The UK's Online Safety Act (OSA) places obligations on providers of online user-to-user and search services (or parts of them) likely to be accessed by children as part of its broader online safety regime. These duties involve conducting risk assessments, protecting children from illegal content and content likely to be harmful to them, and transparency, reporting and redress duties.
The duty to “prevent” children encountering primary priority content harmful to them requires providers to use age verification/estimation (unless Ts&Cs indicate such content is prohibited and the policy applies to all users). Even where not required, age verification and estimation are given as examples of what can be used to comply with all of the obligations imposed regarding protection of children.
The OSA is regulated by Ofcom but age verification and estimation will likely involve processing personal data and, as such, the UK's data protection regulator, the ICO, also has an interest (as discussed here). The ICO has played a leading role in protecting children from online harms to date through its Children's Code - a set of overarching principles that information society service providers are required to implement where their services are "likely to be accessed by children" – ie under-18s - in order to embed age appropriate design where personal data is processed in the provision of the services.
This means that the ICO and Ofcom will have areas of regulatory overlap relating to the OSA (as we discuss here) and, in order to reduce the burden on stakeholders and ensure consistency, they need to work together.
Under the banner of the Digital Regulatory Cooperation Forum (DRCF), Ofcom and the ICO published a Joint Statement on Collaboration on the Regulation of Online Services on 1 May 2024. This sets out:
- Collaboration themes - areas where the regulators will work together.
- Companies of mutual interest - how they will identify when they are looking at the same issues or services.
- New ways of working - information sharing and collaboration.
Collaboration themes highlighted in this statement will be particularly important to businesses that have safety duties under the OSA involving the processing of (children's) personal data, and whose services are also caught under the ICO's Children's Code. They will initially cover:
- age assurance
- recommender systems
- proactive tech and relevant AI tools
- default settings and geolocation settings for child users
- online safety privacy duties
- upholding terms, policies and community standards.
There are overlaps between the Children's Code and the OSA, whether or not the definitions and criteria are the same, although not all organisations in scope of the Children's Code will be caught by the OSA. There are, however, considerable differences in terms of the obligations each engages. Service providers will be looking for Ofcom and the ICO to provide clarity and guidance on how to meet OSA safety duties in a data protection-compliant manner, so will be pleased to see more information about how the regulators will cooperate in this area.
See here for more on the OSA, the EU's Digital Services Act and related online safety issues.
