Action Planned
Ofcom acknowledges the concerns and outlines its plans to implement the Online Safety Act, including consulting on draft codes of practice and taking enforcement action against non-compliant services regarding harmful suicide content. (AI summary)
View full response
Dear Mr Wall, We write in response to the Regulation 28 report to Prevent Future Deaths, received 1st March 2024, which was issued to Ofcom following the death of Daniel Tucker (‘the Report’). Firstly, I would like to offer my deepest condolences to Mr Tucker’s family and loved ones on behalf of Ofcom. I understand that a loss in such troubling circumstances must be incredibly difficult. Our response will necessarily focus only on the issues raised in the report which are within Ofcom’s remit, namely, the ‘continuing accessibility of the pro suicide web-forum, with reference to new legal requirements under the Online Safety Act 2023 (‘the Act’). We thank the coroner’s office for bringing our attention to the role of online services in the tragic circumstances of Mr Tucker’s death. Intelligence about the real-world effects of online harms and their links to specific services will be crucial as we develop our approach to the Online Safety regime. I wish to assure you and the family of the deceased that Ofcom is committed to taking action to ensure that all online services in scope of the Act fulfil their duties in regard to harmful suicide content, as we press forward in our implementation of the Act’s provisions.
i. Response to Regulation 28 report following inquest into the death of Daniel Tucker
In the response below, we set out our proposed actions in relation to the issues raised by the Report, where these fall within the scope of the Online Safety regime, and the timetable for these actions. These actions are pursuant to the new duties and powers assigned to Ofcom by the Act and relate to Ofcom’s plans for implementation of the Act as the UK’s regulator for online safety. The report outlines a number of detailed matters of concern and our response below highlights the steps we are taking to promote compliance with the requirements of the regime across all relevant regulated services. We are currently in the process of putting in place regulation to implement the Online Safety regime, following the Act coming into force on 26 October 2023. Until the relevant procedural steps outlined below are completed, the duties on regulated services are not yet fully in force. As Ofcom’s enforcement powers are tied to non-compliance with these duties, we will only be able to pursue enforcement action against online services once our Codes of Practice are finalised in 2025. Once
Classification: HIGHLY SENSITIVE the duties are in force, we won’t hesitate to exercise our enforcement powers where appropriate and effective to protect Internet users. Following reports1 of alleged illegal and harmful suicide content on , Ofcom contacted the service on 7 November 2023, which subsequently announced via its website that UK users would be blocked. On January 8 2024, we contacted the service again to note we were aware that the restrictions appeared to no longer be in place. At the time of writing, we are aware that the site is accessible by UK users. This is a situation which we will continue to monitor, but as noted above, Ofcom does not have powers to enforce these duties until the relevant guidance and Codes have been finalised and come into force. As a provider of a service that allows user-to-user sharing of content and that is accessible in the UK, is likely to be in scope and subject, in particular, to the illegal content duties found in sections 9 and 10 of the Act, which we outline in further detail below. This means that if the site is still accessible to UK users in its current form when these duties take effect, we would then be able to carry out an initial assessment to explore whether the available evidence merits opening an investigation, whether the issue can be resolved through other means, and whether it should be prioritised. Our published enforcement guidance sets out the framework within which we will make these decisions. If, following a formal investigation, we are satisfied that the company concerned has contravened one or more of its obligations under the Act, Ofcom may issue a notice of contravention, impose a financial penalty and/or require steps to be taken to remedy the harm or come into compliance. Should the service fail to comply with these remedial steps (or pay the financial penalty), we can apply to the court for business disruption measures, which include service restriction orders or access restriction orders. In exceptional circumstances, we may consider it appropriate to apply for a business disruption measure before taking formal enforcement action. Below we set out in more detail the steps and approach we are taking to implement the Act, estimated timelines, and in-scope services’ legal duties to comply with the Act. The Online Safety Act 2023 The Online Safety Act 2023 (‘the Act’) makes persons that operate a wide range of online services legally responsible for keeping people safer online. The Act covers certain categories of internet services that have links with the UK including what are known as user-to-user services and search services. The Act defines a user-to-user or search service as having links to the UK if it meets any one or more of the following criteria:
• Has a significant number of UK users; or
• Has UK users as one of its target markets; or
• Is capable of being used by UK users, and there are reasonable grounds to believe that there is a material risk of significant harm to UK users. Any service which meets one more or the above criteria, and which is not exempt2, will be expected to comply with the relevant duties under the Act.
1 BBC News, ‘“Failure to act” on suicide websites linked to 50 UK deaths’, 24 October 2023 2 A number of exemptions also apply as set out in Schedule 1 to the Act. See: Vol 1, Section 3 of our Illegal Harms Consultation
Classification: HIGHLY SENSITIVE
Provisions of the Act: legal duties on services Among other things, the Act:
• Appoints Ofcom as the regulator for online safety and confers upon us a number of powers and duties (set out in detail below).
• Imposes a number of duties on those regulated services which focus on improving the systems and processes online services operate to ensure the safety of their users, rather than on the presence of individual pieces of content. These include: o duties on user-to-user services to swiftly take down illegal content (including illegal suicide and illegal self-harm content) when it is identified, and to prevent children from encountering content that is harmful to them (including content which encourages, promotes or provides instructions for suicide or self-injury); o duties on search services to minimise the risk of individuals encountering illegal content (including illegal suicide and self-harm content) and children from encountering content that is harmful to them (including content that encourages, promotes or provides instruction for suicide or deliberate self-harm) in search results; and o additional duties for the largest and highest-risk services allowing their users to increase control over the content they encounter on those services.
• Requires regulated services to assess the risks their services pose to users in relation to illegal content and content that is harmful to children and take steps to mitigate and manage those risks.
• Requires Ofcom to issue a number of regulatory publications to help regulated services understand how they can comply with their legal duties. These include Codes of Practice setting our recommended measures services can take to mitigate risks of harm in compliance with their duties, and resources to help companies assess, understand and manage risk. Specifically, the duties on all regulated user-to-user services relating to protecting their users from illegal harms will require those services to understand and take steps to manage and mitigate the risks of users encountering illegal suicide content, or their services being used for the commission or facilitation of this offence. User-to-user services will also have to swiftly take down illegal suicide and illegal self-harm content when it is identified. Where regulated services are likely to be accessed by children, they will also have to take steps to prevent child users from encountering content that encourages, promotes or provides instructions for suicide or deliberate self-injury. There are also additional duties which apply to certain user-to-user services which will be ‘categorised’ based on user numbers and functionalities (these services will be known as ‘Category 1 services’3). These duties are designed to make these services more transparent and accountable to their users about the steps they take to protect them from harm; and enable adult users to have
3 ‘Category 1’ refers to certain user-to-user services categorised based on user numbers and functionalities. Services in this category are subject to additional duties related to transparency, user empowerment and protection of democratic and journalistic content. ‘Category 1 threshold conditions’ are set the Secretary of State, with advice provided by Ofcom. Ofcom will then be responsible for designating services into categories according to these thresholds. See our advice on categorisation: Categorisation Research and advice (ofcom.org.uk)
Classification: HIGHLY SENSITIVE more control over the type of content they encounter, including by having access to tools to reduce their potential exposure to suicide and self-harm content. A set of separate duties apply to regulated search services. These duties focus on those services understanding the risks of harm and focus on services taking steps to minimise the risk of individuals encountering illegal suicide and self-harm content and content that encourages, promotes or provides instruction for suicide or deliberate self-harm to children in search results. Timeline for duties under the Act coming into force Although the Act is now law, there are numerous procedural steps needed for the new regime to be fully implemented, and these steps need to be completed before services’ legal duties under the regime – and Ofcom’s ability to enforce those duties – come into force. These steps include: the completion of public consultations (the first, on illegal harms, closed on 23rd February 2024); services completing Risk Assessments designed to help them understand and managing the risks of harm to their users; and Parliament approving Ofcom’s final Codes of Practices. We explain our plans to implement the regime below. In the meantime, we are already encouraging in-scope service providers to take meaningful steps to improve safety on their platforms. To this end, we are committed to driving industry improvements by engaging with the largest and riskiest services via continuous ‘regulatory supervision.’
ii. Ofcom’s implementation of the Online Safety Act To coincide with Royal Assent, we set out our approach to implementing the Act on our website – this included an implementation road map setting out our three key phases of work over the next three years. We set out in summary below our intended plans for implementation, and in diagram form in Figure 1. This timeline shows our key milestones and documentation but is not a comprehensive guide to everything we will produce over the first three years of the regime. Figure 1: Ofcom’s timeline for Online Safety implementation
As part of our preparatory work for implementation, we have been actively engaging with a range of expert stakeholders including government, law enforcement, and charities such as the Samaritans to develop our understanding, expertise and evidence base in relation to suicide and self-harm, and to ensure that we are aware of developing areas of risk. We have also been concentrating on growing
Classification: HIGHLY SENSITIVE our internal expertise in relation to this complex and important harms area, including by commissioning research.4 We will continue our programme of engagement with relevant experts as we consult on our initial proposals on how services can comply with their duties. Phase One: Illegal Harms Ofcom’s illegal harms consultation: assessing risks The Act requires Ofcom to produce a register of risks for illegal harms, and guidance to assist services in conducting their own risk assessment. Our draft guidance sets out a four-step risk assessment process which we propose as the best way to ensure that a service’s assessments meet their obligations. We have also consulted on our ’Risk Profiles’, which set out an explanation of factors in service design and operation that increase risk of harm. Services will be required to take account of our Risk Profiles when conducting their risk assessments. The information contained in the Risk Profiles is sourced from Ofcom’s own Register of Risks. For illegal suicide and self-harm content, we set out risk factors relating to:
• service type;
• user base;
• functionalities of the service; and
• recommender systems. We are using the consultation process to help us finalise this work. Ofcom’s illegal harms consultation: Codes of Practice The Act requires Ofcom to produce Codes of Practice setting out the measures that in-scope services may take to comply with their duties under the Act.5 The Codes will recommend proportionate systems and processes across a number of areas, including: moderation, governance, and user complaints. While services are not required to implement all measures in our Codes of Practice, in the event that they choose not to take the steps recommended, they will need to be able to explain how their chosen approach allows them to be compliant with their legal duties. We published our illegal content Codes of Practice in draft form alongside our illegal harms consultation.6 The proposed measures in our Codes of Practice would require services to, among other things:
• have a named person, who is accountable to the most senior governance body, for compliance with illegal content safety duties, and reporting and complaints duties;
4 See, for example, our recent research on suicide content and search services: ‘One Click Away: a study on the prevalence of non-suicidal self injury, suicide, and eating disorder content accessible by search engines’. See also our research into children’s experience of suicide, self-harm and eating disorders content: ‘Experiences of children encountering online content relating to eating disorders, self-harm and suicide’ 5 Section 41 of the Act 6 Ofcom, ‘Consultation: Protecting people from illegal harm online’, November 2023. See: Volume 4: How to mitigate the risk of illegal harms – the illegal Content Codes of Practice, Annex 7: Illegal Content Codes of Practice for user-to-user services and Annex 8: Illegal Content Codes of Practice for search services.
Classification: HIGHLY SENSITIVE
• have in place effective and easy-to-find content reporting and complaint mechanisms, so that users that encounter illegal content (including illegal suicide and, if the offence is brought into force, self-harm content) can report it and see action taken;
• in the case of medium or high-risk services that use algorithms to recommend content to users, measure the risk that changes to algorithms increase the chance of users' exposure to illegal content (including illegal suicide and self-harm content);
• in the case of user-to-user services: have in place content moderation systems or processes that are designed to take down known illegal content (including illegal suicide and self-harm content) swiftly; and
• in the case of search services: have systems and processes in place that are designed so that search content that is illegal content is deprioritised or deindexed for UK users. In addition, our draft Codes of Practice include a proposal that search services should provide crisis prevention information in response to search requests that contain general queries regarding suicide and queries seeking specific, practical or instructive information regarding suicide methods. This information should include a helpline and links to freely available supportive information provided by a reputable mental health or suicide prevention organisation. It should also be prominently displayed to users in the search results. Ofcom’s illegal harms consultation: Illegal Content Judgements Guidance Our illegal harms consultation includes a draft version of Ofcom’s Illegal Content Judgements Guidance.7 This document provides guidance to in-scope services on how they may identify illegal content (content which may be reasonably inferred to amount to a relevant offence) including under Section 2 of the Suicide Act 1961. In our draft guidance, we note the intentional act of encouraging or assisting the suicide (or attempted suicide) of another person is an offence and have proposed that, in certain contexts, the provision of specific, practical or instructive information on suicide methods – for example about how to take one’s life, and content inducing someone to enter into a ‘suicide pact’, are likely to be able to be inferred to be illegal content. Our draft guidance therefore suggests that content of this type should be removed from services in order for providers to be compliant with their illegal content safety duties. The Illegal Harms consolation closed on 23rd February 2024. We are now reviewing responses to our consultation and working towards our Illegal Harms Statement, in which we will outline our final policy decisions. After Ofcom’s illegal harms consultation and statement Once we have completed our illegal harms consultation, we are required to publish a statement setting out our response to issues raised by stakeholders, and our final policy decisions. The Act requires Ofcom to submit our Codes of Practice on illegal harms to the Secretary of State and to publish associated guidance within 18 months of Royal Assent. Once we issue our statement, services will have three months to undertake their illegal content risk assessments. At this point we
7 Ofcom, ‘Consultation: Protecting people from illegal harm online’, November 2023. See: Volume 5: How to judge whether content is illegal or not? (Illegal Content Judgements Guidance) and Annex 10: Online Safety Guidance on Judgement for Illegal Content.
Classification: HIGHLY SENSITIVE will also submit the Codes of Practice to the Secretary of State, which, subject to their approval, are to be laid in Parliament for 40 days. Following approval by Parliament, the Codes will come into force 21 days after they have been issued. At this time the illegal harms safety duties become enforceable, and we can begin investigations and – following the conclusion of those – impose sanctions if we find that services are not compliant with these duties. Phase Two: Child Safety As stated above, services that are likely to be accessed by children are required to protect children from legal content which may harm them. As part of Phase Two, we will publish a consultation on protecting children, to be published in May 2024, which will include our proposals for:
• Draft guidance for services on carrying out their Children’s Access Assessments
• Ofcom’s analysis of the causes and impacts of harms to children
• Draft guidance on carrying out Children’s Risk Assessments
• Draft Codes of Practice setting out recommended measures to protect children online. After publication of our final guidance on Children’s Risk Assessments (Spring 2025), relevant services will have three months to carry out a Children’s Risk Assessment. At the same time, we will submit the children’s Codes of Practice to the Secretary of State. Subject to the Secretary of State’s approval, they will then be laid in Parliament for 40 days. Following approval by Parliament, the codes will come into force 21 days after they have been issued. At this time the children’s safety duties become enforceable, and we can begin investigations and impose sanctions for non-compliance. Assuming Parliament immediately approves the codes, we expect the duties to become enforceable in Summer 2025. Phase Three: transparency, user empowerment, and other duties on categorised services Phase Three of online safety focuses on transparency, user empowerment, and other duties which will apply to Category 1 services. The user empowerment duties will contain a duty to include, to the extent that it is proportionate to do so, features which adult users may use or apply if they wish to increase their control over certain kinds of content including content which encourages, promotes or provides instructions for suicide or an act of deliberate self-injury. We issued a Call for Evidence regarding our approach to phase three on 25 March 2024.
iii. Conclusion We thank the Coroner again for bringing to our attention the role that access to online services had in Mr Tucker’s death. His story highlights the pressing importance of tackling the harm from services which provide ready access to suicide content. Government and Parliament have signalled the importance of tackling such content by designating illegal suicide content as a priority offence and legal suicide content as primary priority content that is harmful to children, and our strategic priorities reflect this. As we have set out in our approach to implementing the Online Safety Act, once the regime is in force we expect change.
Classification: HIGHLY SENSITIVE Specifically, we anticipate implementation of the Act will ensure people in the UK are safer online by delivering four outcomes:
• stronger safety governance in online firms;
• online services designed and operated with safety in mind;
• choice for users so they can have meaningful control over their online experiences; and
• transparency regarding the safety measures services use, and the action Ofcom is taking to improve them, in order to build trust. We have set out that we will expect all in-scope services to have appropriate trust and safety measures tackling the full range of harms listed in the Act. In particular, we want to see wider deployment and improvements in services’ measures to address areas which pose the greatest risk to people, including illegal and harmful suicide content, to protect UK users, especially children and vulnerable users. We are committed to working with industry to ensure compliance with these duties, and to this end our draft illegal harms Codes of Practice include specific measures which we propose would allow services to meet their duties in an effective and proportionate manner. We will ensure that through consulting on our proposals we seek input and engagement with external experts. We will also work directly with services to promote compliance, including – where appropriate – through targeted supervision. And where we identify non-compliance, we will not hesitate to take appropriate enforcement action to protect users from harm. Evidence included in reports from coroners and other experts will play an important role in our policy proposals and response as we implement the regime, and we will of course take the evidence in your report into account as we continue our policy development. We hope that this response provides helpful information about the significant steps Ofcom is taking as we continue to work through the implementation of the Act. If further information or clarification is required, we would be happy to provide this.