The House of Lords will debate the Draft Online Safety Act 2023 (Category 1, Category 2A and Category 2B Threshold Conditions) Regulations 2025 on 24 February. Lord Clement-Jones has tabled a regret motion. This note, which is also available as a PDF at the bottom of the page, sets out a number of issues with the regulations as drafted, which are based on advice from Ofcom that does not follow the intent of Parliament, as well as the scrutiny procedure the Government has followed.

Issue

• The Online Safety Act 2023 was amended by the previous Government to ensure that Ofcom had the flexibility to include platforms in category 1 on the basis of risk as well as size. This was the result of a concession, won by Baroness Morgan at Lords’ Report with cross-party support, to amend Schedule 11.
• Additional duties that apply to category 1 services include: transparency reports; a duty to enforce their terms of service; and a duty to provide user empowerment tools to enable users to protect themselves from some of the most harmful content. These are the few remaining protections for adult users following the decision by the previous Government to remove the relevant safety duties.
• Ofcom’s advice to the Government - published last March - did not take account of this flexibility and instead recommended that categorisation of services should be based on size alone. Despite civil society concerns - raised repeatedly with the Secretary of State, his Department, and with Ofcom - spanning suicide, self-harm, mental health and online abuse, the Secretary of State has followed Ofcom’s advice and laid regulations which run contrary to Parliament’s intent.
• His decision to proceed with this narrow interpretation of the OSA provisions - and his failure to use the power he had to reject Ofcom’s imperfect advice - will allow small, risky platforms to continue to operate without the most stringent regulatory restrictions available and leave significant numbers of vulnerable users, women and minoritised groups at risk of serious harm from the targeted activities on these platforms.
• This note covers the Parliamentary background, Ofcom’s advice, the Government’s position and civil society concerns.

Parliamentary background

• Baroness Morgan’s small but significant amendment - to change “and” to “or” so that Ofcom could make decisions on categorisation based on size OR risk, rather than size and risk - had cross-party support in the Lords and led to a defeat of the Government in a vote. It was a continuation of a campaign to ensure a risk-based approach to the categorisation of platforms that Sir Jeremy Wright MP had begun in the Commons.
• Detail on the significance of this amendment is set out in our analysishere; and a history of the Parliamentary debates during the OSB passage is available here.
• The then Government Minister, Paul Scully MP, acknowledged at ping pong on 12 September 2023 that “many in the House have steadfastly campaigned on the issue of small but risky platforms”. He confirmed that the amended legislation would now give the Secretary of State “the discretion to decide whether to set a threshold based on the number of users or the functionalities offered, or both factors” with the change ensuring that “the framework is as flexible as possible in responding to the risk landscape”.

Parliamentary scrutiny

• Despite Lord Parkinson promising at Lords Reportstage - with specific reference to these regulations - that “the decision-making can be scrutinised in Parliament” because the Secretary of State “is accountable to it” and also giving separate commitments to Lord Stevenson that Committees in both Houses should be given advanced notice and the opportunity to comment on regulations relating to the OSA before they are laid, the Government has made no provision for that additional scrutiny. The Commons Science Innovation and Technology committee only received advance notice of the text of the regulations one working day (Fri 13 December) before they were laid on the Monday.
• On 16th December, the Governmentpublished a WMS and laid the regulations for the categorisation of services as per Ofcom’s advice: eg such that category 1 services will be determined according to size. Our brief analysis of what this means is here.
• Peers have challenged the Government on this decision - including most recently in a debate on 16 January on Baroness Ritchie’s question relating to small platforms such as 8Chan; and in correspondence. However, the SI went through two Lords Committees “on the nod”, without any acknowledgement of the issues above, nor any additional scrutiny in light of concerns expressed to the Government in recent months.
• There was, however, significant opposition voiced by MPs at the Commons Third Delegated Legislation Committee on 4 February which both Wright and the SNP’s Kirsty Blackman MP attended. The transcript of that session is here. The regulations were passed 10:3, with the Lib Dems and UUP members voting against and Conservatives abstaining.

Ofcom’s advice

• Ofcom published its advice to the DSIT Secretary of State on categorisation in March last year. It disregarded the flexibility brought into the Act via the Morgan amendment and advised that regulations should be laid that brought only large platforms into category 1.
• The only mention it makes of the concession is as follows:
  • “We have discounted a recommendation that allowed for the categorisation of services by reference exclusively to functionalities and characteristics since the research indicates that user reach has an important role to play too. For instance, there are services where the functionalities and characteristics discussed above are core to the service, but whose smaller number base means that the dissemination of user-generated content on the service is comparatively less pronounced in its speed and breadth relative to other services with a greater number of users and the same functionalities.”
• Our analysis of the implications of that decision ishere.
• Since the publication of that advice in March 2024, there has been a concerted and coordinated civil society campaign to urge the Secretary of State to disregard Ofcom’s advice and ensure that small but risky platforms were included in category 1. Frequent questions were raised in Parliament, representations were made to DSIT at Ministerial and official level, andan open letter signed by the leaders of a number of suicide, mental health and anti-hate charities was sent to the Prime Minister in September.
• There was an exchange of letters between DSIT and Ofcom clarifying how the regulator intended to deal with “small but risky services” in September last year - Rt Hon Peter Kyle MP to Dame Melanie Dawes (10 September 2024); Dame Melanie Dawes to Rt Hon Peter Kyle MP (11 September 2024).

The Government’s position

• Since the draft regulations have been laid in Parliament, the Government has had to defend its reasons for accepting Ofcom’s advice - which fundamentally rests on Ofcom’s narrow interpretation of the Act. It is not clear whether the Government challenged Ofcom on this interpretation prior to laying the regulations, or whether the Secretary of State took this interpretation as read before asking (as per the correspondence above) for assurances on how Ofcom would otherwise address the harm from small, risky services. However, the Government’s public line - in the WMS which accompanied the draft regulations, in the Commons Committee debate and in a recent letter from Minister Jones to Lord Clement-Jones and other Peers - doubles down on Ofcom’s interpretation.
• The interpretation of Schedule 11 being put forward by the Government - and our response to it - is as follows:
  
  • Ofcom/Govt argument: The concept of “risk of harm to adults from certain types of priority content” (known as “legal but harmful”) was removed at Commons Report stage of the OSB and replaced with a requirement that the Secretary of State consider the impact of size and functionalities on how ‘easily, quickly and widely’ user-generated content is disseminated by means of a service.” The Secretary of State went so far as to say in his WMS that “this is the position of the Act”.
    Analysis: What this argument fails to make clear is that the precise wording in Schedule 11 is that the Secretary of State “must take account of” the likely impact of the number of users as well as functionalities; it is not the only aspect he can consider. As Wright said in the Delegated Legislation Committee debate: “Without doubt, therefore, the Secretary of State has to take the number of users into account, but it is not the only criterion. There is a fundamental misunderstanding — at least, I hope that is what it is—in the ministerial statement, which suggests that that is the only criterion to be considered. It is not, and I think it is a mistake to ignore the others”.
    
  • Ofcom/Govt argument: Based on the Act, Ofcom was required to carry out research on the factors set out in Schedule 11, including the “impact of user numbers and functionalities on how easily, quickly and widely” UGC is disseminated by the service which was provided to the Secretary of State.
    Analysis: As per the quote above, there was no research provided by Ofcom to the Secretary of State on the risks arising from small platforms, as provided for in the Act: their consideration started from the position that the wide dissemination of content was the primary criterion and that user reach was therefore the most important factor in this. They therefore “discounted” what they called a “recommendation”, even when it was written into statute based on wide Parliamentary support.
    
  • Ofcom/Govt argument: There was no legally robust or justifiable way of bringing smaller risky services into scope by setting a threshold requirement for functionality alone and “there would have been a material risk of capturing hundreds of smaller low-risk services”.
    Analysis: This argument clearly ignores the will of Parliament; the amendment was specifically supported because it would target the small number of small but risky services that are set up specifically to cause harm - whether that’s encouraging suicide, or targeting minorities with hate and abuse. For Ofcom to dismiss this approach as not being “legally robust or justifiable” - and to not provide a full explanation as to why they thought that was so in their advice to the Secretary of State, or to give them the option to take that course of action even if they as the regulator felt it ran counter to their cautious legal interpretation of the Act - is a derogation of their duty.
    
• Beyond the legal interpretation, Ofcom has put forward a number of further justifications for its position - repeated by the Government in its correspondence with Peers - which are not about the Act but about their implementation of it. These include:
  
  • Category 1 duties are about user empowerment: the users who gravitate towards these harmful sites do so because they are seeking them out so user empowerment and terms of service duties will have little impact.
    We would contend that it is not for Ofcom to make this judgement: it does not respect the will of Parliament that the regulator should be able to use all the powers available to it to address these small but risky sites. It is also a post-hoc justification of their position and was not included in the advice to the Secretary of State when they decided to ignore the “recommendation”.
    
  • It is unlikely that these small but risky sites will have terms of service that prohibit the harmful content that is of concern, nor is the publication of transparency reports likely to alter their operation.
    Again, this is not a judgement for Ofcom to make and speaks more about their lack of appetite for enforcement than the effectiveness of the duties written into the Act. As above, it is also a post-hoc justification of a position that was not set out when the advice was provided to the Secretary of State.
    
  • Small but risky sites will be caught by the illegal content duties and/or child protection duties: Ofcom will be able to enforce against them effectively through those routes.
    That may be so but, given the harm that these smaller services can do - and the fact that the nature of the harm they cause may fall beneath the criminal threshold - Ofcom are eschewing all the enforcement measures that they might possibly have had on the basis of a legal interpretation of the Act that is wrong. As Wright said in the Commons Committee, “Ofcom will not have all the tools it could have to deal with smaller services where greater harm may be concentrated, despite what the Act allows. I have to say that tying one hand behind Ofcom’s back is not sensible, even when Ofcom is itself asking us to do so. That is especially true when the Government place such heavy reliance on the Online Safety Act—as they are entitled to—to deal with the multiple online harms that arise.”
    
  • Ofcom has set up a “small but risky supervision taskforce”.
    As the WMS says, this “will use the tools available under the Act to identify, manage and enforce against such services where there is a failure to comply with the duties that all regulated services will be subject to.” As above, they will only have a limited range of duties against which they can enforce due to the decision to exclude these services from category 1 duties. No details of the taskforce have yet been published.
    
  • Getting on with implementation is the priority. There has been too much delay. These regulations need to go forward as they are to ensure the big platforms comply with category 1 duties asap.
    It is nearly a year since Ofcom submitted its advice to the previous Government. The current Government, in opposition, was well aware of the problems with Ofcom’s advice, particularly given that they argued so strongly - in both the Commons and the Lords - for the amendment which Morgan eventually won. The procrastinations over whether they had the political will to challenge it, which would have had the backing of Parliament, are the cause of the delay. Laying regulations which will not be effective at targeting the harm Parliament intended to be targeted - then having to wait years for them to be reviewed and revised - will itself mean unacceptable, ongoing delays for protections for some of the most vulnerable users.

Conclusion

The intention of Baroness Morgan’s amendment was to ensure that small sites dedicated to harm – for example, sites providing information on suicide and self-harm; sites like 4Chan or 8Chan that are set up to target abuse and hatred at minority groups; sites like Telegram which, during the riots in the summer, was one of the platforms on which far-right groups incited and organised violence; incel and misogynistic hate sites, etc – were subject to these fullest range of duties.

Ofcom has chosen to ignore this option in its advice to the Secretary of State and the Government has ignored the representations from civil society about the significant risk to UK users if they followed this advice.