The Online Safety Act, the text of which was first proposed in 2021, has now become law. When it comes into force, companies that allow users to upload and share content (including via instant messaging apps) will have to take steps to prevent access to and remove illegal content (e.g. child sexual abuse content and content inciting terrorism or hatred) and to prevent children from seeing content that is harmful to them (e.g. content promoting self-harm and eating disorders). Specifically, the Act requires providers to assess the risk of harm from illegal content for all users and, if their service is likely to be accessed by children, the risk to children from content that is harmful to them. Providers must take effective steps to mitigate and manage the risks identified, be clear in their terms how users will be protected and provide user reporting and appeals processes, whilst balancing all such obligations against the importance of free speech and privacy. Providers of online pornography must take steps to ensure children cannot normally access such content.

Ofcom, the regulator under the Act, will have the power to impose large fines for the most serious infringements (up to £18m or 10% of qualifying worldwide expenditure (whichever is greater)) and certain infringements of the Act will amount to a criminal offence, with the possibility of directors and senior managers facing personal criminal liability.

The Act will be implemented in stages and some parts of the Act will not come into force until 2026 or 2027. Ofcom is now required under the Act to produce various Codes of Practice and guidance. In-scope services will not be required to follow the recommendations in the Codes, but if they do, they will be deemed to have complied with the relevant legal duties. If they choose to use other measures, they will need to be able to explain how their chosen approach meets the duties in the Act.

Ofcom has announced that, on 9 November, it will issue a consultation focusing on the illegal content duties, specifically consulting on an Illegal Harms Code of Practice, a register of risks (analysis of the causes and impacts of online harm), and guidance for risk assessments, record keeping and review, illegal content judgements and enforcement. Within a year of the start of this consultation, Ofcom expects to publish a statement of its decisions with final versions of the Codes and guidance. Services in scope of the Act will then have three months to conduct their illegal content risk assessments. At the same time, the Codes will be submitted for approval by the Government and, if approved, for subsequent approval by Parliament. At the conclusion of that approval process, the illegal harms duties become enforceable. It is estimated that this will happen around the end of 2024.

In 2023, Ofcom also intends to issue a consultation on guidance on age verification/estimation to support those providers subject to the obligation to prevent children from accessing pornographic content online.

In 2024, Ofcom proposes to issue a consultation on the duties relating to children, consulting on a Code of Practice for measures to protect children, a register of risks and guidance on children’s access (to determine whether children are likely to access the service in question) and risk assessments. The timing will follow a similar pattern to the consultation on the illegal content duties (set out above) and are expected to come into force by the Summer of 2025.

Services in certain categories will face additional duties including transparency reporting, enabling adult users to adjust the content they see and who they interact with online and to address fraudulent advertising. Criteria for categorisation will be set by the Government in secondary legislation based on Ofcom advice which it plans to provide in 2024 with a view to the categorised services legislation coming into force in Spring 2024. Ofcom will then decide which services meet the legal thresholds for each category and add them to a public register.

However, Ofcom anticipates that only a fraction of the estimated UK 100,000 business that fall within the scope of the Act, will meet the category thresholds and appear on the public register. Ofcom plans to issue proposals for transparency reporting guidance in 2024 and a Code of Practice on fraudulent advertising in 2025.

The funding regime, by which certain services providers will be required to pay fees to Ofcom, will also need to be set out in secondary legislation which Ofcom aims to have in place by 2026/27.

For more information, click here and here.