New Year’s resolutions: Two immediate priorities for online platforms under the UK’s Online Safety Act

The Online Safety Act (OSA) - the UK’s flagship law which aims to make the UK the “safest place in the world to be online” - was passed into law in October 2023 to great fanfare but with barely any of its provisions applying from day one. 

However, two rounds of secondary legislation have now brought much of the OSA into force and those who fall within its scope may well be asking: what do we have to do right now? 

In short, they now need to comply with any information notices issued by Ofcom and must also ensure their terms of service cover a very specific point. Read on to learn more… 

What exactly is in force?

Large parts of the OSA have been brought into force by secondary legislation. OSA Commencement Regulations No.1 brought sections 114(2) and 114(7) on cooperation with overseas regulators into force on the 22^nd November 2023. Following this, the OSA Commencement Regulations No 2 passed on 19 December 2023 and brought into force the majority of provisions in the OSA as of 10 January 2024, while others will come into force on 1 April 2024. 

So what do platforms need to do now?

Although large parts of the OSA are currently ‘in force’, virtually all of the onerous duties (concerning illegal content and content that is harmful to children) will only begin to bite once Ofcom has finished its consultations and the Secretary of State has approved the resulting codes of practice (see The UK’s Online Safety Bill: Ofcom’s updated roadmap to regulation – ready and raring to go?, Ben Packer, Jemma Purslow (linklaters.com)). 

However, Ofcom has specifically flagged two immediate compliance points for platforms to action now. 

First, under s. 72(1) of the OSA, “user-to-user services” must ensure that their terms of service explain in clear and accessible language that users have the right to bring a claim for breach of contract if the service breaches their terms in taking down content or banning a user. "User-to-user services” covers a broad spectrum of businesses and may incorporate social media platforms, messaging services, marketplaces, dating services, review services, games services, file-sharing services and many more. This was a topic we explored in this post previously: The UK’s Online Safety Bill: 5 things that may have flown under the radar, Ben Packer, Dasha Konnova (linklaters.com).

Second, a wide range of entities must now comply fully with any information notices issued by Ofcom. This includes not only user-to-user services but also search services, “ancillary services” (e.g. payment processors), “access facilities” (e.g. app stores) or indeed anyone who appears to have, or appears to be able to generate or obtain, information which Ofcom require. We know from Ofcom’s experience overseeing the VSP regime (see Ofcom’s warning to online platforms: be ready for regulation, Jemma Purslow, Ben Packer (linklaters.com)) that the regulator is willing to launch investigations into non-compliance and to sanction platforms. More about Ofcom’s investigative powers can be found in the recording of our recent webinar (Online Safety Act Webinar Series - session 2 | Linklaters).

Ofcom are still consulting on key provisions

Beyond the immediate priorities, platforms should have an eye on the meatier obligations that are likely to begin to apply later this year. As explained in this post, Ofcom expect the illegal content duties to apply from the end of 2024. Their consultation on what platforms will be required to do has been open since November and has just under a month left to run (see The rubber hits the road: Ofcom launch their first consultations on the OSA 2023, Georgina Kon, Ben Packer, Jemma Purslow, Ria Moody (linklaters.com)).

With plenty for services to incorporate into their New Year Resolutions, 2024 promises to be a busy year for those within the broad scope of the OSA.