Home > Guides > Online Safety Act - In-Depth Guide for Online Business

Online Safety Act - In-Depth Guide for Online Business

Ofcom estimates that over 100,000 online businesses are in-scope for the Online Safety Act. The rules are clear - not following them may lead to fines of up to 10% of global turnover or more.

As the world becomes increasingly reliant on the internet, the opportunity for bad actors to harm individuals or commit criminal acts increases and, inevitably, online regulation steps in.

The Online Safety Act 2023 (OSA) is legislation introduced to protect adults and children from illegal and harmful activities occurring online. It impacts online services such as social media platforms, comparison sites, video games, dating apps, review sites and more. Ofcom – the overseeing regulatory body of the OSA – estimates that over 100,000 online services are in scope.

When an online service is caught by the OSA, there are various duties to comply with which require ongoing monitoring and implementation. A failure to comply with the OSA may result in fines of up to 10% of global turnover or £18m, significant reputational harm, and other enforcement action by Ofcom.

This guide, written by our lawyers, intends to provide an overview for businesses and organisations of the potential OSA duties affecting them.  

Contents

This guide will cover the following: -

  • What online services are caught?

  • What services are exempt?

  • What are the duties?

  • Illegal Content Risk Assessments (ICRAs)

  • How do I judge when content is illegal or harmful?

  • Children Access Assessments (CAAs)

  • What is ‘highly effective age assurance’?

  • Children Risk Assessments (CRAs)

  • How do I judge when content is harmful to children?

  • What evidence must be used to determine if illegal content is on the platform?

  • Can automated content moderation tools be used?

  • What online services does Ofcom consider higher risk?

  • Duty to uphold freedom of expression

  • Duty to uphold the right to privacy

  • When do I need to complete an ICRA, CAA, and CRA?

  • When do I need to update ICRAs and CRAs?

  • How often do I need to do CAAs?

  • How can we assist with OSA compliance?

What online services are caught?

There are two key categories of services which fall under the scope of the OSA. These are (i) user-to-user (U2U) services (ii) search services.

U2U services are online services which allow user generated content (UGC) to be generated, uploaded, or shared directly on the platform to be encountered by other users. Examples include: video and mobile games, dating apps, social sports apps, online forums and chatrooms, file-sharing, social media, online marketplaces, online messaging, AI LLM chatbots, and review platforms. Do note Ofcom does not draw a distinction between organic UGC and content created by generative AI (meaning that harmful content generated by AI outputs will be caught).

Search services are online services which have functionalities enabling users to search some or all websites or databases. Aside from the obvious well-known search engines, this would also include online services which have a narrower scope and perhaps focussed on one topic, product, or industry. Examples include: platforms that collate and aggregate products or results provided by third parties or via the use of APIs (e.g. holiday booking, ticket booking, property searches, online maps, comparison sites) and generative AI which search the internet in response to user prompts.

Some services may have both U2U and search features (e.g. an online marketplace where users can upload product listings and also search for product listings). In such cases, the online service will be treated as a combined service which means that both the rules on U2U and search services must be complied with.

Online services must also target UK users. This could mean, for example, having a significant number of UK users (user accounts do not matter), as well as offering digital content, goods, or subscription services to UK users.

There are also certain ‘categories’ of online service providers under which additional rules apply but these are generally reserved to large providers, such as social media and search engine giants, and are out of the scope of this guide.  

Ofcom has a self-assessment tool available on its website to determine whether your online service may require OSA compliance.

What services are exempt?

The following online services are exempt from the OSA (save for if they allow pornographic content): (i) email, SMS, and MMS services (ii) one-to-one live aural communication services (e.g. phone or video calls) (iii) online services where the main content is provider (or ‘top-down’) content and users can only comment or review on it or respond to it via like, dislike, emoji, or polls (iv) services for internal business use only (e.g. intranets) (v) certain B2B online compliance services and platforms (vi) services provided by public bodies (vii) certain services from education or childcare providers.

What are the duties?

If an online service falls under the scope of the OSA, the duties are as follows: -

  • A general duty to ensure users do not encounter, commission, or facilitate a list of 18 categories of ‘priority’ illegal content on the platform.

  • A duty to implement measures which reduce the amount of time ‘priority’ illegal content appears on the platform and swiftly take down such content when becoming aware of its presence.

  • Carry out an Illegal Content Risk Assessment (ICRA).

  • Carry out a Children Access Assessment (CAA).

  • If applicable, carry out a Children Risk Assessment (CRA).

  • If applicable, various duties to ensure child users are safe from harm on the platform.

  • A duty to include specific provisions in the platform’s terms and conditions relating its OSA duties and how it complies with them (including the use of any proactive technologies).

  • A duty to have in place a suitable reporting and complaints procedure for illegal and harmful content.

  • A duty to uphold the right of freedom of expression and the right to privacy when complying with the OSA duties.

  • A duty to report certain types of sexual offenses directly to law enforcement authorities.

  • A duty to takedown intimate image content within 48 hours of report.

  • A general record-keeping duty.

Illegal Content Risk Assessment (ICRAs)

All providers of U2U and/or search services are statutorily obliged to conduct an ICRA. The ICRA must assess the risk of users encountering illegal content occurring on the platform. Additionally, for U2U services, the risk of the service being used to commission or facilitate the 18 ‘priority’ offenses must also be assessed. Examples of the ‘priority’ offenses include terrorism, harassment, and fraud. 

To assess the risk, Ofcom has a risk register which defines criteria for when a particular category of ‘priority’ illegal content constitutes either high, medium, low, or negligible risk. For example, a ‘high’ risk might be due to criteria such as strong evidence of illegal content appearing on the platform together with high average active monthly users. This risk register applies equally across all categories of priority illegal content but there are separate risk registers for child sexual abuse content and offenses.

Ofcom has also prepared several ‘risk profiles’ which should be assessed to assist with determining the level of risk for each respective illegal content category present on the platform. Each risk profile allocates a higher risk of certain types of harm occurring due to the nature of the service in question or the nature of the online service provider itself. For example, video game services are expected to have a higher risk of hate and harassment perhaps due to the normalisation of such behaviour on certain services by certain individuals. Additionally, early-stage or start-up service providers are expected to be higher risk due to the lack of resources to comply with its OSA duties.

The ICRA must also assess the risk of users encountering certain types of ‘non-priority’ illegal content. Ofcom has identified several of such categories (e.g. epilepsy trolling) but online service providers are expected to identify any trends in harmful behaviour which might denote an emerging ‘non-priority’ category of harm.

Following identification of the risk of illegal content and offenses occurring on the platform, the online service provider must then decide what measures to implement in order to mitigate that risk. Ofcom has produced a code of practice which stipulates various recommended measures which can be taken to achieve this. Some of Ofcom’s recommended measures include setting KPIs for content moderation, appointing an accountable person for OSA compliance, hash-matching for child sexual abuse content, and the use of default settings for children. Though online service providers are free to implement their own measures, it will be sensible to use Ofcom’s code of practice as a guideline, especially for small and mid-sized platforms.

How do I judge when content is illegal or harmful?

When it comes to assessing and taking down UGC and other activities occurring on your platform, Ofcom’s illegal content judgement guidance should be consulted. It explains the criteria required for the criminal prosecution of each type of ‘priority’ offense under various criminal statutes.

Since online service providers are not law enforcement bodies, the burden of proof to determine whether the content or activity is illegal is lower than that used under criminal law. Consequently, and subject to the duty to uphold the right to freedom of expression, it might be that the use of automated moderation tools and/or human moderators with a general, non-specialised awareness of criminal law will be sufficient. Notwithstanding, additional moderation training for child sexual abuse and adult sexual exploitation content and activities would be best practice, due to the stronger duties in the OSA in relation to the same.

Online service providers should also be aware there are certain defences that may apply which can prevent the removal of suspected illegal or harmful content. Generally, these range from journalistic and academic defences to public interest and medical interest defences. As with the determination of whether content is illegal, whether a defence applies will be based on a general, non-specialist determination of the relevant law.

Children Access Assessments (CAAs)

All providers of U2U and/or search services must undertake a CAA to assess whether the ‘child user condition’ is met. The ‘child user condition’ means that either a significant number of users are children or that the service is likely to attract children. A child is someone under the age of 18. If either of these criteria are met, the online service provider must undertake a CRA.

An online service provider is only entitled to conclude that the child user condition is not met, and therefore will not have to conduct a CRA, where (i) age verification or age estimation is used with the result that children are not normally able to access the service and/or (ii) the service does not have a significant number of UK child users and it is unlikely to attract a significant number of the same

Even if ‘highly effective age assurance’ is used, if an online service provider still allows children to access the services or a part of it (perhaps with limited functionality or access controls), it will need to move onto the second limb of the CAA test.

Ofcom has a template CAA on its website which can be used to determine whether your online service needs conduct a CRA and comply with other child-related duties under the OSA.

What is ‘highly effective age assurance’?

The use of ‘highly effective’ age assurance is important because it may absolve online service providers from additional duties under the OSA, such as conducting a CRA and implementing ongoing operational measures pursuant to a CRA. Ofcom’s guidance on age assurance methods should therefore be consulted to determine the extent of the age assurance measures required.

Examples of age assurance methods which are not capable of being highly effective include payment methods that do not require the user to be over 18, self-declaration of age, and general contractual restrictions on the use of the service by children. Conversely, photo-ID matching, facial age estimation, reusable digital identity services, email-based age identification, mobile-network operator checks, and open banking checks are likely to be effective. Tools which are certified by the UK Digital Identity and Attributes Trust Framework are also highly likely to be effective.

Where only documentary evidence is used (e.g. credit card, photo ID, or email) to verify age, multi-factor authentication should be used to check that the documents used belong to the user supply the evidence.

In any event, online service providers should consider using a variety of age assurance methods, especially in order to increase accessibility for vulnerable or disabled users.

Children Risk Assessments (CRAs)

Following completion of a CAA with a positive result, a CRA must be undertaken. The process for a CRA will be very similar to an ICRA insofar as identifying certain categories of illegal content, assigning a risk level to them, and deciding what measures to implement.

The key differences, however, are: -

  • ‘Priority illegal content’ moves way for ‘primary priority’ and ‘priority’ content which are focussed toward content harmful against children (e.g. eating disorders and self-harm). Generally, ‘priority’ harms will require more robust measures to be implemented, such as age assurance.

  • ‘Non-priority’ content is instead labelled as ‘non-designated’ harms and is focussed toward content harmful to children (e.g. body stigma).

  • The ‘risk profiles’ are similar, save for that they are geared toward the impact of online harms on children. For example, Ofcom identifies a risk profile of the ability for users to see and interact with connections (or ‘friends of friends’) as a heightened risk factor in relation to grooming.

  • In relation to the recommended measures to implement, these are similar but are aimed toward protecting children from harm. For example, the recommendation to exclude primary priority content from feeds and to down-rank non-designated content from content recommender algorithms.

How do I judge when content is harmful to children?

In relation to content harmful to children, the criteria to assess the same is generally not based on criminal law statutes (as it is for ICRAs). Conversely, it is the OSA’s own legal definitions of primary, priority, and non-designated content to be used as the benchmark coupled with Ofcom’s guidance on what specific situations and scenarios will be seen as harmful.

For example, for eating disorders (primary priority), content which glamourises anorexia will be harmful whereas content in relation to religiously-observed dietary restrictions (e.g. fasting) will not.  

What evidence must be used to determine if illegal content is on the platform?

To determine whether illegal content is actually present on the platform, Ofcom guidance suggests the use of ‘core’ and ‘enhanced’ evidence.

Core evidence will be matters such as: user complaints, user reports, user data, service’s characteristics, algorithms, content recommendation systems, retrospective analysis of previous instances of harm, and any existing controls. Enhanced evidence will be matters such as: the results of product testing, outputs from content moderation systems, consultations with technical or independent experts or with users and representative groups, research into users’ behaviours and needs, or external audit and risk assurance processes.

Generally, enhanced evidence should only be used where core evidence is insufficient to determine whether illegal content is appearing on the platform or if there are several risk factors at play.

Can automated content moderation tools be used?

The use of third-party content moderation tools may be useful and Ofcom guidance acknowledges this. Further, some third-party tools may even be provided for free by reputable organisations, especially in relation to child sexual abuse activities. However, ultimately, it is up to the online service provider in question to determine whether such tools would be sufficient to enable it to comply with its respective OSA duties.

What online services does Ofcom consider higher risk?

Online services which have an inherent risk of enabling illegal and harmful activities to occur are given special attention under Ofcom’s ‘risk profiles’, especially where they contain certain functionalities. For example, under U2U services, user anonymity brings higher risk of harms such as foreign interference, child sexual abuse, and harassment due to the emboldening of individuals whom post without an account or identity. For online services which meet the ‘child user condition’, the use of functionality such as tagged content, chats, and reposts may improve the discoverability of harmful content by children.

There are over 50 ‘risk profiles’ which Ofcom has prepared that apply to U2U and search services, as well as online services which meet the child user condition. Ofcom also has the power to introduce further risk profiles as the online industry develops.

Duty to uphold freedom of expression

There is an evident tension between, on the one hand, online service providers stifling the freedom of expression on its platforms by taking down content and, on the other hand, the right of individuals or content creators to freely express their UGC.

For black-and-white situations, the risk of stifling freedom of expression will probably not be an issue, but problems may arise in fringe cases. Certainly, the lower burden of proof required to entitle online service providers to take down content, together with the use of bulk takedowns, exacerbates matters.

Despite this, Ofcom guidance suggests that implementing an appeals system will be taken as a presumption that the right to freedom of expression is being upheld. It could be that, therefore, the use of mass or automated takedown tools coupled with an appropriate appeals system will be sufficient to meet relevant OSA duties.

Duty to uphold the right to privacy

Online service providers must acknowledge the distinction drawn between ‘public’ and ‘private’ communications under the OSA in order to uphold individuals’ rights to privacy. This is because the OSA does not permit online service providers to interfere, via automated means, with private communications made on its platforms.

Whether a communication is private depends on (i) the number of individuals in the UK who are able to access the content by means of the service (ii) any restrictions on who may access the content by means of the service (e.g. ‘invite-only’) (iii) the ease with which the content may be forwarded to or shared with users of the service other than those who originally encounter it or users of another internet service (e.g. ‘reposting’).

The result of this could mean that, as an example, a private party chat on a video games platform cannot proactively be scanned for illegal or harmful content but if a user reports something happening there the online service provider can only then investigate.

When do I need to complete an ICRA, CAA, and CRA?

For new and start-up businesses that are U2U and/or search services, or businesses which turn into a U2U or search service, the first ICRA and/or CRA must be done within 3 months of the first day in which they are caught by the duty to conduct the ICRA and/or CRA.

For new and start-up businesses, or businesses which turn into a U2U or search service, the first CAA must be done within 3 months of the first day in which they are caught by the need to conduct a CAA.

When do I need to update ICRAs and CRAs?

ICRAs and CRAs must be reviewed and updated where either (i) Ofcom makes a significant change to a ‘risk profile’ which affects the online service, or (ii) before a significant change to the online service is made. In any event, Ofcom guidance states that ICRAs and CRAs should be reviewed on an annual basis.

A ‘significant’ change to an online service are, generally, changes which materially impact a substantial proportion of a user base, changes the types of users likely to access the platform, impacts the efficacy of the changes implemented in the organisation’s previous ICRA or CRA. An example could be a change in the functionality or GUI of a content reporting system. 

How often do I need to do CAAs?

Ofcom guidance states that CAAs should be done regularly; either annually or before major changes to the service (see above) to assess whether a CRA is required.

How can we assist with OSA compliance?

OSA compliance is a necessary and fundamental duty for many online services with interactive user elements. At Click Digital Law, our lawyers possess strong industry expertise from working with digital businesses throughout their careers.

Our lawyers can assist with the following: -

  • Conducting and preparing ICRAs, CAAs, and CRAs.

  • Updating ICRAs and CRAs whenever key changes to your online service occurs or when Ofcom introduce new risk profiles.  

  • Interpreting the OSA and Ofcom guidance generally, as well as for novel, unique, or emerging situations, to determine the extent of your legal duties.

  • Legal support on implementing Ofcom-recommended or in-house measures, policies, and procedures for OSA compliance.

  • Legal support on the adoption of organisational methods and systems to assess whether UGC is harmful by OSA and Ofcom standards.

About the author

This guide has been written in-house by our qualified lawyers whom you can contact here for further information and support on your business activities.