This explainer by Professor Lorna Woods, Professor of Internet Law at the University of Essex and expert adviser to the OSA Network, considers the concept of safety by design in the Online Safety Act (OSA). It is also available to download as a PDF below. It covers: What the OSA says Current thinking on “by design” obligations The specifics of other “by design” approaches, including “Privacy by Design” and “Security by Design” Existing “Safety by Design” principles How these approaches and principles apply to the interpretation of “safety by design” in the OSA The Online Safety Act: section 1 (3)

Background The tragic murder of three children – and injuries to many more – stabbed by a 17-year-old attacker at a summer holiday dance class in Southport on 29th July has been the trigger for riots and public disorder in towns and cities in the UK. Initial violence in Southport, London and Manchester was whipped up by mis and disinformation spread on social media, particularly on X, about the identity and background of the attacker with far-right groups then using a variety of platforms to organise the riots. (Analysis from Hope Not Hate provides useful context for these initial disturbances, with a report from ISD containing further detail, while the BBC reporter Marianna Spring looked specifically at the role of social media.)

Media coverage over the last year has detailed the presence of a number of forums accessible from the UK and the tragic fact that a number of individuals, many of whom were children, have taken their own lives based on information or encouragement from these sites, or by using substances sourced online. Many, if not all of these sites, are small and based overseas. In this explainer, we consider whether the Online Safety Act improves the ability of Ofcom to take action against these sites. We consider:

The second phase of Ofcom’s major consultation programme to inform their implementation of the Online Safety Act focuses on the duties to protect children. In this explainer, Prof Lorna Woods and Dr Alexandros Antoniou set out what these duties are and what they require from regulated services in response. A PDF copy of this explainer is available to download at the bottom of the page. Overview User-to-user services and search services are subject to duties in relation to content harmful to children under the Online Safety Act (OSA), but only when those services “are likely to be accessed by children” (s 7(4) OSA, repeated in ss 11(1), 12(1), 28(1) and 29(1); see alsoExplanatory Notes (EN), paras 222 and 227). All providers of a Part 3 service must carry out a “children’s access assessment” (ss 35-36) to determine whether they are services to which children’s safety duties apply. If so, user-to-user and search services must comply with the relevant risk assessment and safety duties. These obligations depend on Ofcom producing guidance and codes of practice (s 41). The consultation on these codes and guidance is due to be published by Ofcom on 8 May.

The Online Safety Act sets out Ofcom’s enforcement powers in Chapter Six (Sections 130-151). Ofcom recently consulted on its approach to enforcement and the proposed draft guidance as part of its consultation on illegal harms. In Volume 6 (Information gathering and enforcement powers and approach to supervision), the regulator says: “Ofcom’s general approach to enforcement is guided by our regulatory principles. We operate with a bias against intervention but with a willingness to intervene promptly and effectively when required. We will always seek the least intrusive regulatory methods to achieve our objectives and will strive to ensure that interventions are evidence-based, proportionate, consistent, accountable and transparent in both deliberation and outcome. These regulatory principles will also apply to online safety enforcement.” (Volume 6, 29.3)

Under the Online Safety Act 2023 (OSA), Ofcom is required to prepare and issue Codes of Practice (CoP) for Part 3 service providers (U2U and search services), setting out measures recommended for compliance with specified duties, bearing in mind the principles in Schedule 4. The CoPs relate to the design, operation and use of services in the UK (or as they affect UK users of the service) but apply to providers of such services regardless of whether or not they are inside the UK.

The first phase of Ofcom’s consultations on implementing the Online Safety Act focuses on the illegal content duties. In this explainer, Prof Lorna Woods and Dr Alexandros Antoniou set out what these duties do in relation to search services and what they require from regulated services in response. A complementary explainer is available on how the illegal content duties apply to user-to-user services. There are three types of duty for search services relating to illegal content:

The first phase of Ofcom’s consultations on implementing the Online Safety Act focuses on the illegal content duties as they apply to user-to-user services. In this explainer, Prof Lorna Woods and Dr Alexandros Antoniou set out what these duties do and what they require from regulated services in response. A complementary explainer is available on how the illegal content duties apply to search services. There are three types of duty for user-to-user (U2U) services relating to illegal content:

The Online Safety Act’s illegal content duties apply to offences, defined as “priority illegal content” that are contained in Schedule 5 (terrorism offences), Schedule 6 (child sexual abuse offences) and Schedule 7 (a range of other offences). The PDF below provides links to the legislation that underpins those individual offences and, where applicable, Crown Prosecution Guidance on the offence.

The Online Safety Bill completed its Parliamentary passage in September 2023 and was granted Royal Assent on 26 October 2023. The Online Safety Act 2023 sets out a broad, if complex, framework for regulation. Many of the provisions came into force as soon as the Act was passed (see our Commencement explainer here); it will be for Ofcom – as the designated regulator – to then fill in the detail of the implementation regime through a swathe of consultations, including risk assessments, codes of practice and guidance. Ofcom have set out how they intend to do this, with a three-phase consultation process starting in November 2023.