Department for Science Innovation and Technology
government_department
Action Taken
The Department highlights the Online Safety Act (OSA) which requires companies to prevent users from encountering illegal content and remove such content swiftly. Ofcom can issue information notices at the coroner's request, requiring services to provide data and Data Preservation Notices to preserve a child's data. (AI summary)
View full response
Dear Mr Bridgman,
Thank you for giving me the opportunity to respond to your Regulation 28 Report to Prevent Future Deaths dated 4 November 2025, regarding the devastating death of Oliver Gorman. Since taking up my role as Secretary of State for the Department of Science, Innovation and Technology, I have been actively reviewing the issues you have raised in your report, and I am grateful to you for bringing them to my attention.
First and foremost, I want to express my deepest condolences to Oliver’s family and friends. Every death is a tragedy, but it is especially harrowing when it involves someone so young, and with their whole life ahead of them. The circumstances of Oliver’s death are profoundly concerning, and I will ensure your report informs the government’s considerations on how we strengthen online safety for everyone - particularly for children. I also want to assure you that I will be working across government with all relevant Secretaries of State to see what more we can do to stop these very tragic incidents happening.
As you will be aware, the Online Safety Act received Royal Assent in October 2023. This landmark legislation lays the foundation for strong protections against illegal content for all users and harmful material, particularly for children. The independent regulator for online safety under the Act is Ofcom.
The illegal content duties have been in force since March. This means that all companies in scope need to take steps to prevent users from encountering illegal content and criminal behaviour on their services and remove such content swiftly when identified (once aware that it has been uploaded).
The Act delivers important protections for children. Since July, the child safety duties have required all regulated user-to-user services and search services in scope of the Act that are likely to be accessed by children to protect them from harmful content. Sadly, Oliver’s death occurred before these duties came into force, but I want to set out how I hope the safeguards now in place will prevent tragedies like this in the future.
Content that is harmful to children can be categorised as either ‘Primary Priority Content’, ‘Priority Content’ or ‘non-designated content’. Your report highlighted evidence from Oliver’s school, detailing a trend of inhaling to experience a ‘buzz’. Your report stated that this trend is widespread on social media and was a ‘challenge’ that you note was disseminated through TikTok. The Act explicitly defines ‘Priority Content’ as including content which encourages a person to ingest, inject, inhale or in any other way self-administer a physically harmful substance or a substance in such a quantity as to be physically harmful. ‘Priority Content’ also includes content defined as content which encourages, promotes or provides instructions for a challenge (or stunt) highly likely to result in serious injury to the person who does it.
A6
Platforms such as TikTok must protect children from ‘Priority Content’, while search services have a duty to minimise the likelihood that children in age groups encounter harmful content when searching online.
Ofcom recommends that services which are at medium or high risk of Priority Content and allow this type of content on their service should use highly-effective age assurance to determine whether children are on these parts of the service and put in place appropriate access or content controls.
Your report noted concerns about Oliver being bullied. While you evidence that this was not a factor in Oliver’s death, it is worth highlighting that the Act also defines ‘Priority Content’ to include bullying, abusive, or hateful content. Services in-scope of the Act must also take steps to protect children from this type of content online.
We are also applying more robust duties on services in respect of the most harmful types of content (‘primary priority content’), which includes pornography or content that encourages, promotes or provides instructions for suicide, self-harm or eating disorders, and must prevent children from encountering such content by using highly effective age assurance.
Your report references algorithms on social media services. Under the Act, providers must assess how algorithms may amplify children’s exposure to illegal or harmful content and take action to reduce risks, including for ‘priority content’. If a risk assessment identifies that habit-forming or addictive behaviour (resulting from the design of the service) could cause significant harm to children, providers must implement measures to mitigate and manage this risk. The Act also makes clear that harm can arise from how content is disseminated — for example, when an algorithm repeatedly pushes large volumes of content to a child in a short period.
Services likely to be accessed by children must also provide simple, effective reporting tools for harmful content and respond quickly.
In relation to minimum age limits for access to online services - 13 years-old is commonly the age social media services set as a minimum age. 13 is the digital age of consent in the UK – the age at which a child can consent to their data being processed by online services. This age reflects what was considered at the time the digital age of consent legislation passed to be the right balance between enabling young people to participate online and ensuring their data is protected. Any change to this age threshold would require a formal process, including public consultation, to ensure that the views of all relevant stakeholders such as parents, children, industry, and regulators are fully considered before any legislative amendments are made.
The OSA does not require services to set a minimum age limit. However, Ofcom notes that if a service has a minimum age limit set (as most social media services do) and is not using highly-effective age assurance to enforce this, then they should assume younger children are using their service and apply protections accordingly. This should help ensure that younger children also have age-appropriate online experiences.
Your report references that the challenge or practice of recreationally inhaling deodorant spray was known to be shared on TikTok. However, your report also notes that it was not possible to access Oliver’s mobile phone to determine whether he had been viewing content about dangerous stunts or challenges before his death. It would be helpful to understand further what issues you had accessing Oliver’s phone. It is of utmost importance to me that coroners do not face undue barriers when it comes to preserving or accessing social media data in these tragic circumstances, and so if you wanted to provide further details on why you were unable to access his phone, I would be happy to ensure we look into this further.
As you will likely already be aware, there are existing provisions in the OSA to aid coroners with preservation and access of social media data. Under the OSA, Ofcom can issue information notices at the coroner’s request, requiring services to provide data where a coroner feels it is relevant to an investigation. Since September 2025, Ofcom has also had the power to issue Data Preservation Notices, if requested by coroners, which require services to preserve a child’s data so it cannot be deleted or altered during an investigation. I hope that these powers will make a material difference A7
for you and other coroners in being able to access and preserve social media data, where it may have played a part in a child’s death.
If a platform fails to respond to a Notice, Ofcom can take tough enforcement action - including fines of up to 10% of the companies' qualifying worldwide revenue or £18 million, whichever is greater. I expect Ofcom to use all its enforcement powers to hold platforms accountable where they are failing to meet their duties under the OSA, including in these circumstances.
The government’s mission is clear: children must grow up safe, protected, and free from online harms. I will work relentlessly across government, alongside other Secretaries of State, to prevent tragedies like this from ever happening again. The Online Safety Act is a critical tool in achieving that goal. The protections outlined above are now fully in force, and we are already seeing real tangible improvements in how children experience the online world. But let me be absolutely clear—this is only the beginning. These protections are a foundation from which we will build on if required. My department is working closely with Ofcom to track the impact of the Act, and their flexible approach means we can respond quickly to new and emerging risks. If further action is needed, I will not hesitate to strengthen child safety measures. We will do whatever it takes to ensure children are protected online.
Thank you for giving me the opportunity to respond to your Regulation 28 Report to Prevent Future Deaths dated 4 November 2025, regarding the devastating death of Oliver Gorman. Since taking up my role as Secretary of State for the Department of Science, Innovation and Technology, I have been actively reviewing the issues you have raised in your report, and I am grateful to you for bringing them to my attention.
First and foremost, I want to express my deepest condolences to Oliver’s family and friends. Every death is a tragedy, but it is especially harrowing when it involves someone so young, and with their whole life ahead of them. The circumstances of Oliver’s death are profoundly concerning, and I will ensure your report informs the government’s considerations on how we strengthen online safety for everyone - particularly for children. I also want to assure you that I will be working across government with all relevant Secretaries of State to see what more we can do to stop these very tragic incidents happening.
As you will be aware, the Online Safety Act received Royal Assent in October 2023. This landmark legislation lays the foundation for strong protections against illegal content for all users and harmful material, particularly for children. The independent regulator for online safety under the Act is Ofcom.
The illegal content duties have been in force since March. This means that all companies in scope need to take steps to prevent users from encountering illegal content and criminal behaviour on their services and remove such content swiftly when identified (once aware that it has been uploaded).
The Act delivers important protections for children. Since July, the child safety duties have required all regulated user-to-user services and search services in scope of the Act that are likely to be accessed by children to protect them from harmful content. Sadly, Oliver’s death occurred before these duties came into force, but I want to set out how I hope the safeguards now in place will prevent tragedies like this in the future.
Content that is harmful to children can be categorised as either ‘Primary Priority Content’, ‘Priority Content’ or ‘non-designated content’. Your report highlighted evidence from Oliver’s school, detailing a trend of inhaling to experience a ‘buzz’. Your report stated that this trend is widespread on social media and was a ‘challenge’ that you note was disseminated through TikTok. The Act explicitly defines ‘Priority Content’ as including content which encourages a person to ingest, inject, inhale or in any other way self-administer a physically harmful substance or a substance in such a quantity as to be physically harmful. ‘Priority Content’ also includes content defined as content which encourages, promotes or provides instructions for a challenge (or stunt) highly likely to result in serious injury to the person who does it.
A6
Platforms such as TikTok must protect children from ‘Priority Content’, while search services have a duty to minimise the likelihood that children in age groups encounter harmful content when searching online.
Ofcom recommends that services which are at medium or high risk of Priority Content and allow this type of content on their service should use highly-effective age assurance to determine whether children are on these parts of the service and put in place appropriate access or content controls.
Your report noted concerns about Oliver being bullied. While you evidence that this was not a factor in Oliver’s death, it is worth highlighting that the Act also defines ‘Priority Content’ to include bullying, abusive, or hateful content. Services in-scope of the Act must also take steps to protect children from this type of content online.
We are also applying more robust duties on services in respect of the most harmful types of content (‘primary priority content’), which includes pornography or content that encourages, promotes or provides instructions for suicide, self-harm or eating disorders, and must prevent children from encountering such content by using highly effective age assurance.
Your report references algorithms on social media services. Under the Act, providers must assess how algorithms may amplify children’s exposure to illegal or harmful content and take action to reduce risks, including for ‘priority content’. If a risk assessment identifies that habit-forming or addictive behaviour (resulting from the design of the service) could cause significant harm to children, providers must implement measures to mitigate and manage this risk. The Act also makes clear that harm can arise from how content is disseminated — for example, when an algorithm repeatedly pushes large volumes of content to a child in a short period.
Services likely to be accessed by children must also provide simple, effective reporting tools for harmful content and respond quickly.
In relation to minimum age limits for access to online services - 13 years-old is commonly the age social media services set as a minimum age. 13 is the digital age of consent in the UK – the age at which a child can consent to their data being processed by online services. This age reflects what was considered at the time the digital age of consent legislation passed to be the right balance between enabling young people to participate online and ensuring their data is protected. Any change to this age threshold would require a formal process, including public consultation, to ensure that the views of all relevant stakeholders such as parents, children, industry, and regulators are fully considered before any legislative amendments are made.
The OSA does not require services to set a minimum age limit. However, Ofcom notes that if a service has a minimum age limit set (as most social media services do) and is not using highly-effective age assurance to enforce this, then they should assume younger children are using their service and apply protections accordingly. This should help ensure that younger children also have age-appropriate online experiences.
Your report references that the challenge or practice of recreationally inhaling deodorant spray was known to be shared on TikTok. However, your report also notes that it was not possible to access Oliver’s mobile phone to determine whether he had been viewing content about dangerous stunts or challenges before his death. It would be helpful to understand further what issues you had accessing Oliver’s phone. It is of utmost importance to me that coroners do not face undue barriers when it comes to preserving or accessing social media data in these tragic circumstances, and so if you wanted to provide further details on why you were unable to access his phone, I would be happy to ensure we look into this further.
As you will likely already be aware, there are existing provisions in the OSA to aid coroners with preservation and access of social media data. Under the OSA, Ofcom can issue information notices at the coroner’s request, requiring services to provide data where a coroner feels it is relevant to an investigation. Since September 2025, Ofcom has also had the power to issue Data Preservation Notices, if requested by coroners, which require services to preserve a child’s data so it cannot be deleted or altered during an investigation. I hope that these powers will make a material difference A7
for you and other coroners in being able to access and preserve social media data, where it may have played a part in a child’s death.
If a platform fails to respond to a Notice, Ofcom can take tough enforcement action - including fines of up to 10% of the companies' qualifying worldwide revenue or £18 million, whichever is greater. I expect Ofcom to use all its enforcement powers to hold platforms accountable where they are failing to meet their duties under the OSA, including in these circumstances.
The government’s mission is clear: children must grow up safe, protected, and free from online harms. I will work relentlessly across government, alongside other Secretaries of State, to prevent tragedies like this from ever happening again. The Online Safety Act is a critical tool in achieving that goal. The protections outlined above are now fully in force, and we are already seeing real tangible improvements in how children experience the online world. But let me be absolutely clear—this is only the beginning. These protections are a foundation from which we will build on if required. My department is working closely with Ofcom to track the impact of the Act, and their flexible approach means we can respond quickly to new and emerging risks. If further action is needed, I will not hesitate to strengthen child safety measures. We will do whatever it takes to ensure children are protected online.