Online Safety Bill – are you caught?

Auteur

Louise Popple

Senior Counsel – Knowledge

Londres

What has happened?

The Online Safety Bill (OSB) is the UK's attempt to regulate the safety of users online. It imposes a statutory duty of care on certain online service providers to protect their users from specified harms. A first draft of the Bill was published in May 2021, building on the Online Harms White Paper that had gone before it. Now, a revised draft of the Bill has been introduced into Parliament.

The major change in terms of who is in scope is that providers of pornographic content are now subject to various obligations under the Bill. There are also a number of other less significant amendments which add clarity. Otherwise, the revised Bill does not significantly alter the position - as with the previous draft, a very broad range of online service providers are caught. In particular:

The OSB continues to apply to any service that enables content generated, uploaded or shared by one user to be encountered by another user (user-to-user services) or that allows users to search more than one website or database (search services).
The definitions remain broad. It is not just online platforms and search engines that are within scope. Any service that allows one user to encounter content from another user will potentially be caught, even if that content is a 'one-off' or short lived. The term "users" is potentially wide and goes beyond mere consumers and end-users. Websites, apps and other software are covered, as are public and private channels. The exemptions for eg 'below the line' content are drafted narrowly and won't always apply.

A careful review of all online content and services provided should therefore be undertaken to determine if any falls within the scope of the Bill.

In this article, we discuss who is in scope of the revised Bill (with the exception of the providers of pornographic content, which are not discussed). Since the duties imposed by the OSB apply to any "user-to-user service" or "search service" that has "links with the UK" and is not "exempt", we discuss what each of these terms means in practice. First, however, we briefly list the changes to who is in scope introduced by the revised Bill.

Changes to scope in the revised Bill

Notable changes in terms of who is in scope (in the revised Bill compared to the original version) are as follows:

Providers of pornographic content are now subject to various obligations under the Bill.
Where content is generated by a user of a service, that content must now be generated by the user "directly on the service" to fall within the definition of a user-to-user service. This is helpful clarification. It means that content generated by a user but uploaded by the service provider itself is no longer covered. That will be a relief to many service providers (especially as the definition of a "user" is potentially quite broad).
There are new provisions which determine whether a user-to-user service which contains a search engine is to be classified as a user-to-user service or a search service, as well as various provisions around "combined" services (any user-to-user service that which contains a public search engine).
There are new provisions and exemptions relating to services provided by persons providing education or childcare.
There are clarifications relating to "identifying information" (content the function of which is to identify a user of an internet service, for example, a user name or profile picture).
While outside the scope of this article, it is also worth mentioning at this point that the revised Bill introduces a new legal duty which requires the largest user-to-user services and search services (ie social media platforms and search engines) to take steps to prevent fraudulent paid-for advertising from appearing on their services. See here for more.

User-to-user services

The definition of a user-to-user service is now any "internet service by means of which content that is generated directly on the service by a user of the service or uploaded to or shared on the service by a user of the service, may be encountered by another user, or users, of the service" (words in italics added by the revised draft). The definition remains very broad. In particular:

An internet service is a service made available by means of the internet or a combination of the internet and an electronic communications service. It therefore covers websites, apps and other software. The fact that payment or subscription is required for such a service is irrelevant.
Content means anything that can be communicated by means of an internet service, including written materials or messages, oral communications, photographs, videos, visual images, music and data of any description. Webcam footage is therefore content (see government guidance), as is location information, and clicking on an emoji. Identifying information is now largely excluded. Both public and private channels are covered (see government guidance).
Any one act performed by a user – generating (directly on the site), uploading or sharing – suffices. This means that content uploaded/shared by a user irrespective of who generated that content is potentially within scope. This should be kept in mind when auditing online content to determine whether the OSB applies. Helpfully, the revised draft makes clear that content generated by a user but uploaded by the service provider itself is not now covered; the generating has to occur directly on the site.
The definition applies to content generated, uploaded or shared by a "user". However, there is no definition of "user". Instead, the OSB defines who are not users. These are any of the following when acting in the course of the provider's business: where the provider is an individual(s), that/those individual(s); where the provider is an entity, any officer(s) of, and anyone who works for, the provider; and any other person(s) providing a business service to the provider, such as a contractor, consultant or auditor. Everyone else appears to be a user. There is likely to be much debate about whether a person is "providing a business service to the provider" and is therefore exempt. Arguably, a variety of third parties could fall within this exemption but the inclusion of contractors, consultants and auditors as examples might suggest that it will be interpreted narrowly. Understanding the scope of this exemption will be important for many providers, most obviously listings websites and repositories.
The requirement is that the user-generated content "may" be encountered by at least one other user – it does not have to be encountered in fact. "Encountered" is drafted broadly and includes reading, viewing, hearing or otherwise experiencing the content. It therefore incudes such things as one user watching another user play a video game. Content can be encountered if it is capable of being shared with another user by operation of a functionality of the service (such as a private messaging function). The fact that content may be available for a limited period of time only is irrelevant.
It does not matter what proportion of content or a service falls within the definition of a user-to-user service – there is no de minimis requirement.

It should be clear from the above that a number of services and functionalities will fall within the definition of a user-to-user service. At its extreme, the OSB potentially catches a one-off online video presentation by one user to another. A careful review of online content should therefore be undertaken.

Search services

A search service is now defined as any "internet service that is or includes a search engine". In the previous draft, a service was a search service if it fell within this definition and was not a user-to-user service. Under the new draft, there are provisions to help determine whether a user-to-user service which contains a search engine is to be classified as a user-to-user service or a search service and various provisions around combined services (any user-to-user service that contain a public search engine).

The following should be noted about the definition of a search service:

The definition of what is a search engine is quite broad and effectively includes any service or functionality that allows a user to search more than one website or database. Searching can be by any means including by input of text or images or speech. Examples of "searching" in the government guidance include typing search terms into a search box, reading through a list of contents and using tags or meta data to filter content.
Although not apparent from the definition of a search service, the duties imposed by the OSB appear only to apply to "regulated content" that may be encountered in or via search results, not other forms of content. This includes regulated content encountered as a result of interacting with search results or paid-for advertisements (for example, by clicking on them). However, it does not include regulated content encountered as a result of subsequent interactions with an internet service other than the search service.
A search engine is not to be taken to be "included" in an internet service or a user-to-user service if the search engine is controlled by a person who does not control other parts of the service.

The government says that offering search functionality can make it easier for people actively to seek out and find harmful content and can also present harmful content to people who are not actively seeking it. This is why search services have been included in the OSB. However, the OSB goes beyond large search engines. For example, a facility offered by a provider that allows a user to search two databases would be caught (assuming those databases contain user-generated content).

Regulated services

A user-to-user service is a "regulated user-to-user service" and a search service is a "regulated search service" if the service has "links with the UK" and is not "exempt". We consider these terms next.

Links with the UK

The legislation has wide extra-territorial application. To be caught, a user-to-user service or search service must have links with the UK. A service has links with the UK if:

it has a significant number of UK users, or
UK users form one or the only target market for the service, or
it is capable of being used in the UK by individuals and there are reasonable grounds to believe that there is a material risk of significant harm to individuals in the UK from user-generated content present (user-to-user services) or search content of the service (search services).

There is no indication of what constitutes a significant number of users. Whether a service targets the UK ought to be easier to determine given guidance on targeting in other areas of law (such as trade mark law).

Exempt services

The following services are exempt:

Any user-to-user service where the only user-generated content (other than an "identifying content") enabled by the service is emails, SMS messages, MMS messages or a combination of SMS and MMS messages.
Any user-to-user service with limited functionalities. Effectively, these are services where users are only able to communicate by posting comments or reviews on content published by the provider itself (or a person on its behalf) – so-called 'below-the-line' content. Sharing such comments or reviews on a different internet service or expressing views on such comments or reviews or on the content published by the provider itself by various specified means (such as by 'like' or 'dislike' buttons or applying emojis) is also exempt. Producing or displaying "identifying content" in relation to any of these categories is also exempt.
Any user-to-user service where the only user-generated content enabled by the service (other than identifying content) is one-to-one live aural communications. The communication must consist solely of real time speech or other sounds between two users of the service by means of the service. If other content, such as written messages, videos or visual images are included, the exemption does not apply. However, "identifying content" is now acceptable.
Any user-to-user service or search service provided by public bodies exercising their public functions.
Any user-to-user service and search service comprising certain internal business resources or tools. This means that most internal message boards and search engines for employees and officers of the provider are exempt.

Services which only have combinations of the above exemptions are also largely exempt. It is worth adding that the OSB does not apply to a "part" of any user-to-user service or search service in certain circumstances (largely, if that part falls within any of the exemptions or combinations of exemptions mentioned above and does not publish or display any regulated provider pornographic content). Services are not exempt if regulated provider pornographic content is published or displayed on the service and the service has links with the UK.

The exemptions are drafted very tightly and should be reviewed on a case-by-case basis to determine whether or not they apply. The Secretary of State has power to add additional categories of services to the list of exempted services if they consider that the risk of harm to individuals in the UK presented by such services is low. They also have power to remove limited functionality services and one-to-one live aural communications from the list of exempted services.

Wide application

As well as search engines, content-sharing platforms, social media platforms, blogs, forums, listings sites, and aggregators, any provider that allows one user to encounter content from another user will potentially be caught. This includes content from a wide variety of "users" not just consumers or end-users. Furthermore, a wide variety of search services and functionalities are covered. The OSB therefore has wide application and any online presence will need to be evaluated to determine whether it is in scope.