With the UK Online Safety Act (OSA) now a seemingly familiar part of the UK legislative landscape, it’s a good time to consider some common pitfalls and less obvious aspects, as well as what may be coming next, writes Elle Todd, Partner, at the law firm Reed Smith.
The first key mistake made with the OSA is not realising how crucial it is to spend time considering the correct classification of services. It is very rarely the case that the OSA applies to a whole service and not carefully thinking through which features and parts are actually in scope can be dangerous. Not only does this result in unnecessary governance and obligations, but with the new fees regime for services having kicked in this summer, services could find themselves literally paying for the error.
Fees are charged by [regulator] Ofcom based on revenue generated from “relevant parts” of the service (subject to certain thresholds—currently fees are payable where there is UK revenue of over £10m and global revenue of £250m). Overreach in determining which parts of a service are in scope will directly impact qualifying revenue and therefore fees. We have urged numerous services to revisit their status over the past year.
Second, the OSA is far from the UK’s version of the EU Digital Services Act (DSA), as many often assume, although both address risks around user-generated content and search services. While many services will be caught by both regimes, unfortunately they don’t map neatly against each other. Again, this requires careful feature-by-feature analysis to determine which obligations apply. A few key differences to be alert to:
Age assurance
A third pitfall is that the obligations on age assurance are frequently misunderstood. Despite the noise about age gates, the OSA’s current mandatory provisions are quite limited. The focus is on pornography services (where there has been a real focus on enforcement from Ofcom, given these restrictions kicked in first) and on services that fail to prohibit specific content being generated or uploaded by users, such as pornography, or suicide and self-harm content – for example in their terms.
So, what are we likely to see? Undoubtedly, interest in age assurance will continue to grow. The new proposals for amendments to introduce bans for users under sixteen on livestreaming, social media, and certain chat services will take shape. This presents various challenges. One which is often overlooked is that the shift from over-18 verification (which we all thought would be the primary focus and around which many age assurance tools have been designed) to identifying younger age brackets, such as the proposed 16-year threshold, is a far from easy task.
Current technologies sometimes struggle with accuracy at these finer age distinctions, creating real implementation headaches but requiring ID documentation presents other risks including discrimination and collection of sensitive information. It’s not just the UK, EU-wide digital age of majority proposals and growing international variation in age thresholds will force new solutions and decisions here.
Compliance gaps
We will see a focus on services that currently fall into an OSA compliance “gap.” This includes app stores, where Ofcom’s report this autumn will no doubt prove interesting reading, as many apps hope that more responsibility will shift to these so-called gatekeepers. We will also likely see AI chat services (currently largely out of scope where they only have one-to-one interactions between the service and user) come more into focus.
Inevitably litigation will also start testing the boundaries of Ofcom’s powers and the proportionality of specific enforcement actions. The courts may have the final word on how far the regulator can go.
