Recommendation 12

HM Government · verbatim extract Accepted

The government is committed to ensuring that individuals have a say over the content they are presented by recommendation algorithms and in how their personal data is processed. While no single piece of UK legislation provides a specific ‘right to reset’ as recommended by the Committee and we would not want to be overly prescriptive in how organisations engage with their end users, the government believes that there are existing powers and protections that collectively deliver a proportionate approach to the Committee’s objective. Whilst the OSA does not seek to restrict adult users’ access to legal content, it will require regulated services to have clear and accessible Terms of Service (ToS). Where the ToS of Category 1 services, set out what kinds of legal content for adults they don’t accept on their platforms, they are required to apply these terms consistently and transparently so that adult users can have greater assurance of the kind of experience they will have on a service. Category 1 services are also required to offer adult users, at the earliest possible opportunity, optional and proportionate “easy to access” features. These features, if applied, will limit their engagement with certain types of legal content, including that which encourages suicide, self-harm or eating disorders, and material that is abusive or incites hate based on certain protected characteristics. These services must include clear and accessible provisions in their terms of service specifying which control features are offered and how adult users may take advantage of them. These duties are designed to empower adult users to have more autonomy over their online experience, and we expect them to be in effect from early-mid 2027. Ofcom is the independent regulator of the OSA and can take robust enforcement action against those failing to fulfil their duties, including issuing large fines and business disruption measures. On top of these duties, the OSA will deliver greater platform accountability and trust through its transparency framework. Ofcom must require Category 1, 2A and 2B services to publish annual transparency reports. The contents of the reports is at Ofcom’s discretion but can include information about the platform’s algorithms. These reports will be made public, enabling users to make informed decisions and keep providers accountable. The OSA also provides Ofcom with a robust suite of information gathering powers which will help ensure it can access the information it needs to understand how companies are fulfilling their duties. Under these powers, Ofcom can require the provider to conduct an empirical test or demonstration, to observe how the algorithms function in practice. These powers should help Ofcom and members of the public to understand how platform algorithms work, enabling more informed decision making and protective actions. In addition to the OSA, UK data protection legislation provides individuals with a range of specific rights in relation to their personal data. These rights enable individuals to have a degree of control over how their personal data is used and, in some cases, could help users control their recommendation algorithms and content promoted to them by online services. For instance, the UK GDPR gives individuals the right to object to the processing of their personal data in certain circumstances. This right could be exercised by individuals, in some scenarios, to stop social media platforms from using their personal data to develop content recommendation algorithms. For example, an individual has the right to object to the processing of their personal data for direct marketing purposes, such as online advertising that is targeted to a particular user (e.g. based on browsing history, purchase history or login information). Furthermore, an individual may also be able to exercise their ‘right to erasure’ (also known as the ‘right to be forgotten’) to have personal data erased by online services. If applicable, individuals could use this right to request that their personal data used in content recommendation, such as browser history or behavioural data, be deleted by an online service. While the UK’s data protection framework does not provide individuals with a specific ‘right to reset’, these existing rights do give users meaningful control over how their personal data is used to personalise content. When taken together, the OSA and UK GDPR provide citizens with significant influence over how recommendation algorithms affect them.