The Online Safety Act will bring major changes to the regulation of user generated online content and place considerable obligations on relevant online service providers.
What's the issue?
The Online Safety Bill, originally published in 2021 and then re-published a year later, is the UK's attempt to regulate the safety of users online. It will require certain online service providers to protect their users from specified harms. It also introduces a number of new criminal offences to the face of the legislation.
The OSB has had a long and controversial passage through Parliament, not helped by the changes in government along the way. Tensions around how to define what constitutes harmful content and how to regulate it without curbing free speech, while still protecting users, have been difficult to resolve. Another area of controversy has been the potential powers for Ofcom to require platforms to scan messages for illegal content (although the government recently said this would not be enacted until suitable technology was available). This has resulted in many changes to the 2022 draft, with the government introducing its own amendments well into July 2023, and Ofcom revising its implementation timetable (as discussed here).
What's the development?
The OSB has passed its final Parliamentary hurdle after being approved by the House of Lords on 18 September 2023, and now moves to Royal Assent. There are different levels of obligations relating to different types of harmful content and whether the content is particularly harmful to children.
Among other things, the Online Safety Act (OSA) as it will be, will introduce requirements on social media platforms (and other relevant providers) in relation to children, to:
- remove illegal content or prevent it from appearing in the first place
- prevent children accessing harmful and age-inappropriate content
- enforce age limits and age-verification measures
- publish risk assessments of potential online harms to children
- provide reporting and complaints procedures for children and their parents.
The most onerous obligations regarding children relate to pornographic content and content which encourages, promotes, or provides instructions for suicide, self-harm or eating disorders.
The OSA will also introduce new criminal offences including cyber-flashing and sharing 'deepfake' pornography, and will make it easier for bereaved parents to obtain information about their children's online activities.
Protections for all internet users include:
- removal of illegal content
- a legal responsibility on social media platforms to comply with their user terms and conditions, particularly in relation to their content policies
- the option to filter out potentially harmful content.
The most onerous obligations relate to terrorism content, CSEA content and other content amounting to a serious offence.
What does this mean for you?
The Online Safety Act (OSA) will apply to any service that enables content generated, uploaded or shared by one user to be encountered by another user (user-to-user services) or that allows users to search more than one website or database (search services).
The definitions are broad. It is not just online platforms and search engines that are within scope. Any service that allows one user to encounter content from another user will potentially be caught, even if that content is a 'one-off' or short lived. So, for example, this will also cover blogs, forums, listing sites and aggregators. The term "users" is potentially wide and goes beyond mere consumers and end-users. Websites, apps and other software are covered, as are public and private channels. The exemptions for eg 'below the line' content are drafted narrowly and won't always apply. Government figures reportedly suggest not only 'big tech' but also 20,000 smaller businesses will be in scope.
Much of the detail about implementation is to follow in Codes of Practice. Ofcom has promised its first Codes of Practice on illegal harms duties within 100 days of the OSA's enactment. A careful review of all online content and services provided will be needed in order for service providers to understand the extent to which they are within scope of the OSA, and what they need to do to comply. This is made all the more urgent given fines for non-compliance may reach up to the higher of £18m or 10% of annual global turnover and executives may also face criminal liability.
