay to appeal," he added.

The code of practice applies to ISPs with over 400,000 customers, meaning that it will initially apply to BT, TalkTalk, Virgin Media, Sky, Orange, O2 and the Post Office, who together control 96% of the market. Ofcom, however, will review unlawful filesharing activity on a quarterly basis and can extend the code to cover smaller ISPs and the mobile phone companies if it spreads.

Those quarterly reports will also be used to see whether the letter writing campaign is leading to a reduction in illegal filesharing. If after a year it does not appear that the code is having any effect on the use of such services as peer-to-peer networks, the culture secretary, Jeremy Hunt, can demand the introduction of so-called technical measures including severing the broadband connections of persistent offenders.

Sending letters to warn persistent unlawful file-sharers that they face the threat of court action has been tested in the UK before, but the code is designed to automate and standardize the process across all the major ISPs.

The code, contained in a 74-page consultation document, sets out the evidence which the music and film companies must collect about individual infringements of their copyright when making a copyright infringement report to an ISP. Content companies must make their requests to ISPs within 10 working days of them gathering the information about a breach of copyright. It then covers how the ISP must then use that information to identify the specific customer involved and send them a letter warning them that their activities have been noticed and they are laying themselves open to court action. The letter will also name the copyright owner and give details of how they can appeal against the ruling that they have infringed copyright.

The code allows for three notification letters – each at least a month apart – to be sent to a user, before their details are placed on a copyright infringement list. All three letters must be sent with a 12 month period, as ISPs are required to delete any notifications after a year.

The copyright infringement list, which has anonymous details of individual users, can then be requested by the copyright owner and used to launch a court action to get the user's name and address in order to sue them. The three letters can be generated by copyright infringement reports from three different copyright owners. All three can then request access to the copyright infringement list held on that user, to be received within five days – though they will only see details of how that individual infringed their copyright.

The draft code, which Ofcom is consulting on until 30 July, is one of three consultations the regulator is launching as a result of the Digital Economy Act. In July it will look at how the code will be enforced before looking at how the costs of the scheme will be shared in September.

The regulator also has to set up an independent appeals body and decide how the costs of appeals should be apportioned. In its consultation document Ofcom said a successful appellant may get compensation and costs. It added "the costs of the appeals body, and the possibility that a subscriber may have to pay a fee, was raised in the government's consultation on the cost sharing arrangements" but then makes no suggestion that subscribers should pay if their appeal fails.

On the issue of costs, TalkTalk said that "copyright owners are the only ones that will benefit from this system, so unless the government decides that these companies should fully reimburse ISPs' costs, broadband customers will in effect be forced to subsidise the profits of large music and film companies".

Ofcom hopes to have the code, which needs European Commission clearance, in place by 8 January and is accepting responses to this consultation until 30 July.

In response to the draft code, the Communications Consumer Panel, Consumer Focus, Which?, Citizens Advice and the Open Rights Group have banded together to produce a set of principles they believe will ensure that the new rules on online copyright infringement properly protect consumers.

Their principles include that there should be sound evidence of wrongdoing before any action is taken against a consumer; that comprehensive and consistent information needs to be provided to all suspected repeat infringers and this should be written in plain English; that consumers must have the right to defend themselves; and that there is an independent and transparent appeals process is essential, at no cost to the customer.