The Online Safety Act Phase One

The Online Safety Bill became the Online Safety Act on 26 October 2023, when it received Royal Assent. Much of the detail surrounding its implementation will come in the form of Codes of Practice to be issued by Ofcom.

On 9 November, Ofcom issued the first of its draft Codes of Practice for consultation, focusing on illegal harms duties. The draft Codes of Practice and related guidance on illegal harms cover the following key points:

• Service risk assessment guidance;
• Guidance on record keeping and review;
• Illegal content codes of practice for user-to-user and search services;
• Guidance on content that is communicated publicly and privately under the Online Safety Act;
• Guidance on judgement for illegal content; and
• Enforcement guidance.

It is important to note that the above are all currently in draft form. The consultation itself covers the following:

• The causes and impacts of illegal harms;
• How services should assess the risks of illegal harms and mitigate them;
• How services can identify illegal content; and
• How Ofcom will approach enforcement.

The consultation is open until 5pm on 23 February 2024 and can be accessed here (external link). It is, to say the least, a detailed set of documents spanning multiple volumes. Ofcom also provides an “at a glance” summary (external link) and a summary of each chapter of the consultation (external link).

What will the Online Safety Act Mean for Your Business?

Ofcom estimates that some 100,000 services will need to consider the Online Safety Act in some way or another. In some cases, the safety measures set out by the legislation will apply only to larger and/or higher-risk operations, but even smaller services will still be subject to a range of obligations.

As we noted in our previous newsletter on the Online Safety Act, the Government suggests that some 20,000 SMEs will be impacted by the new legislation. Whilst there are exemptions, they are narrowly defined. Most notably, these include:

• user-to-user services where the only user-generated content is emails, SMS, or MMS messages;
• user-to-user services where the only user-generated content is one-to-one live aural communications;
• services with limited functionality where users only communicate by posting or interacting with comments or reviews (or other interactions such as “liking” or “disliking”) relating to content published by the service provider (and not by other users); and
• internal business services.

With these narrow exemptions in mind, it is easy to see how a wide range of services may still be subject to the Online Safety Act.

What’s Next?

When this consultation closes, Ofcom will review the responses and its proposals, and aims to publish a statement on its final decisions along with final versions of the Codes of Practice and guidance toward the end of 2024.

As for this year, there is still expected to be one more consultation to come. The focus of the next phase will be child safety, pornography, and the protection of women and girls. This is expected in December.