Online Safety Bill – are you caught?

The Online Safety Bill (OSB) has broad application. Those with an online presence will need to scrutinise the online content and services they provide – including those provided intermittently and at a low level – to determine whether they are in scope.

What is the Online Safety Bill and how broad is it?

Tackling online harms has been a focus for governments around the world for some time now. The UK government's plans in this area are continuing apace with the recent publication of the OSB (which builds on the Online Harms White Paper). The OSB imposes duties on certain online service providers to protect users from harm arising from user-generated content. 

The OSB has wide-ranging application. In particular:

• The OSB captures any service that enables content generated, uploaded or shared by one user to be encountered by another user or that allows users to search more than one website or database. Both public and private channels are caught. The definitions are broad. It is not just content from end-users and consumers that is potentially in scope, but content generated by a variety of third parties (including where that content is uploaded/shared by the provider itself). 
• The OSB has extra-territorial application. Those caught include providers in the UK as well as those based outside of the UK where users in the UK are affected.

Who is caught?

The duties imposed by the OSB apply to any "user-to-user service" or "search service" that has "links with the UK" and is not "exempt". More specifically, the duties appear to be tied to "regulated content" that may be encountered on or via any such service. However, this is not completely clear since there are some gaps in the OSB (including the definitions) that will need to be filled. 

User-to-user services

A user-to-user service is an "internet service by means of which content that is generated by a user of the service or uploaded to or shared on the service by a user of the service, may be encountered by another user, or users, of the service". This definition is much broader than might seem at first. In particular: 

• An internet service is a service made available by means of the internet or a combination of the internet and an electronic communications service. It therefore covers websites, apps and other software. The fact that payment or subscription is required for such a service is irrelevant. 
• Content means anything that can be communicated by means of an internet service, including written materials or messages, oral communications, photographs, videos, visual images, music and data of any description. Webcam footage is therefore content (see government guidance), as is account information (see government guidance), location information, and clicking on an emoji. Both public and private channels are covered (see government guidance).
• Any one act performed by a user – generating, uploading or sharing content – suffices. This means that content uploaded/shared by a user irrespective of who generated that content is potentially within scope, as is content generated by a user but uploaded/shared by the provider itself. The latter should be kept in mind when auditing online content to determine whether the OSB applies.

• The definition applies to content generated, uploaded or shared by a "user". However, there is no definition of "user". Instead, the OSB defines who are not users. These are any of the following when acting in the course of the provider's business: where the provider is an individual(s), that/those individual(s); where the provider is an entity, any officer(s) of, and anyone who works for, the provider; and any other person(s) providing a business service to the provider, such as a contractor, consultant or auditor.
• Everyone else appears to be a user. There is likely to be much debate about whether a person is "providing a business service to the provider" and is therefore exempt. Arguably, a variety of third parties could fall within this exemption but the inclusion of contractors, consultants and auditors as examples might suggest that it will be interpreted narrowly. Understanding the scope of this exemption will be important for many providers, most obviously listings websites and repositories. 
• The requirement is that the user-generated content "may" be encountered by at least one other user – it does not have to be encountered in fact. "Encountered" is drafted broadly and includes reading, viewing, hearing or otherwise experiencing the content. It therefore incudes such things as one user watching another user play a video game. Content can be encountered if it is capable of being shared with another user by operation of a functionality of the service (such as a private messaging function). The fact that content may be available for a limited period of time only is irrelevant.
• It does not matter what proportion of a service falls within the definition of a user-to-user service – there is no de minimis requirement. 

It should be clear from the above that a number of services and functionalities will fall within the definition of a user-to-user service. At its extreme, the OSB potentially catches a one-off online video presentation by one user to another or content generated by a third-party business but uploaded by the provider to its website. A careful review of online content, including any content generated by third parties, should therefore be undertaken.

Search services

A search service is any "internet service that is or includes a search engine and is not a user-to-user service". The following should be noted: 

• The definition of what is a search engine is quite broad and effectively includes any service or functionality that allows a user to search more than one website or database. Searching can be by any means including by input of text or images or speech. Examples of "searching" in the government guidance include typing search terms into a search box, reading through a list of contents and using tags or meta data to filter content.
• Although not apparent from the definition of a search service, the duties imposed by the OSB appear only to apply to "regulated content" that may be encountered in or via search results, not other forms of content. This includes regulated content encountered as a result of interacting with search results (for example, by clicking on them). However, it does not include regulated content encountered as a result of subsequent interactions with an internet service other than the search service. 

The government says that offering search functionality can make it easier for people actively to seek out and find harmful content and can also present harmful content to people who are not actively seeking it. This is why search services have been included in the OSB. However, the OSB goes beyond large search engines. For example, a facility offered by a provider that allows a user to search two databases would be caught (assuming those databases contain user-generated content).

Exempt services

The following services are exempt:

• Any user-to-user service where the only user-generated content enabled by the service is emails, SMS messages, MMS messages or a combination of SMS and MMS messages.
• Any user-to-user service with limited functionalities. Effectively, these are services where users are only able to communicate by posting comments or reviews on content produced and published by the provider itself (or a person on its behalf) – so-called "below-the-line" content. 
• Any user-to-user service where the only user-generated content enabled by the service is one-to-one live aural communications. The communication must consist solely of real time speech or other sounds. If other content, such as written messages, videos or visual images are included, the exemption does not apply. 
• Any user-to-user service or search service provided by public bodies exercising their public functions.
• Any user-to-user service and search service comprising certain internal business resources or tools. This means that most internal message boards and search engines for employees and officers of the provider are exempt. 

The exemptions are drafted very tightly and should be reviewed on a case-by-case basis to determine whether or not they apply. The Secretary of State has power to add additional categories of services to the list of exempted services if they consider that the risk of harm to individuals in the UK presented by such services is low. They also have power to remove limited functionality services and one-to-one live aural communications from the list of exempted services.

Links with the UK

The legislation has wide extra-territorial application. To be caught, a user-to-user service or search service must have links with the UK. A service has links with the UK if:

• it has a significant number of UK users, or
• UK users form one or the only target market for the service, or
• it is capable of being used in the UK by individuals and there are reasonable grounds to believe that there is a material risk of significant harm to individuals in the UK from content present (user-to-user services) or content that might be encountered in or via search results (search services). 

There is no indication of what constitutes a significant number of users. Whether a service targets the UK ought to be easier to determine given guidance on targeting in other areas of law (such as trade mark law).

Regulated content

Many of the duties in the OSB are tied to "regulated content". This is user-generated content with certain exceptions. User-generated content is any content that is generated, uploaded or shared by a user that may be encountered by at least one other user. It therefore maps onto the definition of user-to-user services and comments made about that definition above also apply to regulated content.

The exceptions are emails, SMS messages, MMS messages, comments and reviews on provider content, one-to-one live aural communications, paid-for advertisements, and news publisher content. Again, these exceptions are drafted very tightly (but not necessarily in the same terms as the exemptions for user-to-user and search services described above) and should be carefully reviewed.

Wide application

As well as search engines, content-sharing platforms, social media platforms, blogs, forums, listings sites, and aggregators, any provider that allows one user to encounter content from another user will potentially be caught. This includes content from a wide variety of "users" not just consumers or end-users. Furthermore, a wide variety of search services and functionalities are covered. The OSB therefore has wide application and any online presence will need to be evaluated to determine whether it is in scope.

Find out more

To discuss the issues raised in this article in more detail, please reach out to a member of our Technology, Media & Communications team.