The Online Safety Act 2023 received royal assent in October 2023 and is already sparking serious debate over the immediate action required by businesses and the wider impact on the sector. “Big Tech” players are already under considerable pressure in Europe following the implementation of the EU’s Digital Services Act in November 2022, meaning that the UK’s new regulatory regime risks deterring online service providers from participating in the UK market.
The Act targets the publication of harmful or illegal material. Whilst it does not prevent the production of individual pieces of content, it does provide that companies should proactively put in place certain processes to protect their users from encountering it.
Specifically, the Act places a legal responsibility on tech companies to put in place systems and abide by Ofcom regulations in five main areas:
The Act predominantly addresses the vulnerability of children. However, it also empowers adults to have better control of what they see online by removing illegal content; ensuring that promises outlined in social media platform Terms and Conditions are properly enforceable; and ensuring that users are offered the option to filter out certain content which they do not want to see online
The Act has also strengthened provisions to address violence against women and girls meaning it’ll be easier to convict those who share intimate images without consent. It also criminalises the non-consensual sharing of intimate deepfakes.
The scope of the Act is substantial and goes beyond regulating “Big Tech” social media and online services. The legal requirements are specifically imposed on all services which fall under Ofcom’s remit, specifically:
The Act encompasses smaller platforms including websites, online forums, websites displaying advertisements, or where users might interact with other users.
The Act also differentiates between Category 1 and Category 2 services, with Category 1 services including the largest companies which will be subject to additional requirements.
If your business to falls within the wide scope of the Act, it is important to take steps to comply with the new regulations to avoid serious financial penalties. It is recommended that the following steps are taken:
On 9 November 2023, Ofcom released a consultation aimed specifically at protecting people from illegal harm online. A summary with links to each chapter and further guidance can be found here. A second consultation on child safety, pornography and the protection of women and girls is expected early this year. These consultations are the first in several Ofcom will be publishing as part of the government’s phased approach to bringing the Act into force. A third phase focused on transparency reporting, user empowerment, fraudulent advertising and user rights is expected in spring 2024. A summary of Ofcom’s approach to implementing the Online Safety Act can be found here.
Failure to meet the requirements of the Act could mean that a company will face hefty fines of up to £18 million or 10% of their global revenue.
The Act also strengthens criminal sanctions against those found guilty of the base offence of intentionally sharing an intimate image without consent, who can face up to 6 months in prison. That rises to two years behind bars for those who threaten to share, or share intimate deepfakes with the intent to cause distress, alarm or humiliation.
Criticism surrounds the Act's penalisation of platforms rather than content creators, its broad scope, and the potential inconsistency in defining “legal but harmful” material. “Big Tech” companies have expressed concerns over the Act’s implications for end-to-end encryption in messaging apps. The government asserts Ofcom’s use of decryption powers is a last resort and urges companies to balance encryption with preventing harmful content.
The Online Safety Act 2023 represents a significant regulatory shift in the UK's digital landscape. It aims to enhance online safety but has elicited intense debate and criticism for its wide-ranging impact. Businesses must adapt to comply with the stringent requirements, navigating a landscape reshaped by enhanced online safety measures.
