Online Safety Act: What happens now?

The Online Safety Bill was introduced in March 2022 to make the UK the ‘safest place in the world to be online’. After a long journey through Parliament, the Bill passed its final parliamentary stages on Tuesday 19 September and was granted royal assent on 26 October 2023, meaning it is now enshrined in law as the Online Safety Act (OSA). However, companies will not have to comply with most of the Act’s provisions immediately. Rather, many details are yet to be set out via secondary legislation and guidance. In this blog post, we take a look at the next steps under the UK’s new online safety regime.   

Ofcom: consultations, advice, and guidance

The Office for Communications (Ofcom) is the responsible regulator under the online safety regime and will be responsible for advising the Secretary of State for Science, Innovation and Technology (‘Technology Secretary’), issuing guidance and codes of practice for businesses, and enforcing the OSA’s provisions. Ofcom’s enforcement powers commenced immediately after royal assent on 26 October. Given the delay in the OSA’s parliamentary progress, the regulator, which initially expected royal assent in early 2023, has been working on its approach in the background to be able to move as quickly as possible once the Act is passed and will now proceed in three phases.

Phase one: illegal harms duties

Under the OSA, in-scope services   must mitigate the risks of illegal harms. Related duties include performing illegal content risk assessments and having pathways for users to flag illegal content.

Ofcom will publish its first consultation on illegal harms (which include child sexual abuse material, terrorist content and fraud) on 9 November 2023. This consultation will also contain proposals for how services can comply with the illegal content safety duties and draft codes of practice. The regulator will publish a response to this consultation in autumn 2024 alongside final versions of the illegal harms risk assessment guidance and codes of practice. Once Ofcom issues its consultation response, companies will have three months to undertake their illegal content risk assessments. At the same time, Ofcom will submit the codes of practice to the Technology Secretary, who, once they have approved them, will lay them in Parliament via secondary legislation  . Once the codes come into force, Ofcom will be able to begin investigating services it believes are not complying with the duties. 

Phase two: child safety duties and pornography

Under the OSA, regulated user-to-user and search services must conduct a so-called children’s access assessment to determine whether a service is likely to be accessed by children. If so, the OSA prescribes additional child safety duties, such as assessing and mitigating any risks a service might pose to children. Ofcom will publish proposals for this part of the OSA in spring 2024, including draft guidance on carrying out children’s access and safety assessments and draft codes of practice that set out recommended measures to protect children online. Final guidance will be published in early 2025, following which services will have three months to carry out relevant assessments. By spring 2025, Ofcom also intends to publish draft guidance on protecting women and girls. 

Phase three: transparency, user empowerment, and other duties on categorised platforms

This phase will be relevant to those services who might be designated as Category 1 and 2B (some user-to-user services) or 2A (some search services) and thus subject to additional duties concerning amongst others transparency reporting, user empowerment, fraudulent advertising, and user rights. The thresholds for whether companies fall in scope of either one of these categories will be set out in secondary legislation (see below). Ofcom already conducted a call for evidence between July and September 2023 to inform its advice to the Government on the thresholds and plans to publish the advice, as well as draft guidance on transparency reporting, in spring 2024. Ofcom is expected to publish its register of categorised services around the end of 2024, and a draft code of practice on fraudulent advertising, in early 2025. Final codes and guidance are expected to be issued around the end of 2024.

Secretary of State: secondary legislation

Some services will fall into Categories 1, 2A or 2B, with threshold conditions to be set by the Technology Secretary via secondary legislation. However, this legislation will not be ‘at random’, as several criteria are already set out in the OSA that the Secretary must consider.

For example, the threshold conditions for Category 1 and 2B services must include at least one condition on the number of users of the user-to-user part of the service or at least one condition on the functionalities of the user-to-user part of the service. Other considerations for these services will include the likely impact on user numbers on service functionality (Categories 1 and 2B), how easily and quickly regulated user-generated content can be disseminated by means of the service (Category 1), and the level of risk of harm to individuals from content that is illegal content or content that is harmful to children disseminated by the service (Category 2B). There may be additional threshold conditions relating to other characteristics, where the Secretary considers it relevant. Meanwhile, the threshold conditions for Category 2A services must include at least one condition on the user numbers of the search service (here, the Secretary must consider the likely impact of the search engine’s user numbers on the level of risk to individuals from illegal search content or search content that is harmful to children). There may be additional threshold conditions relating to other characteristics, if relevant.

The Secretary of State will also be responsible for approving and enshrining in law Ofcom’s final codes of practice. In-scope companies will have to comply with duties from the day on which the first code of practice for that duty comes into force (this will be 21 days after a code has been approved by Parliament).

How we can help

During the implementation phase of the OSA, there will be many opportunities for businesses to feed into the regime and get a better idea of how they can comply with their duties. If you are looking for expert help with understanding or contributing to the next steps of the UK’s new online safety regime, get in touch with our team at Inline Policy today.

Source: Ofcom