Is your online business caught by the Online Safety Act?

The Online Safety Bill recently received Royal Assent and became law in October this year (the “Act”), at which point the Office of Communications (“Ofcom”) was granted broad powers to regulate online service providers. Essential detail concerning the legislative framework within the Act will be disclosed in the course of consultation and stakeholder engagement concerning the secondary legislation, codes of practice and guidance which will underpin the Act.

In its Impact Assessment, the Government estimated that approximately 25,100 tech companies will be in scope of the new online regulatory framework (which may be a conservative estimate). Whilst the primary aim of the Act is to establish a new regulatory regime predominantly to address illegal and harmful content online accessed via the ‘Big Tech’ platforms, many smaller to mid-size tech platform providers are likely to be required to comply with the new regulatory regime (such as online forums, gaming sites, social media platforms and blogging platforms).

In order to assess the impact of the Act upon your online business, it is necessary to first understand the intended scope of the legislation.

The online services to be regulated

The Act imposes legal requirements on providers of the following online services:

1. User-to-user services. This relates to providers of ‘internet services’ which allow users to ‘encounter content’ generated, uploaded or shared by other users i.e. user-generated content.

a) An ‘internet service’ is defined as a service made available by means of the internet or a combination of the internet and an electronic communications service. It therefore covers a broad range of services, including websites, apps and other software. It doesn’t matter whether payment and/or a subscription is required to receive the service.

b) To ‘encounter content’ means to read, view, hear or otherwise experience content communicated by means of an internet service, whether publicly or privately, including written material or messages, oral communications, photographs, videos, visual images, music or data of any description. A service with the functionality to either send direct messages to other users via an instant/private messaging service or watch another user’s audio-visual content will therefore be classed as a user-to-user service.

c) It doesn’t matter if content is actually shared between users in practice, so long as the service has functionality that allows for such sharing, it will be considered as a user-to-user service.

d) It also doesn’t matter what proportion of the content on the platform is user-generated. By way of example, a site which provides discrete online forum functionality through which users can interact and post, but which is a minor element of the site’s functionality, will still be caught by the Act.

2. Search services. This relates to providers of search services and/or search engines which enable users to search multiple websites and databases.  

a) The commonly-understood interpretation of a search engine, such as Google or Bing, is deemed a ‘search service’ by the Act, but the definition also includes services provided via virtual assistants, such as ‘Siri’ and ‘Alexa’.

b) A search service is only caught by the Act if it allows a user to search more than one database or website. Relevant search services include those which involve typing search terms into a search box, reading through a list of contents and/or using tags or metadata to filter content.

3. Pornographic services. This relates to any online service provider which publishes or displays pornographic content which is not user-generated.

Regulation of online services based outside of the UK

An online services provider must have ‘links with the UK’ in order to be categorised as a provider of user-to-user services, search services or pornographic services. In practice, that hurdle is easily jumped as any service; (a) with a significant number of UK users; or (b) with a target market of UK users; or (c) capable of being used in the UK by individuals, will be deemed to have ‘links with the UK’.

Provided the relevant services have links with the UK, the Act considers user-to-user services, search services and pornographic services to be ‘Regulated Services’ (save for those which fall within the exemptions explained below). Ofcom will now have the power to take appropriate action against all providers of Regulated Services, no matter where they are based.

It’s also worth noting that a search service that both enables user-generated content and includes a search engine will be deemed either a user-to-user service or a search service under the Act. If the only user-generated content enabled by the search service is of a kind exempted under the provisions of Schedule 1 of the Act (explained below), then the service will be categorised as a search service. If the search service enables other forms of user-generated content, then it will be categorised as a user-to-user service.

Categories of regulation: thresholds

The Act allocates Regulated Services into different categories to ensure proportionality with regard to regulatory requirements. Thresholds for these categories have not yet been defined by the Government and will be set out in secondary legislation, so it is unclear at this stage as to which platforms will fall into what category. Broadly, the most onerous compliance obligations will fall upon the services assessed to give rise to the greatest risk of harm resulting from the number of users on a platform and type and range of content users may encounter.

Based on initial policy intention, the Government estimates in its Impact Assessment that between 30-40 platforms are expected to be designated as the highest risk service providers in ‘categories 1, 2A and 2B’ (explained below). This means approximately 25,050 other online service providers are caught by the new regime in lower risk categories.

In advance of the passage of secondary legislation to clarify matters, the Government’s Impact Assessment includes high level examples of the types of platforms likely to fall within scope of each category, as follows:

1. Category 1. These platforms will be the highest risk user-to-user services, capturing a small group of the largest social media sites (e.g. Facebook, Instagram etc.) and pornography sites.
2. Category 2A. These platforms will be the highest risk search services, capturing a small group of the largest online search engines (e.g. Google).
3. Category 2B. These platforms will be user-to-user services which are high-risk and high-reach, but which may not necessarily meet all of the Category 1 thresholds.
4. All other in scope businesses (save for those in the categories set out in points (1) – (3) above and point (5) below).
5. Pornography publishers that do not host user-generated content or enable user-to-user interaction.

Exemptions

Whilst the definitions of Regulated Services are broad, the following services are exempt and outside the scope of the Act’s regulatory framework:

1. Email, telephony and other forms of communications. Any user-to-user service where the only user-generated content enabled by the service is email communication, SMS messages, MMS messages and one-to-one live aural communications (such as telephone calls).
2. ‘Low risk functionality’ user-to-user exemption. These are services where users are only able to communicate by posting comments on digital content directly published by the relevant platform/service, such as product reviews. This also includes ‘below the line comments’ on articles and blogs.
3. Internal business services. This is defined as a service, managed by an organisation, the primary purpose of which is to enable interactions between members within that organisation. This exempted category encompasses intranets, customer relationship tools, enterprise cloud storage and enterprise conferencing software.
4. Network infrastructure. This includes internet service providers, virtual private networks and other business-to-business network infrastructure services.
5. Services relating to educational institutions. These are platforms used by teachers, students and parents to communicate and collaborate in the educational context, including platforms such as intranets, cloud storage systems and ‘ed-tech’ platforms.

Still unclear?

Outside of the ‘Big-Tech’ companies which the Act is clearly aimed to regulate, it may be far from clear-cut as to whether an SME online service provider will be caught by the Act. If your business is struggling to understand whether it falls within the regulatory perimeter of the Act, please contact Andrew Solomon, Caroline Sheldon or our online safety team for advice.