Online Safety Act: Outside of ‘big tech’ who should be worrying about its implementation?

Ofcom and DSIT are currently engaged in a back-and-forth exchange about categorising which companies will be caught by the additional duties of the Online Safety Act. Naturally there has been a lot of focus on the biggest and most well-known social media platforms operating in the UK. But alongside this, real regulatory concern is emerging about a second tier of companies which offer products that present risks to users and have enough size to have an impact.

Companies operating in the “mid-layer” of in-scope services – which could include anything from social media services to video games to dating apps – need to start thinking about:

• How to navigate a new identity as a regulated service, that is subject to intense obligations and related compliance costs, as well as significant scrutiny

• How to manage subjective regulatory judgements on what service functionalities are “higher risk” and what appropriate mitigation in systems and processes looks like.

Navigating a new identity

Ofcom will publish a register of categorised services as well as an “emerging services list”, which will include services that are close to meeting the categorisation user number threshold. It may well be that some mid-sized services end up categorised straight away, but the regulator will keep the list under review and amend it over time, particularly in response to new legislation and any changes in definition to the categorisation thresholds suggested by its research.

Being a “categorised service” brings significant additional obligations, and platforms will need to factor the associated increase in compliance costs that come with this status into their product strategies. These obligations include enhanced requirements on risk assessments and record-keeping; additional terms of service duties; protections for news publisher and journalistic content, and content of democratic importance; providing user empowerment features; providing user identity verification options; and prevention of fraudulent advertising.

This is on top of the online safety duties that all in-scope services will have to contend with – including assessing risks of harm from illegal content and (where relevant) content harmful to children, and then introducing safety measures as appropriate. Measures will vary depending on risk and size of the service, and more complex larger services are much more likely to be captured by more onerous requirements. Navigating these extensive regulatory requirements won’t be a trivial task, and will be subject to change over time as a service evolves and grows its offering.

Mid-size platforms, even where they are “emerging” rather than categorised, need to be prepared for substantial levels of scrutiny around these duties. With more than 100,000 services potentially in scope of the regulatory regime, Ofcom is going to need to prioritise its supervision and enforcement efforts. We expect platform size and magnitude of risks are likely to inform regulatory focus, and it will be hard for mid-size platforms to slip through the net.

Communicating bespoke risk management

Ofcom has said that services which implement the measures in its Codes of Practice will be treated as complying with the relevant duties. However, some of its proposals for illegal content are principles-based, leaving flexibility – and ambiguity – about implementation. We expect Ofcom will adopt a similar approach to child safety – an issue on which it will consult shortly. It will be up to each platform to decide how to comply.

While this avoids a one-size-fits-all approach, and allows services to respond as technical solutions evolve, complexity around effectiveness of solutions (how good is good enough?) as well as the need to balance safety with impacts on areas such as privacy and freedom of expression mean this is not necessarily a straightforward task. 

For example, for illegal content, a key challenge is identifying and swiftly removing it. Content moderation has always been a costly and fraught exercise, and it is not yet clear that large language model (LLM) tools, which are being touted as cost-saving moderation solutions, are entirely up to the task yet.

Platforms will also be expected to explain how their approach to online safety is appropriate and effective, and this could be challenging. For example, larger platforms often have sophisticated moderation processes that have evolved over many years, with formalised and centralised rules that can deal with large amounts of content at scale. Inevitably the systems used by larger players will frame how regulator thinks about best practice in mid-sized companies.

However, this type of approach is not always seen elsewhere in the market, where there may be less ability to invest or a preference for other processes such as user community self-moderation. Mid-sized players that are keen to retain their more bespoke approaches to content moderation will need to demonstrate how they meet obligations under the OSA and achieve the desired outcomes. Just ticking boxes, where having “something” will do, is not enough – as demonstrated by Ofcom’s investigation into the effectiveness of OnlyFan’s age verification measures.

Platforms may be engaging (or already using) trust-and-safety-as-a-service vendors, which can provide a range of solutions. The vendor landscape is relatively nascent, and, as the space matures, we anticipate calls for quality markers and certification systems to signal trustworthiness of particular vendors, much as we saw in the digital identity provider space.

While quality markers and certification could improve clarity around standards for compliance, getting them right is not straightforward. Regulators are likely to be cautious about accepting them and will in any case want them to evolve over time to reflect future technological change. Any such systems are therefore unlikely to solve compliance decisions in the short term. During that period platform companies themselves will need to assess the suitability and credibility of vendors, keep vendors in check through (private) service agreements and all the while communicate the effectiveness of their vendor-enabled solutions to Ofcom.

What businesses should be doing and how Flint can help 

Platforms need confidence and certainty about how and when they will be categorised. Businesses should consider working with Ofcom and policymakers quickly, and before secondary legislation this summer, if they feel they are likely to be captured unfairly by Ofcom’s categories, including being put on the list of emerging services.

Organisations must also be prepared for compliance, and third-party vendors need to understand the regulatory trajectory to help platforms give confidence to Ofcom. This means carefully reviewing draft requirements and Codes of Practice, and responding to Ofcom’s consultations to influence its decisions. Once finalised, services will need to make judgements about what internal systems and processes are going to be needed, and be ready to communicate these choices to the regulator.

The Flint team includes subject matter experts on online safety policy, and consultants with first-hand experience of decision-making inside the government and regulatory world. We can help you to assess the risk and create a strategy ensuring the best outcomes for you across all these issues and other online safety concerns.

This blog was written by Flint Manager Louisa Bartolo, Flint Director Charlie Jackson and Flint Director Lacey Law. The authors work across our competition and political analysis teams specialising in AI, tech and media.