Call for Evidence on Approach to Guidance and Codes of Conduct

As the implementation of the Online Safety Act continues, Ofcom has published another call for evidence, this time designed to inform its codes of practice and guidance on the additional duties that will apply to categorised services under the Act. This follows on from the publication of Ofcom’s advice to the government on the threshold conditions applying to Category 1, 2A, and 2B services. The consultation is available here (external link) and closes on 20 May 2024.

Service Categorisation under the Online Safety Act

All online services within the scope of the Act’s provisions will be subject to certain duties to protect users in the UK from illegal content and online harm. Some services, however, will be subject to additional requirements if they qualify as categorised services. The categories are Category 1, 2A, and 2B. Early analysis by Ofcom suggests that up to 60 services will be categorised under the Act.

As the threshold conditions set out below illustrate, it is arguably unlikely that SMEs will fall into these categories, however we have included this consultation in the interests of completeness. Note that this is advice from Ofcom and that, now it has been published, it will be for the Secretary of State to consider it and produce draft secondary legislation.

Category 1 Services

These services are those user-to-user services with the highest reach and the highest risk functionalities. Consequently, they are subject to the highest number of additional obligations.

A Category 1 service is one which fulfils either of these two conditions:

Condition 1:

• The service uses a content recommender system; and
• Has more than 34m UK users using the user-to-user part of the service.

Condition 2:

• The service allows uses to forward or re-share user-generated content; and
• Uses a content recommender system; and
• Has more than 7m UK users using the user-to-user part of the service.

Category 2A Services

These services search services with the highest reach and that do not qualify as vertical search services (that is, those which only focus on a specific topic or type of content, as Ofcom concluded that such search services pose a lower risk).

A Category 2A service is one which fulfils the following conditions:

• The service is not a vertical search service; and
• Has more than 7m UK users using the search engine part of the service.

Category 2B Services

This category of services covers those user-to-user services which do not fall into Category 1 but still present risks sufficient to justify categorisation due to their user numbers and functionalities.

Perhaps unsurprisingly given present concerns surrounding online bullying and grooming, services with direct messaging facilities are a focus here.

A Category 2B service is one which fulfils the following conditions:

• The service enables users to send direct messages; and
• Has more than 3m UK users using the user-to-user part of the service.

The Additional Duties

Ofcom’s call for evidence is asking for views from those in relevant industries, expert groups, and other interested parties on how it should produce guidance and codes of practice on the actions that categorised services can take to comply with the applicable additional duties.

Category 1 services face the highest number of additional duties as follows:

• Transparency reporting
• Enhanced requirements on risk assessments and record keeping
• Additional terms of service duties
• Protections for news publisher and journalistic content, and content of democratic importance
• Providing user empowerment features
• Providing user identity verification options
• Prevention of fraudulent advertising
• Disclosure of information about use of the service by a deceased child user

Category 2A services have fewer, but nonetheless important additional duties:

• Transparency reporting
• Enhanced requirements on risk assessments and record keeping
• Prevention of fraudulent advertising
• Disclosure of information about use of the service by a deceased child user

Category 2B services have the fewest additional duties:

• Transparency reporting
• Disclosure of information about use of the service by a deceased child user

Ofcom’s Questions About the Additional Duties

In the call for evidence, Ofcom asks about the additional duties in order to produce its guidance and codes of practice relating to them. Ofcom is also seeking any additional input that interested parties consider relevant to the guidance and codes of practice.

Additional Terms of Service Duties

Ofcom wants to know how online service providers ensure that their terms of service enable their users to understand when and how different types of enforcement action will be taken against particular content or accounts; how they measure whether users have read, understood, and follow their rules; and how they avoid over-or under-enforcing those rules in their moderation systems.

Protections for News Publisher and Journalistic Content, and Content of Democratic Importance

Here, Ofcom wants to know about the identification, classification, and moderation of such content; how effective and costly these processes are; and the measures taken to prevent the misuse of systems to identify and categorise such content, including details of complaints and appeals processes.

Providing User Empowerment Features

Again, Ofcom wants to know about the detection, classification, and moderation of relevant content; the tools and features currently available to users enabling them to navigate relevant content and user-to-user interactions; the incidence of relevant content for adult users across services; and the experience of adult users with a protected characteristic when encountering relevant content, or of users likely to be particularly affected by such content.

Providing User Identity Verification Options

Under this heading, Ofcom wants to know about the circumstances in which identity verification is offered on user-to-user services, how it is implemented, and the cost and effectiveness of such methods; and about the broader implications surrounding identity verification.

Prevention of Fraudulent Advertising

Ofcom wants to know about the processes and mechanisms that categorised online services use to support the delivery of advertising and the detection of fraudulent advertising; suggestions for additional processes and mechanisms that would enable services to meet their duties under this heading; and any relevant evidence on the role of third parties involved in the process of serving ads on their services, and their relationship to those services.

Access to Information About a Deceased Child’s Use of a Service

This duty is particularly notable in the context of online bullying and its sometimes-deadly consequences. Ofcom wants to know what kinds of evidence online services would need about a parent’s identity or relationship to the child in question, and about the child’s death; what kinds of information parents may request about their child’s use of the service; what information online services already do or might provide (and how), and the challenges and trade-offs involved in doing so; how long it should take for an online service to provide such information; and what mechanisms currently exist for parents to find out what needs to be done to obtain information in such situations, whether those mechanisms are easy to use, and what other options may be made available.

What’s Next?

The call for evidence closes on 20 May 2024, after which, Ofcom will prepare its codes of practice and guidance, and is currently aiming to have them completed before the end of 2024.