Online Safety Act may take years to have noticeable impact despite public’s high expectations

Committee calls on regulator to let members of public know outcome of complaints

Ofcom faces significant challenges in regulating overseas providers with much still to do to implement effective regulatory regime

Years may pass before the Online Safety Act (OSA) makes a noticeable difference to people’s online experience. In a report published today, the Public Accounts Committee (PAC) finds that regulator Ofcom has made a good start in preparing for its new role protecting citizens from online harm – but questions remain over how it will manage public expectations for what the regulatory regime will achieve, with the regulator unable to act on individual complaints and overseas providers in particular posing a significant challenge.

The inquiry heard that there could be 100,000+ service providers falling within Ofcom’s new scope, most of them small businesses and/or based overseas. Ensuring compliance for the vast majority of providers will rely on automated processes not yet in place, which the PAC calls on Ofcom to urgently finalise. The regulator also recognises that some providers may choose not to engage with it, or be hard to contact for many smaller overseas companies, and there is a lack of clarity over its planned approach in these cases.

Ofcom prepared well for its new responsibilities, and moved swiftly to implement the OSA when it became law in October 2023. But the PAC warns of potential public disappointment with the new regulatory regime, which will not be fully implemented until 2026, if people cannot quickly see improvements to their online experience or understand how complaints are acted on. With Ofcom able only to take action where there are systemic concerns about a service provider, the report recommends it develop a mechanism for letting people know what impact their complaint has had.

Once fully operational, the new regime is expected to be self-financing, with set-up and ongoing costs to be covered by fees levied on industry. However, the PAC’s inquiry heard that Ofcom has yet to establish the details of how the fee regime will work, with the report highlighting that Ofcom may not recover all its set-up costs until 2032-33.

While a lack of information was provided on the scale of fees for industry, Ofcom stated they will aim to be proportionate, fair and administratively effective, while recognising the challenge that more time may be spent regulating smaller and risky companies, which would be paid for by larger, more compliant companies.

Dame Meg Hillier MP, Chair of the Committee, said: “Expectations are understandably high for firm guardrails in the hitherto largely unregulated online world. We know that around two thirds of UK children and adults say they experienced at least one potential online harm in a month in 2022, according to Ofcom, which is to be commended for how swiftly it has moved to take on its new responsibilities.  It must now continue to be proactively frank with the public over what the Online Safety Act does and does not empower it to do, lest confidence in the new regime be swiftly undermined.

“Firm detail on how fees for industry, enforcement, automated monitoring and a range of other issues must now be locked in. No other country has introduced equivalent online safety regulation. Ofcom now needs to capitalise on its early progress. It must also accelerate its coordination with other regulators both at home and overseas, in the recognition that it is at the forefront of a truly global effort to strike the right balance between freedom and safety online.”

PAC report conclusions and recommendations  

It will take a long time for Ofcom to implement the regulatory regime in full and it is therefore crucial that it meets its interim deadlines on the priority areas of illegal harms and protecting children. Ofcom prepared well for its new role as online safety regulator and, following the Online Safety Bill becoming law in October 2023, moved swiftly to begin implementation. By the start of December 2023, it had begun consultation in two key areas (illegal harms and protecting children from pornography) and is planning to consult on another key area (protecting children more widely) early in the New Year. It has issued an updated roadmap, showing key stages for the regime’s implementation. However, Ofcom still has a lot to do to implement the regime in full and achieve the government’s aim of making the UK the safest place in the world to be online. At the time we took evidence last December, Ofcom had only issued approximately 10 of the 54 documents it needs to produce to implement the regime, and full implementation has slipped by a year from 2025 to 2026. The Act requires Ofcom to have its regulatory regime in place for two key areas (illegal harms and protecting children) within 18 months of the Bill becoming law (that is, by April 2025). While Ofcom thinks this timeframe is achievable, it considers it the bare minimum time required to deliver this regulation, so there are risks.

Recommendation 1: Ofcom must meet its deadline to introduce codes of practice in the two priority areas of illegal harms and protecting children within 18 months of the Online Safety Bill becoming law.

The public may be disappointed with the new regime if people cannot quickly see improvements to their online experience or understand how their complaints are acted on. As the regulatory regime will not be fully implemented until 2026, there is a risk that public confidence in the regime will be undermined if it does not quickly bring about tangible changes to people’s online experience. A key mechanism for instilling confidence would be if people could see that their complaints were acted on. Individuals must complain in the first instance to service providers. Ofcom will set out how it expects service providers to handle complaints, including communicating effectively with the user, but it has no powers to require providers to act on the complaints. Individuals can then complain to Ofcom if they remain concerned. Ofcom has set up a contact centre to receive such complaints, but it is not able to act on them individually. Instead, Ofcom will review complaints alongside its normal monitoring data to decide if it needs to take further action where there are systemic concerns about a service provider. Where Ofcom does act, it does not currently have a mechanism for feeding back directly to individuals on what impact their complaint has had.

Recommendation 2: Ofcom needs to develop mechanisms to provide feedback to complainants, particularly where this has contributed to Ofcom taking action against a service provider. 

Ofcom lacks clarity about how it will identify and respond to non-compliance and when to use its enforcement powers. Ofcom estimates that there could be 100,000 or more service providers subject to regulation, with most of these being small businesses and / or based overseas. Ofcom will rely on automated processes to identify and collect monitoring data on the compliance of the vast majority of service providers, but does not have these processes in place yet. Where non-compliance issues arise, Ofcom will engage with service providers to encourage their compliance. This approach has already had some success, when, following recent news stories about a website promoting suicide, Ofcom contacted its overseas provider which then agreed to block access to the site for UK users. However, Ofcom recognises some providers may choose not to engage, and it may prove difficult to contact the many smaller, overseas companies. Where engagement fails, Ofcom has a range of enforcement powers, including fines of up to 10% of a company’s global revenue and business disruption measures. These enforcement powers will only come into effect in stages as the regime is implemented, and Ofcom has already begun to consult on its approach to using these powers.

Recommendation 3: Ofcom should urgently finalise its automated compliance monitoring systems and clarify its enforcement approach with service providers where engagement has not proved possible.

Ofcom has yet to work through the detail of how fees levied on industry will work, including how it will recover the set-up costs and cover the ongoing costs of the regime. Delays to the Online Safety Bill’s passage through parliament mean that introduction of the fee regime has been pushed back from 2025-26. Fees will begin in 2026-27, covering Ofcom’s ongoing costs, with recovery of set-up costs starting in 2027-28. Until the fee regime starts, Ofcom’s costs for online safety will be met from existing arrangements whereby costs are funded from Wireless Telegraphy Act 2006 receipts which would have otherwise gone to the Exchequer. Ofcom has yet to establish the details of how the fee regime will operate, such as the payment thresholds, fee structure and period for recovery of set-up costs. Establishing details of the regime is set to take some time and Ofcom may not recover all its set-up costs until 2032-33. In establishing the fee regime, Ofcom aims to balance competing objectives of fairness and proportionality, administrative efficiency, and recovery of costs-only. It also plans to provide transparency to industry about the annual fees.

Recommendation 4: As part of its Treasury Minute response to this report, Ofcom should set out:

• The modelling it plans to undertake on the fee regime;
• How it will transparently report on its approach to the fee regime; and
• How it will transition from the current funding regime to a self-financing model.

Effective regulation will require Ofcom and the Department to sustain the skills and people they need in a fast-moving and highly technical sector. To date, Ofcom has successfully recruited the skills it requires, recruiting people from industry and a wide variety of other sources. This has increased Ofcom’s headcount by nearly 50%. Ofcom has taken the opportunity to reshape itself more widely and is recruiting non-executive directors to ensure its board is appropriately diverse with relevant technical and online safety expertise to provide effective oversight and challenge. Ofcom has already experienced staff turnover, with some staff returning to industry, but is confident in its ability to attract the necessary talent. The Department recognises that it also needs staff with the right skills in this area, and that it needs to be constantly evolving its own capabilities to deal with the risks and opportunities arising from the fast-changing landscape of online harms.

Recommendation 5: Both the Department and Ofcom need to determine how often they should undertake regular skills audits to identify gaps, including at senior and board level, to ensure that they continue to have the right people with the right skills in place. They should complete an initial audit within the first year following the Online Safety Bill becoming law.

The long-term success of the regime depends on Ofcom continuing to learn from international engagement and regular evaluation. No other country has introduced online safety regulation of an equivalent scale. Ofcom has engaged with UK and overseas regulators, and it sees the development of these relationships as crucial to the regime’s future success. In 2022, for example, Ofcom helped establish a global network of online safety regulators, which has helped it better understand and respond to the emerging harm of sextortion (sex-based blackmail). The Department and Ofcom also recognise the role evaluation will play in ensuring the regime’s future success. They both have evaluation plans in place (Ofcom reviewing the effectiveness of its measures and the Department assessing the effectiveness of the regime) and are working together to implement these. However, Ofcom has yet to finalise its metrics to measure performance and the Department has key gaps in its evidence base. Evaluation will also be challenging owing to the nature of the regulated harms, the fast-changing technology landscape and the lack of equivalent regimes in other countries.

Recommendation 6: Ofcom and the Department should accelerate their work on evaluating the regime and collaborating with other regulators (both UK- and overseas-based), so they can identify emerging risks and better understand how regulation is working, including identifying the most effective solutions.