The Online Safety Act 2023

Introduction

The Online Safety Act 2023 (OSA 2023) is landmark legislation that establishes a new regulatory framework for online safety in the United Kingdom. The Act imposes a duty of care on providers of user-to-user services and search services to protect users from illegal content and activity, to protect children from harmful content, and to ensure greater transparency and accountability in platform operations. OFCOM is the designated regulator with extensive enforcement powers under the Act.

Scope and Application

The OSA 2023 applies to two categories of service: user-to-user services — including social media platforms, messaging apps, forums, and video-sharing platforms — which enable users to generate and share content with other users; and search services — including search engines — which enable users to search websites and databases. The Act applies to services with links to the United Kingdom, regardless of where the service provider is established.

Services are categorised based on size and risk. Category 1 services are those with the largest user numbers and highest risk profiles, and are subject to additional duties including the duty to protect users’ journalistic content and to ensure democratically important content is not removed for political reasons. OFCOM designates category 1 services by notice, applying criteria set out in the Act.

The Duty of Care

The core of the OSA 2023 is the duty of care — a legal obligation on service providers to take proportionate measures to address specified harms. The duty has multiple components, applying to different types of content and service categories.

The illegal content duty requires providers to take proportionate measures to prevent users from encountering illegal content, to minimise the length of time any illegal content is present, and to swiftly remove illegal content when it is identified. The duty applies to all illegal content, with priority offences including terrorism, child sexual exploitation and abuse, hate crime, fraud, and the sale of illegal weapons and drugs.

The child safety duty requires providers whose services are likely to be accessed by children to take proportionate measures to protect children from harmful content. The duty distinguishes between primary priority content (content that is most harmful to children, such as pornography, violent content, and content promoting self-harm) and priority content (content that may be harmful but is less severe). Providers must have robust age assurance measures to prevent children from accessing harmful content.

The transparency duty requires providers to publish annual transparency reports setting out details of their content moderation practices, the volumes of illegal and harmful content detected, and the effectiveness of their safety measures.

OFCOM’s Regulatory Role

OFCOM is designated as the online safety regulator under the Act. OFCOM is responsible for producing codes of practice, enforcing compliance, and providing guidance to service providers. OFCOM must publish codes of practice setting out practical guidance on how providers can comply with their duties. Compliance with the codes provides a safe harbour — providers who follow the code are deemed compliant with the corresponding duty.

OFCOM has extensive information-gathering powers, including the power to require providers to provide information about their algorithms, content moderation systems, and safety measures. OFCOM may conduct risk assessments and commission independent audits of providers’ compliance. OFCOM also has the power to enter providers’ premises to inspect equipment and documents.

Enforcement and Penalties

OFCOM has a graduated enforcement framework. Where OFCOM considers that a provider has failed to comply with its duties, it may issue an enforcement notice requiring specific remedial action. Failure to comply with an enforcement notice may result in: financial penalties of up to £18 million or 10 per cent of the provider’s annual qualifying worldwide revenue, whichever is higher; business disruption measures, including requiring payment service providers and internet service providers to cease providing services to the non-compliant platform; and in the most serious cases, criminal liability for senior managers who fail to comply with OFCOM’s information requests.

OFCOM may apply to the court for a service restriction order requiring internet access providers to block access to non-compliant services, or requiring app stores to remove the service from their platforms.

Freedom of Expression and Privacy

The OSA 2023 includes safeguards for freedom of expression and privacy. The Act imposes a duty on providers to have regard to the importance of freedom of expression and the need to protect users from unwarranted restrictions on lawful content. Category 1 services must have a news publisher exemption, ensuring that content from recognised news publishers is not removed except where it constitutes illegal content.

Providers must also give users the right to appeal content moderation decisions and must publish information about their complaints procedures. The Act requires OFCOM to have regard to the importance of privacy when exercising its functions and to ensure that its codes of practice do not require providers to implement measures that would be disproportionate to the risk.

The Transparency Reporting Framework

The OSA 2023 establishes a comprehensive transparency framework designed to increase public understanding of how platforms moderate content. Providers must include in their transparency reports information about: the volume of illegal content detected and removed; the number of complaints received from users and how they were resolved; the use of automated content moderation tools and the accuracy of those tools; and the resources dedicated to content moderation, including the number of human moderators employed.

OFCOM must publish periodic reports on the state of online safety, analysing data from providers’ transparency reports and identifying trends in online harm.

Conclusion

The Online Safety Act 2023 represents a significant step in the regulation of online platforms, imposing a statutory duty of care on service providers to protect users from illegal and harmful content. OFCOM’s enforcement powers, including substantial financial penalties and the ability to restrict non-compliant services, provide a robust framework for ensuring accountability in the online environment. The Act balances safety objectives with protections for freedom of expression, privacy, and journalistic content.