The UK Online Safety Act

The Core Mandate: A New Digital Social Contract

The Online Safety Act is one of the most ambitious and controversial pieces of internet regulation ever enacted in the Western world. Born from years of public debate and political pressure following high-profile cases of online harm, its primary mission is to make the UK the safest place in the world to be online. The Act fundamentally shifts responsibility, imposing a legal 'duty of care' on tech companies to proactively manage the risks posed by content on their platforms. It moves away from a model of reactive content removal to one of proactive system design for safety.

The core objectives are to:

• Protect Children: Go beyond simple moderation to proactively shield minors from harmful content such as pornography, self-harm promotion, and eating disorder content through robust age verification and system design.
• Tackle Illegal Content: Ensure the swift and effective removal of universally illegal material, including terrorist content and child sexual exploitation and abuse (CSEA), for all users.
• Empower Adult Users: Give adults more control over the types of legal-but-harmful content they see, such as certain forms of abuse, hate speech, or misinformation, through user-configurable tools.

How the Act Works: The Three-Tier System

The Act isn't a one-size-fits-all solution. It categorizes services based on their size, functionality, and potential for harm. The duties imposed on a platform depend entirely on which category it falls into. This is crucial for distinguishing between a massive social network ("user-to-user" service) and a search engine.

The Role of Risk Assessments

The requirement for platforms to conduct regular, comprehensive risk assessments is the foundation of the Online Safety Act. This forces a shift from reactive content deletion to a proactive safety-by-design approach. Platforms can no longer claim ignorance of the harms their services might facilitate.

These assessments must consider:

• User Base Risks: Does the platform attract a large number of children? Is it likely to be used by vulnerable adults?
• Content Risks: What types of illegal and harmful content are most likely to appear on the service?
• Functionality Risks: Do features like live-streaming, anonymous posting, or algorithmic recommendations increase the risk of harm?

Based on these assessments, companies must implement appropriate safety measures to mitigate the identified risks. This is the core of the "duty of care."

Decoding 'Legal but Harmful' Content

This is one of the most debated concepts in the Act. It refers to content that is not criminal but has the potential to cause significant physical or psychological harm to an ordinary person. The Act does not require platforms to remove this content for adults.

Instead, Category 1 services must:

• State their policy: Clearly define in their terms of service how they handle such content.
• Provide user tools: Offer robust, easy-to-use functions that allow adult users to filter this content out of their feeds if they choose.
• Apply policies consistently: Enforce their own terms of service fairly for all users.

Examples of content that could be considered 'legal but harmful' include content that promotes or glorifies eating disorders, self-harm, or specific patterns of abuse not covered by existing criminal law.

Ofcom's Role: The New Digital Sheriff

The UK's communications regulator, Ofcom, has been given vast new powers to enforce the Act. It is responsible for creating the detailed rulebooks (Codes of Practice) that platforms must follow and for taking action against those who fail to comply.

Ofcom's approach is phased:

1. Consultation: Ofcom consults extensively with industry, academia, and the public to develop its Codes of Practice. This is a multi-year process.
2. Guidance: It publishes detailed guidance to help companies understand their legal obligations.
3. Enforcement: Once the duties are in force, Ofcom will monitor compliance and investigate potential breaches. Its powers are significant.

The Technology of Age Verification

A cornerstone of the Act's child protection measures is the requirement for platforms that host pornography or other content harmful to children to implement "robust" age verification. This presents significant technical and privacy challenges.

Potential methods include:

• Digital ID Systems: Using official digital identities (like a digital driver's license) to prove age. This is secure but requires government infrastructure that is not yet widespread.
• Third-Party Verification: Users upload an ID document to a trusted third-party service which then confirms their age to the platform without sharing the document itself. This raises concerns about data centralisation.
• Facial Age Estimation: Using AI to estimate a user's age from a selfie. This is a privacy-preserving option as the image can be deleted immediately, but it's controversial due to potential inaccuracies and biases.

Freedom of Expression vs. The Duty of Care

At its heart, the Online Safety Act navigates a fundamental tension between two core democratic values: the right to free expression and the responsibility of a society to protect its citizens, especially children, from harm. This is not a simple technical problem but a profound philosophical one.

• The Argument for Free Speech: Proponents argue that a free and open internet requires the ability to discuss controversial, offensive, or unpopular ideas without fear of censorship. They warn that giving a regulator the power to influence what content platforms promote or remove creates a "chilling effect" that could stifle important debate and artistic expression.
• The Argument for a Duty of Care: Supporters contend that online platforms are not just neutral bulletin boards; their algorithms actively shape what billions of people see. They argue that this power comes with a responsibility to design systems that don't amplify harm, just as a car manufacturer has a duty to ensure its vehicles have working brakes. For them, this isn't about censoring individual posts but about ensuring the system itself is safer by design.

The Act attempts to strike a balance by focusing on illegal content and child protection while giving adults tools to control their own experience, but the debate over whether it gets this balance right is central to the entire controversy.

Points of Contention: Why the Act is So Divisive

The Online Safety Act's journey into law was fraught with debate. The disagreements stem from fundamental tensions between the goals of safety, privacy, and freedom of expression.

• The Encryption Conflict: The most contentious part of the Act involves powers that could compel platforms to use "accredited technology" to scan user messages for CSEA content. Critics, including services like Signal and WhatsApp, argue this is technically impossible to do without breaking end-to-end encryption. They warn this would create a 'spy clause' that undermines the privacy of all users and creates a backdoor that could be exploited by criminals and hostile states.
• The Free Speech Chilling Effect: While the focus on 'legal but harmful' content was softened, concerns remain. The "duty of care" model and the threat of massive fines could lead platforms to over-censor legitimate content to be risk-averse. This could disproportionately affect discussion on sensitive topics or content from marginalised communities, leading to a form of "collateral censorship" where platforms remove anything that might be deemed risky.
• Technical Feasibility and "Magical Thinking": Many technologists and privacy experts have accused the government of "magical thinking" by demanding solutions that are not currently possible without severe side effects. The idea of a system that can perfectly detect illegal content in encrypted messages without compromising the encryption itself is, for now, a technical fantasy.
• The Power of Ofcom: Granting a regulator such extensive powers over online speech is a major concern for civil liberties groups. They worry about the potential for these powers to be used to suppress dissent or unpopular opinions in the future, regardless of the current government's intentions.

New Criminal Offences Explained

The Act also creates several new criminal offences to target specific types of online abuse that were previously difficult to prosecute.

• Cyberflashing: It is now a specific criminal offence to send an unsolicited image or video of genitals to another person for the purpose of sexual gratification, alarm, or humiliation.
• Epilepsy Trolling: The Act criminalises the act of sending flashing images to a person with epilepsy with the malicious intent of inducing a seizure.
• Encouraging Self-Harm: It is now illegal to encourage or assist another person to commit serious self-harm, closing a loophole in previous legislation.
• False Communications: A new offence targets sending communications that are knowingly false and intended to cause non-trivial emotional, psychological, or physical harm.

Your Digital Rights & How to Use Them

The Act empowers you with new rights when using online services. Here’s how you can use them:

• The Right to Appeal: If a platform removes your content or suspends your account, look for their appeals section. You now have the right to a clear and fair process. State your case clearly and refer to their terms of service.
• The Right to Control Your Feed: On major platforms, explore your settings for "Content Preferences" or "Sensitive Content Filters." The Act mandates these tools, allowing you to filter out types of 'legal but harmful' content you don't wish to see.
• The Right to Report Harm Easily: When you see harmful content, use the platform's reporting function. The Act requires these to be easy to find and use. Be specific about which rule you believe has been broken.

What the Act *Doesn't* Cover

It's important to understand the Act's boundaries. It is not a silver bullet for all online problems. Key areas outside its direct scope include:

• Paid-for Advertising: Scams and harmful content in paid ads are largely outside the scope of the Online Safety Act itself, though they are covered by other regulations like the Advertising Standards Authority (ASA) codes.
• Email and One-to-One Messages: Content in emails, SMS, and one-to-one messaging apps (like a direct message between two people on WhatsApp) is not covered, unless it involves CSEA or terrorism.
• Content Published by News Organisations: Recognised news publishers have an exemption to protect press freedom.
• Comments on News Publisher Sites: Comments sections below articles on news publisher websites are also exempt.

The Act and Online Gaming Communities

The Act's rules apply to online gaming just as they do to social media. Gaming platforms that include features like in-game chat, forums, or user-generated content fall under the duty of care.

• In-Game Chat: Companies must take steps to protect players, especially minors, from bullying, harassment, and exposure to illegal content in voice and text chat.
• User-Generated Content (UGC): Platforms that allow players to create and share content (like custom maps, skins, or mods) must have systems to deal with illegal or harmful creations.
• Reporting Tools: Gaming services must have clear and effective in-game tools for players to report harmful behaviour or content.

A Guide for Small Businesses & Startups

If your UK-accessible business operates a website or app with user-generated content (forums, comment sections, reviews), you are likely in scope of the Act. While the heaviest duties fall on tech giants, you still have responsibilities.

1. Assess Your Risk Honestly: Do you have a comment section? A user forum? A review system? You must conduct a basic risk assessment to identify the potential for illegal content to appear on your service.
2. Create Clear & Simple Terms: Your Terms of Service must clearly state what is and isn't allowed. You don't need complex legal language. A simple, clear statement like "We do not tolerate illegal content or hate speech" is a good start.
3. Implement an Obvious Reporting Tool: You must have a simple, easy-to-find way for users to report content they believe is illegal. This can be a simple "Report" button or a dedicated email address.
4. Act on Reports: You must have a process for reviewing reports and removing illegal content in a timely manner. Document your decisions.
5. Stay Informed via Ofcom: Keep an eye on Ofcom's website for their specific guidance for smaller businesses. They are tasked with providing support and clarity for SMEs.

Comparing the UK Act to the EU's Digital Services Act (DSA)

The Online Safety Act is often compared to the EU's own landmark regulation, the Digital Services Act. While they share similar goals, their approaches differ in key ways.

The Global Context & Future Outlook

The Online Safety Act is not being created in a vacuum. It is part of a global trend of governments attempting to regulate the digital world.

• Setting a Precedent: The world is watching the UK. The success or failure of the Act, especially its approach to encryption and risk assessments, will influence similar legislation being developed in the EU (with its Digital Services Act), Canada, Australia, and beyond.
• The 'Brussels Effect' vs. 'London Effect': For years, the EU's GDPR set the global standard for data privacy (the 'Brussels Effect'). The UK hopes its Online Safety Act will do the same for content moderation, creating a 'London Effect'.
• An Evolving Law: The Act is a framework. The specific rules will be fleshed out over years through Ofcom's codes of practice and will be updated as new technologies and harms emerge. This is the beginning of a long process, not the end.

Glossary of Terms

Client-Side Scanning (CSS)

Technology that scans the content of a user's message on their own device before it is encrypted and sent. A highly controversial method proposed to detect illegal content on encrypted platforms.

Duty of Care

A legal obligation requiring platforms to take reasonable steps to protect their users from foreseeable harm arising from their service.

End-to-End Encryption (E2EE)

A secure communication method where only the sender and recipient can read the messages. The Act's potential impact on E2EE is a major point of controversy.

Illegal Content

Content that is against the law, such as terrorist material or child sexual exploitation and abuse (CSEA).

Legal but Harmful Content

Content that is not illegal but could cause significant physical or psychological harm, especially to children (e.g., content promoting self-harm or eating disorders).

Ofcom

The UK's communications regulator, now responsible for enforcing the Online Safety Act.

Risk Assessment

A formal process that platforms must undertake to identify, evaluate, and mitigate the risks of harm to users on their services.

Frequently Asked Questions