It’s not just Big Tech caught in Online Safety Act crosshairs

Who would have thought ‘safety’ might be this government’s legacy? Whether it’s AI and its bid to be regulator-in-chief or its promise to make the UK “the safest place in the world to be online”, Rishi Sunak’s government has bounded eagerly into post-Brexit bureaucracy.

The landmark Online Safety Bill – legislation designed to put reins on the seemingly uncontrollable rise of illegal content and content harmful to children found online, such as revenge porn and hate speech – gained Royal Assent last month.

With Big Tech companies in the crosshairs of the new Online Safety Act, or OSA, it’s worth pausing a moment to consider how the implications will ricochet around the thousands of other businesses with sites or platforms with functionality that allows user-generated content to be shared between users (whether or not content is actually shared).

Some controversy has surrounded the Online Safety Act. On one side, there has been ideological debate around desires for a lighter regulatory touch post-Brexit. On the other side, there has been a determination to limit online freedoms that saw Big Tech players accused of negligence.

This was heightened in 2017 by the suicide of 14-year-old Molly Russell after she was exposed to self-harm and suicide-related posts on Instagram and other social media platforms. This led to an inquest and the publication of a coroner’s report in 2022, in which the platforms’ algorithms were cited as a contributing factor that led to Molly’s death.

As part of a promise to create a fairer, safer and more competitive online space for users and businesses, the Act focuses heavily on the big social media players, holding them responsible for the content they host in an attempt to tame the “Wild West”.

However, there will be a cost of compliance for small businesses and those looking to scale, which in turn could impact their competitive advantage. It is estimated that the Act will impact more than 25,000 tech companies including ‘user-to-user’ and ‘search’ services in the UK.

So, what will change and how can businesses be prepared?

Who will be affected by the Online Safety Act?

Although parts of the legislation will only apply to the Big Tech companies, other parts are far more wide-reaching. In addition to search engine operators and providers of internet services, any business that allows content to be generated, uploaded or shared by users on the service will need to brush up on its knowledge of the legislation – even if the offending content is not shared.

Not only do businesses that fall under this need to be aware of how the legislation affects them now, but they also need to look ahead to how it might impact them in the future as they continue to grow. Anticipating these impacts will not only help growth businesses manage the costs involved but also place them on the front foot for further regulation in the years to come.

While communications regulator Ofcom is set to issue guidance on how businesses should conduct risk assessments in the coming months, there are ways that SMEs and growing businesses can prepare. Businesses should start by assessing whether or not the functionalities of their platforms (existing or planned) put them within scope of the legislation. They should look at who can access their platform (could children access it and how likely is it that they will access it), to determine how onerous compliance with the Act may be.

Once this is ascertained, they can start preparing for necessary changes and putting appropriate processes in place to comply with the legislation, setting them up for when Ofcom releases its guidance.

As Ofcom starts to enforce the regulations, there will undoubtedly be businesses that get caught out and are accused of not complying properly. Keeping a paper trail of the risk assessments carried out and subsequent processes put in place, together with any changes planned or made to sites in the early stages will be key to demonstrating a company’s efforts to adhere to the laws. Equally, this will give investors and other stakeholders greater confidence, which could have a significant commercial impact.

More hoops to come

The OSA isn’t the only legislation that businesses need to be aware of and keep a close eye on. The UK Digital Markets, Competition and Consumers Bill (DMCC) might only be in the early stages of the legislative process, but it is set to receive Royal Assent next spring.

The DMCC will be another hoop for SMEs and scaling businesses to jump through with its new rules aiming to promote competition in the digital sector and stamp out unfair commercial practices. A key area of focus is how it will deal with the issue of “subscription traps”: where customers are lured in by a free trial or discounted fee but don’t get around to cancelling the service or have difficulty in doing so.

As a result, businesses that offer subscriptions will need to provide a long list of information about the subscription such as the length of the free trial, what customers must pay for when this ends and how the customer can end the contract before the end of the trial period.

Patchwork of legislation

Although one of the benefits of Brexit has been the UK’s ability to create its own legislation such as OSB, this doesn’t negate the fact that UK businesses operating in the EU also fall under EU digital legislation such as the EU Digital Services Act. Although there will be some overlap, they are not identical.

The OSA aims to mitigate and manage the risks of harm posed by “illegal content” and “content that is harmful to children”. There are areas, such as content that infringes intellectual property rights that are not dealt with by the Act but are covered by the EU Digital Services Act. Conflating both requirements that come under different legislation will therefore inevitably take up time and resources for businesses.

Although the UK is trying to make it easier for businesses to operate while still protecting consumers’ online space, in a global world, businesses can’t ignore EU legislation. For SMEs and scaling businesses, this patchwork of legislation can be challenging to navigate. Putting it off will likely make it even more challenging.

What’s next?

There will undoubtedly be some teething issues as SMEs and scaling businesses start to unpack what these legislative changes mean for them.

As the Online Safety Act gets into full swing, SMEs and scaling businesses need to take advantage of this time ahead of Ofcom’s guidance being issued and delve into business practices that might fall under the Act.

If businesses don’t start the process of complying early it will become harder to do so – as there will be more and more content to weed out on their platforms.

Eesheta Shah is partner at Marriott Harrison.