Platforms & media
The Online Safety Act (OSA)
What is the purpose of the OSA?
The Online Safety Act (OSA) is a UK Act of Parliament designed to address the growing challenge of illegal and harmful online content. The OSA's purpose overlaps with the EU Digital Services Act, but there are significant differences between the two.
The services within scope of the OSA are narrower, the harms it addresses are broader, particularly when it comes to child protection, and the actions services need to take to comply are more focused on organisation-wide governance, systems and processes. The OSA applies to search engines and 'user-to-user' services that allow users to access content generated or shared by other users.
Key provisions
Duty of care - the OSA imposes a duty of care on in-scope services to protect users from harm. This duty encompasses a wide range of responsibilities, including the removal of illegal content, such as terrorist propaganda and child sexual abuse material, and protecting children from harmful but legal content, such as self-harm content and cyberbullying.
Free speech protections - when deciding on and implementing safety policies/procedures, services must carefully consider the importance of protecting (a) users’ right to freedom of expression within the law and (b) users from unlawful breaches of privacy (including relating to data protection). The OSA requires platforms to be transparent about their content moderation policies, procedures, and decisions.
Vulnerable user safeguards - services are required to regularly assess potential risks to children and may be required to implement age verification mechanisms, content filtering tools, and reporting mechanisms for users to flag harmful content (which goes beyond illegal content). Some services will need to have tools in place to empower adult users to control the content and other users they encounter.
Where will the OSA apply?
The OSA applies to services which have links to the UK. A service has links to the UK if:
- it has a significant number of UK users
- UK users form one/the target market for the service, or
- it is capable of being used in the UK and there are reasonable grounds to believe the UGC/search content on the service presents a material risk of significant harm to individuals in the UK.
Who will have obligations under the OSA?
User-to-user services permitting sharing of UGC and search engines are in scope of the OSA. This includes content-sharing platforms, social media platforms, online marketplaces, online gaming services, blogs, and forums. Specific obligations also apply to pornographic content service providers. Obligations under the OSA will depend upon the nature of the service, with larger, higher-risk services being subject to more onerous obligations, and the service users (ie whether the service is likely to be accessed by children).
Exemptions apply for services that are providing only email, SMS/MMS messaging or one-to-one voice communications, services allowing only limited functionality UGC (eg platforms allowing likes, emojis, voting or limited comments under articles and posts), internal business information services, and some public sector and educational provider-led services.
Are there sanctions for non-compliance?
Ofcom, the UK's media regulator, has been appointed as the regulator to oversee the OSA. It must produce codes of practice and guidance relating to nearly all duties, which will include how the duties can be met and it has wide investigatory and enforcement powers. Draft codes of practice published to date reveal that services will need to take significant steps, requiring organisation-wide engagement, to ensure compliance.
Ofcom's enforcement powers include the power to issue fines of up to the greater of 10% of annual global turnover or GBP18 million. Some criminal offences are created by the OSA. Parent entities can be liable for failures of subsidiaries and vice versa and individuals in senior leadership can face personal liability.
Key dates and deadlines
26 October 2023 – the OSA entered into law. Some of Ofcom's powers, including investigatory powers, are already in force as of August 2024, but most substantive aspects of the OSA will only apply once relevant statutory codes of practice are approved by Parliament. This is expected to happen between late 2024 and 2026.
