Preparedness for online safety regulation

The public may be disappointed with the new regime if people cannot quickly see improvements to their online experience or understand how their complaints are acted on. As the regulatory regime will not be fully implemented until 2026, there is a risk that public confidence in the regime will be undermined if it does not quickly bring about tangible changes to people’s online experience. A key mechanism for instilling confidence would be if people could see that their complaints were acted on. Individuals must complain in the first instance to service providers. Ofcom will set out how it expects service providers to handle complaints, including communicating effectively with the user, but it has no powers to require providers to act on the complaints. Individuals can then complain to Ofcom if they remain concerned. Ofcom has set up a contact centre to receive such complaints, but it is not able to act on them individually. Instead, Ofcom will review complaints alongside its normal monitoring data to decide if it needs to take further action where there are systemic concerns about a service provider. Where Ofcom does act, it does not currently have a mechanism for feeding back directly to individuals on what impact their complaint has had. Recommendation 2: Ofcom needs to develop mechanisms to provide feedback to complainants, particularly where this has contributed to Ofcom taking action against a service provider.

Ofcom lacks clarity about how it will identify and respond to non-compliance and when to use its enforcement powers. Ofcom estimates that there could be 100,000 or more service providers subject to regulation, with most of these being small businesses and / or based overseas. Ofcom will rely on automated processes 6 Preparedness for online safety regulation to identify and collect monitoring data on the compliance of the vast majority of service providers, but does not have these processes in place yet. Where non- compliance issues arise, Ofcom will engage with service providers to encourage their compliance. This approach has already had some success, when, following recent news stories about a website promoting suicide, Ofcom contacted its overseas provider which then agreed to block access to the site for UK users. However, Ofcom recognises some providers may choose not to engage, and it may prove difficult to contact the many smaller, overseas companies. Where engagement fails, Ofcom has a range of enforcement powers, including fines of up to 10% of a company’s global revenue and business disruption measures. These enforcement powers will only come into effect in stages as the regime is implemented, and Ofcom has already begun to consult on its approach to using these powers. Recommendation 3: Ofcom should urgently finalise its automated compliance monitoring systems and clarify its enforcement approach with service providers where engagement has not proved possible.

Ofcom has yet to work through the detail of how fees levied on industry will work, including how it will recover the set-up costs and cover the ongoing costs of the regime. Delays to the Online Safety Bill’s passage through parliament mean that introduction of the fee regime has been pushed back from 2025–26. Fees will begin in 2026–27, covering Ofcom’s ongoing costs, with recovery of set-up costs starting in 2027–28. Until the fee regime starts, Ofcom’s costs for online safety will be met from existing arrangements whereby costs are funded from Wireless Telegraphy Act 2006 receipts which would have otherwise gone to the Exchequer. Ofcom has yet to establish the details of how the fee regime will operate, such as the payment thresholds, fee structure and period for recovery of set-up costs. Establishing details of the regime is set to take some time and Ofcom may not recover all its set-up costs until 2032–33. In establishing the fee regime, Ofcom aims to balance competing objectives of fairness and proportionality, administrative efficiency, and recovery of costs-only. It also plans to provide transparency to industry about the annual fees. Recommendation 4: As part of its Treasury Minute response to this report, Ofcom should set out: • The modelling it plans to undertake on the fee regime; • How it will transparently report on its approach to the fee regime; and • How it will transition from the current funding regime to a self-financing model.

Effective regulation will require Ofcom and the Department to sustain the skills and people they need in a fast-moving and highly technical sector. To date, Ofcom has successfully recruited the skills it requires, recruiting people from industry and a wide variety of other sources. This has increased Ofcom’s headcount by nearly 50%. Ofcom has taken the opportunity to reshape itself more widely and is recruiting non-executive directors to ensure its board is appropriately diverse with relevant technical and online safety expertise to provide effective oversight and challenge. Ofcom has already experienced staff turnover, with some staff returning to industry, but is confident in its ability to attract the necessary talent. Preparedness for online safety regulation 7 The Department recognises that it also needs staff with the right skills in this area, and that it needs to be constantly evolving its own capabilities to deal with the risks and opportunities arising from the fast-changing landscape of online harms. Recommendation 5: Both the Department and Ofcom need to determine how often they should undertake regular skills audits to identify gaps, including at senior and board level, to ensure that they continue to have the right people with the right skills in place. They should complete an initial audit within the first year following the Online Safety Bill becoming law.

The long-term success of the regime depends on Ofcom continuing to learn from international engagement and regular evaluation. No other country has introduced online safety regulation of an equivalent scale. Ofcom has engaged with UK and overseas regulators, and it sees the development of these relationships as crucial to the regime’s future success. In 2022, for example, Ofcom helped establish a global network of online safety regulators, which has helped it better understand and respond to the emerging harm of sextortion (sex-based blackmail). The Department and Ofcom also recognise the role evaluation will play in ensuring the regime’s future success. They both have evaluation plans in place (Ofcom reviewing the effectiveness of its measures and the Department assessing the effectiveness of the regime) and are working together to implement these. However, Ofcom has yet to finalise its metrics to measure performance and the Department has key gaps in its evidence base. Evaluation will also be challenging owing to the nature of the regulated harms, the fast-changing technology landscape and the lack of equivalent regimes in other countries. Recommendation 6: Ofcom and the Department should accelerate their work on evaluating the regime and collaborating with other regulators (both UK- and overseas-based), so they can identify emerging risks and better understand how regulation is working, including identifying the most effective solutions. 8 Preparedness for online safety regulation 1 Delivering the full regulatory regime

On the basis of a report by the Comptroller and Auditor General, we took evidence from the Department for Science, Innovation and Technology (the Department) and Ofcom about preparedness for online safety regulation.1

As part of its implementation of the regime, and before the regime can take real effect, Ofcom will have to produce 54 documents setting out different parts of the regulations, including formal codes of practice and guidance for regulated service providers, risk registers and pieces of research. At the time we took evidence Ofcom had so far produced 10 of these documents.9

Ofcom has been preparing for its new regulatory role since 2020 when the government confirmed its decision to appoint Ofcom as the regulator for online safety.10 Ofcom told us that there was no regulation of comparable scale and ambition, and that it therefore had to start from scratch in 2020. Both the scope and the timetable of the Bill changed significantly during its passage through Parliament.11 For example, in March 2022, the government removed previously core duties to tackle legal but harmful content.12 We questioned Ofcom about the impact the changes in scope and delays to the expected Bill timetable had on its preparation. Ofcom responded that, although it had been challenging for it to stay on track, the extra time had been quite helpful as it enabled it to progress its preparations and to move swiftly after the Bill became law. The Department and Ofcom both told us that they had had a close and collaborative relationship during this set-up period in order to be as ready as they could be on the day after the Bill received Royal Assent.13 Handling complaints

The Act requires all regulated service providers to put procedures in place for handling complaints from users and affected people about potentially harmful content.14 Ofcom will set out, through its codes of practice, how it expects service providers to handle such individual complaints. Its expectations include that it is easy for people to complain about particular pieces of content, and that service providers communicate effectively with the complainant and take action when the complaint is justified.15

Ofcom itself is only required to consider complaints from organisations about systemic issues arising from a service provider and impacting on online safety. It has no specific powers to take action, or compel regulated service providers to take action, on individual pieces of content or to get providers to offer redress to individual users on a case-by-case basis.16 Ofcom explained that the scale of potentially harmful, online material would make it impossible for it to respond to individual complaints and it must, 8 Q 9 9 Q 42; C&AG’s Report, para 1.12 10 C&AG’s Report, para 3 11 Q 4; C&AG’s Report, para 1.8 12 C&AG’s Report, para 1.8, figure 4 13 Qq 4, 6 14 C&AG’s Report, para 1.16 15 Q 26 16 Q 26; C&AG’s Report, para 1.16 10 Preparedness for online safety regulation instead, rely on service providers to have appropriate systems and processes to take action on complaints. It told us that Facebook alone moderates hundreds of thousands of items every hour.17

Ofcom told us that, while it is not able or resourced to act on individual complaints, its contact centre will be set up so people are able to submit complaints to Ofcom. Ofcom explained that this would provide a valuable source of data for itself, alongside other data, informing its triage process of harmful websites and helping it to identify emerging harms and to determine whether action would be taken.18

In other areas of Ofcom’s regulation, such as broadcasting, Ofcom can take action over complaints about individual programmes. We asked Ofcom how it will manage public expectation, including the risk of disappointment that people cannot complain to Ofcom about individual pieces of online content and the risk of frustration people might feel if they cannot see action being taken. Ofcom told us that it will be transparent about its work, including, where appropriate, publishing updates on compliance and enforcement action.19 Ofcom has also developed a communications strategy for managing people’s expectations and addressing misunderstandings about its roles.20 However, Ofcom stated that it did not currently have a system for relating action it subsequently took back to individual complaints from the public and did not think this would be straightforward to implement. Ofcom recognised the importance of a feedback loop to the public and said it would think about explaining how its work relates to public concerns.21 Monitoring and enforcing compliance

As the regulator for online safety, Ofcom will need to monitor the compliance of over 100,000 service providers, who target the UK market or have a significant number of UK users, and that fall within the scope of the regulation. The majority of regulated service providers will be based overseas and will not have been regulated by Ofcom before. The largest and riskiest service providers will be subject to detailed, one-to-one supervision.22 Ofcom expects around 40 companies will be supervised in this way and it has established a supervision team for this purpose.23 It also said that it had information-gathering powers and would issue requests for information to service providers, co-ordinating these requests carefully to prioritise the information required and take account of the burden on providers.24

For the non-supervised service providers, Ofcom will monitor their compliance through automated data collection and analysis processes, supported by information from partner organisations that deal with the various harms. Ofcom told us that it has yet to develop the automated systems, but that it hopes the systems will provide an early warning system and enable it to spot emerging risks.25 Ofcom did not plan to ask large numbers of smaller companies for information at this stage, because it considered that 17 Q 28 18 Qq 26–28 19 Qq 28, 30, 31, 68 20 C&AG’s Report, para 1.16 21 Q 31 22 Q 16; C&AG’s Report, paras 14, 3.11 23 Q 44 24 Q 15 25 Qq 23, 48, 49: C&AG’s Report, para 3.12 Preparedness for online safety regulation 11 would not be proportionate.26 It recognised that, in an area where there has not been regulation before, this change is going to increase costs overall across the industry, and said it would therefore do everything it could to make the burden of compliance manageable and proportionate.27 It was also conscious of the need for it to manage carefully the risk that its regulation could prohibit the emergence of new players and innovation.28

Ofcom explained that, where non-compliance issues arise, it will approach services with an engagement-first attitude and would not normally move straight to enforcement. It described a recent example of its engagement with an overseas-based website about how to commit suicide.29 Following Ofcom’s engagement, UK users are now blocked from the website. Nonetheless, Ofcom recognised that it might be difficult to work with small, overseas companies that do not engage, and that, in these circumstances, and if there was a serious risk, it would probably need to take enforcement action.30

Ofcom cannot undertake enforcement action until the codes of practice are published and, in some instances, set before parliament.31 Ofcom plans to publish its first codes, on illegal harms and protecting children, within 18 months of the Bill becoming law (April 2025).32 We asked Ofcom how it plans to reduce online harms and prepare service providers for regulation before the codes become enforceable.33 Ofcom responded that the consultation documents on its various codes of practice and guidance for service providers will set out practical steps which providers can take now to protect users before their duties become fully enforceable .34 It had also set up its supervision team and begun engaging with the supervised service providers to encourage these to start to comply in the short- to medium- term before their statutory duties become enforceable, and to make its expectations very clear.35

Ofcom told us that it had undertaken a similar approach in its regulation of video- sharing platforms from November 2020. It had worked with pornography providers, some of whom had, as a result, introduced age estimation techniques. However, there had been a cluster of smaller companies that had not been so compliant, and Ofcom had therefore started a compliance programme on these at the beginning of 2023. As a result, these too were now moving to put in place the kinds of age verification Ofcom was asking for. Ofcom noted that, even when its powers are enforceable, it does take time to achieve change as some companies will move faster than others.36

The enforcement action Ofcom can take on online safety regulation includes: fines of up to 10% of global revenues; requirements on the service provider to make changes; business disruption measures that prevent them from accessing the UK market; and criminal sanctions.37 Ofcom explained that any action it takes can be judicially reviewed 26 Q 15 27 Qq 19, 20 28 Q 72; C&AG’s Report, para 3.16 29 Q 25 30 Qq 25, 27, 55 31 Q 51; C&AG’s Report, para 1.14 32 Qq 24, 44, 51 33 Qq 44, 51 34 Qq 24, 52 35 Qq 44, 52 36 Q 47 37 Q 53; C&AG’s Report, figure 3 12 Preparedness for online safety regulation if a company feels that Ofcom has gone too far or does not have the right evidence. Its enforcement decisions will therefore need to be clearly evidenced, proportionate and risk- based, such that any action it takes has an impact and stands up in court.38 38 Qq 54–56 Preparedness for online safety regulation 13 2 Financing the regime and ensuring excellence Financing the regime

Ofcom’s expenditure is subject to an overall budget cap set by HM Treasury. Treasury agreed to increase this cap to fund the upfront costs of the online safety regime, with the costs funded from Ofcom’s retention of Wireless Telegraphy Act 2006 receipts, which it would have otherwise handed to the Exchequer.39 The Department told us that this arrangement will continue until the fee regime is in place.40 As at April 2023, Ofcom estimated that its cumulative costs in preparing for and implementing the regime could total £169 million over five years by the end of 2024–25.41 As part of this, the Department and Treasury agreed to provide Ofcom with £63 million for 2024–25, which was £3 million less than Ofcom had requested.42

The online safety regime is expected to be self-financing, once it is fully operational, with both ongoing costs of the regime and the costs of its set-up covered by fees levied on industry.43 However, Ofcom will not start charging fees until 2026–27 and will not begin recouping the set-up costs until 2027–28, with it taking three to five years for these costs to be fully recovered.44 The start of the fee regime is later than Ofcom originally expected. In June 2023, Ofcom had expected that it would start to recover costs in 2025–26, which was already a year later than originally expected. These delays are due to changes to the timetable and scope of the Bill during its passage through parliament, as well as a recommendation by a parliamentary Committee to introduce additional scrutiny to the legislative process required to introduce the fees.45 Ofcom recognised that it will be a long time before the costs are recovered, but told us that they do not score as public expenditure.46

Ofcom has yet to determine many of the details of the fee regime, including the period over which set-up costs will be recovered; the revenue threshold at which firms start to pay fees; and the fee rates payable. It had also yet to undertake financial modelling to inform the design of the fee regime.47 Ofcom explained that, before it sets up the fee regime, the Act requires it to produce advice for the Secretary of State on revenue thresholds, which will require consultation, and to publish a statement of charging principles that sets out how Ofcom has calculated the fees for each year. Ofcom expects that the fees are likely to be index-linked, but is still working out the details.48

We asked Ofcom whether it has been able to give industry any indication about the likely scale of fees. Ofcom was unable to comment but did highlight that it will run a consultation during which industry can provide input and that ultimately the Government 39 Q 58; C&AG’s Report, para 2.6 40 Q 66 41 C&AG’s Report, para 2.7 42 Q 59 43 Q 59; C&AG’s Report, para 2.6 44 Q 61 45 Q 63; C&AG’s Report, paras 2.6, 2.7 46 Q 62 47 C&AG’s Report, para 2.9 48 Qq 80–82 14 Preparedness for online safety regulation will have a role in deciding on some of the trade-offs involved in setting up the fee regime.49 Ofcom recognised the challenge that more time may be spent regulating smaller and risky companies, which is paid for by larger and more compliant companies. It stated that it will aim to be proportionate, fair and administratively effective with how it sets the fees across the industry.50 Ofcom also told us that it will be completely transparent with industry at the start of each financial year about the fees it will be charging.51 Capacity and skill requirements

To deliver its online safety work, Ofcom reported that it has increased its headcount, from around 950 people to what will probably be around 1,500, an increase of about 50%.52 Progress in meeting its staffing requirements has been broadly to schedule.53 Ofcom described such a major recruitment programme as both a challenge and an opportunity to improve the overall shape and make-up of the organisation. It had been able to grow its expertise in technology and data, and now had a workforce that was more spread across the country.54 Ofcom has, so far, recruited from a variety of relevant bodies, including civil society bodies such as the National Society for the Prevention of Cruelty to Children (NSPCC) and Internet Watch Foundation, law enforcement agencies, such as the National Crime Agency, other regulators, and online service providers such as Google and Meta.55

Ofcom told us that some recruits have returned to industry, but that retention generally is not an issue at the moment.56 It told us that it is confident in its ability to attract the necessary talent, with people attracted by Ofcom’s mission and the opportunity to achieve change to online safety. We asked Ofcom about the salaries it is offering. As an independent regulator, Ofcom is able to set its own salaries. Ofcom told us that the salaries it offers are what is required to attract the necessary skills, but that they are not that much higher than elsewhere in the public sector.57

Ofcom has undertaken extensive organisational design work to prepare for and operate the new regulatory regime.58 Ofcom explained that, to improve accountability and organisational clarity, it re-organised around four groups of work, of which online safety is one. Accountability for delivering Ofcom’s online safety responsibilities sits within this online safety group.59 Ofcom is confident that this new structure will enable it to respond quickly to new and emerging harms but acknowledged that more work is needed to embed more responsive ways of working.60 The Department told us that, at the time of our evidence session, it was at the very late stages of recruiting three non-executive directors to the Ofcom board to provide knowledge and experience across the full suite of Ofcom’s activities, including online safety.61 49 Qq 85–86 50 Q 84 51 Q 81 52 Q 8 53 C&AG’s Report, para 2.13 54 Q 8 55 C&AG’s Report, para 2.16 56 Qq 88–89 57 Qq 60, 87–89 58 C&AG’s Report, para 2.10 59 Qq 70–71 60 C&AG’s Report, para 2.11 61 Q 69 Preparedness for online safety regulation 15

The Department also recognised that it needs to be constantly evolving its own capabilities so that it has the right resources to deal with the new risks and opportunities arising in a rapidly changing environment. It cited as examples the work it had done since its own creation in response to the rapid developments in generative AI, such as the emergence of ChatGPT. However, the challenge it faced was making that ability to evolve and respond quickly to change part of its DNA.62 Evaluating and learning

The government considers that, with the Online Safety Act, the UK will be the first country to regulate such a comprehensive range of online harms, and the Department told us that a lot of what it described as ‘nascent legislation in this space’, particularly around Europe and elsewhere, looked a lot like the Act.63 In developing the legislation and regulatory regime established by the Act, both the Department and Ofcom have engaged with overseas regulators as they recognise that online safety is a global problem and that hardly any of the companies subject to regulation are based in the UK. Ofcom has also liaised with other UK regulators.64

Both the Department and Ofcom see collaboration, both nationally and internationally, as crucial to achieving change on behalf of the British public in line with the Act. Working in partnership with other regulators will help them be alert to the next set of issues arising and how they might be addressed.65 For example, the Global Online Safety Regulators Network, which Ofcom helped launch in November 2022, has enabled Ofcom to get to grips with the emerging harm of sextortion (sex-based blackmail) and talk to law enforcement agencies about this more quickly than it would otherwise have done.66 The Act also requires Ofcom power to tackle fraudulent advertising. Ofcom told us that it is recommending that larger platforms should use trusted flaggers, organisations like HMRC, the Financial Conduct Authority, and other civil society organisations that are well-placed to know that something is fraudulent. It is also recommending that the services have in place a tougher flagger system so that they can act more quickly against criminals who use whichever loophole has opened up.67

The Department and Ofcom also recognise the role evaluation will play in ensuring the regulatory regime’s future success. For example, Ofcom is developing evaluations and key metrics to make sure that its proposals are being acted on and are having the effect that it intended, while the Online Safety Act requires the Department to undertake an evaluation of regulatory effectiveness within two to five years after the Act received Royal Assent. The Department has been working with Ofcom to ensure their evaluation activities complement each other. However, Ofcom has yet to finalise the performance metrics it will use to evaluate the impact of its different interventions, and the Department has important gaps in its evidence base. Evaluation will also be challenging owing to the nature of the regulated harms, the fast-changing landscape, the novelty of the regulatory regime and the lack of international precedents, and the lack of relevant data and metrics.68 62 Q 36 63 Q 17; C&AG’s Report para 1.3 64 Qq 17, 75, 77; C&AG’s Report paras 3.5–3.7 65 Qq 74, 75, 77 66 Qq 23, 75, 77; C&AG’s Report para 3.7 67 Q 67 68 Qq 23, 73, 78; C&AG’s Report paras 3.13–3.15 16 Preparedness for online safety regulation