Chloe Macdermott

Dear Mr Rogers, We write in response to the Regulation 28 report to Prevent Future Deaths, received 19th December 2023, which was issued to Ofcom following the death of Chloe Macdermott (‘the Report’). On behalf of Ofcom, I would like to offer my deepest condolences to Ms Macdermott’s family and loved ones. Ensuring that online services, such as those mentioned in the Report, fulfil their duties in regard to harmful suicide content is a key priority for Ofcom as we begin to implement the Online Safety Act.

i. Response to Regulation 28 report following inquest into the death of Chloe Macdermott In this response, we set out our proposed actions in relation to the issues raised by the Report, where these fall within the scope of the Online Safety regime, and the timetable for these actions. These actions are pursuant to the new duties and powers assigned to Ofcom by the Online Safety Act 2023 and relate to Ofcom’s plans for implementation of the Act as the UK’s regulator for online safety. We thank the coroner’s office for bringing our attention to the specific, tragic circumstances surrounding Ms Macdermott’s death. Intelligence about the real-world effects of online harms and their links to specific services will be crucial as we develop our approach to the Online Safety regime. The report outlines a number of detailed matters of concern and our response below highlights the steps we are taking to promote compliance with the requirements of the regime across all relevant regulated services. We are currently in the process of putting in place regulation to implement the Online Safety regime. Until the relevant procedural steps outlined below are completed, the duties on regulated services are not yet fully in force. Further detail on Ofcom’s planned approach to online safety regulation is set out below. Whilst the regime is at this early stage, we are supporting all in scope services to be compliant with the provisions of the Act and intend to seek to engage constructively with services.

Classification: HIGHLY SENSITIVE Following reports1 of alleged illegal and harmful suicide content on , Ofcom contacted the service which subsequently announced via its website that UK users would be blocked. As of 31st January 2024, we are aware that the site is accessible by UK users. This is a situation which we will continue to monitor. The Online Safety Act 2023 The Online Safety Act 2023 (‘the Act’) received Royal Assent on 26 October 2023 and makes persons that operate a wide range of online services legally responsible for keeping people safer online. The Act covers certain categories of internet services that have links with the UK including what are known as user-to-user services and search services. The Act defines a user-to-user or search service as having links to the UK if it meets any one or more of the following criteria:
• Has a significant number of UK users; or
• Has UK users as one of its target markets; or
• Is capable of being used by UK users, and there are reasonable grounds to believe that there is a material risk of significant harm to UK users. Any service which meets one more or the above criteria, and which is not exempt2, will be expected to comply with the relevant duties under the Act. Among other things, the Act:
• Appoints Ofcom as the regulator for online safety and confers upon us a number of powers and duties (set out in detail below).
• Imposes a number of duties on those regulated services which focus on improving the systems and processes online services operate to ensure the safety of their users, rather than on the presence of individual pieces of content.
• Requires regulated services to assess the risks their services pose to users in relation to illegal content and content that is harmful to children and take steps to mitigate and manage those risks.
• Requires Ofcom to issue a number of regulatory publications to help regulated services understand how they can comply with their legal duties.
• Requires Ofcom to publish resources to help companies assess, understand and manage risk.
• Ofcom will also produce Codes of Practice, setting out recommended measures services can take to comply with the relevant duties under the Act in order to mitigate the risk of harm. As explained further below, the duties on all regulated user-to-user services relating to protecting their users from illegal harms will require those services to understand and take steps to manage and mitigate the risks of users encountering illegal suicide content3, or their services being used for the commission or facilitation of this offence. User-to-user services will also have to swiftly take down illegal suicide and illegal self-harm content when it is identified. Where regulated services are likely to be accessed by children, they will also have to take steps to prevent child users from

1 BBC News, ‘“Failure to act” on suicide websites linked to 50 UK deaths’, 24 October 2023 2 A number of exemptions also apply as set out in Schedule 1 to the Act. See: Vol 1, Section 3 of our Illegal Harms Consultation 3 In other words content that would ‘amount to’ an offence of assisting or encouraging suicide under s.2 of the Suicide Act 1961 or s. 13 of the Criminal Justice Act (Northern Ireland) 1966.

Classification: HIGHLY SENSITIVE encountering content that encourages, promotes or provides instructions for suicide or deliberate self-injury.4 Ofcom would only have a role in connection with the prevention of supply or marketing of particular substances within the UK insofar as this relates to a type of content or activity that would be caught under duties in the Online Safety Act. Based on the information available in the report, it is not clear that material relating specifically to the supply or marketing of the substance itself would fall in scope of the duties under the Act. There are also additional duties which apply to certain user-to-user services which will be ‘categorised’ based on user numbers and functionalities (these services will be known as ‘Category 1 services’). These duties are designed to make these services more transparent and accountable to their users about the steps they take to protect them from harm; and enable adult users to have more control over the type of content they encounter, including by having access to tools to reduce their potential exposure to suicide and self-harm content. A set of separate duties apply to regulated search services. These duties focus on those services understanding the risks of harm and focus on services taking steps to minimise the risk of individuals encountering illegal suicide and self-harm content and content that encourages, promotes or provides instruction for suicide or deliberate self-harm to children in search results. Although the Act is now law, there are numerous procedural steps needed for the new regime to be fully implemented, and these steps need to be completed before services’ legal duties under the regime - and Ofcom’s ability to enforce those duties – come into force. These steps include, for example, the completion of public consultations (the first is currently open for illegal harms); services understanding and managing the risks of harm to their users; and Parliament approving Ofcom’s final Codes of Practices. We explain our plans to implement the regime below. In the meantime, we are already encouraging in-scope service providers to take meaningful steps to improve safety on their platforms. To this end, we are committed to driving industry improvements by engaging with the largest and riskiest services via continuous ‘regulatory supervision.’

ii. Ofcom’s implementation of the Online Safety Act To coincide with Royal Assent, we set out our approach to implementing the Act on our website – this included an implementation road map setting out our key phases of work over the next three years as set out above. We set out in summary below our intended plans for implementation, and in diagram form in Figure 1. This timeline shows our key milestones and documentation but is not a comprehensive guide to everything we will produce over the first three years of the regime.

4 There are similar duties on regulated search services which focus on those services understanding the risks of harm and focus on services taking steps to minimise the risk of individuals encountering illegal content and content that is harmful to children in search results.

Classification: HIGHLY SENSITIVE Figure 1: Ofcom’s timeline for Online Safety implementation

Phase One: The first step in this was the publication of the Consultation: Protecting people from illegal harms online (‘illegal harms consultation’) on 9 November 2023. As part of this consultation, we published proposals for Codes of Practice which set out how services can comply with their illegal content duties in the Act.5 We also published draft Illegal Content Judgements Guidance on how services can identify illegal suicide and illegal self-harm content. Phase Two: We also published our Consultation: Guidance for service providers publishing pornographic content on 5 December 2023, which includes draft guidance on age assurance and other duties for services providing pornographic content. This will be followed by a broader consultation on measures to protect children from encountering other harmful content, including legal suicide and self-harm content, in Spring 2024. Phase Three: From late 2024, we will publish a call for evidence on additional duties on categorised services, which includes user empowerment measures that will apply to ‘Category 1’ services, followed by a full consultation on proposals in Q1 2025. As part of our preparatory work for implementation, we have been actively engaging with a range of expert stakeholders including government, law enforcement, and charities such as the Samaritans to develop our understanding, expertise and evidence base in relation to suicide and self-harm, and to ensure that we are aware of developing areas of risk. We have also been concentrating on growing our internal expertise in relation to this complex and important harms area. We will continue our programme of engagement with relevant experts as we consult on our initial proposals on how services can comply with their duties. Phase One Ofcom’s illegal harms consultation: assessing risks The Act requires Ofcom to produce a register of risks for illegal harms, and guidance to assist services in conducting their own risk assessment. Our draft guidance sets out a four-step risk

5 It is not mandatory for services to implement all measures in our Codes of Practice. However, where Codes of Practice are not implemented in full, services are obliged to demonstrate the steps they have taken to achieve the same safety outcomes

Classification: HIGHLY SENSITIVE assessment process which we propose as the best way to ensure that a service’s assessments meet their obligations. We are also consulting on our ’Risk Profiles’, which set out an explanation of factors in service design and operation that increase risk of harm. Services will be required to take account of our Risk Profiles when conducting their risk assessments. The information contained in the Risk Profiles is sourced from Ofcom’s own Register of Risk. For illegal suicide and self-harm content, we set out risk factors relating to:
• service type;
• user base;
• functionalities of the service; and
• recommender systems. We are using the consultation process to help us finalise this work. Ofcom’s illegal harms consultation: Codes of Practice The Act requires Ofcom to produce Codes of Practice setting out the measures that in-scope services may take to comply with their duties under the Act.6 The Codes will recommend proportionate systems and processes across a number of areas, including: moderation, governance, and user complaints. While services are not required to implement all measures in our Codes of Practice, in the event that they choose not to take the steps recommended, they will need to be able to explain how their chosen approach allows them to be compliant with their legal duties. We published our illegal content Codes of Practice in draft form alongside our illegal harms consultation.7 The proposed measures in our Codes of Practice would require services to, among other things:
• have a named person, who is accountable to the most senior governance body, for compliance with illegal content safety duties, and reporting and complaints duties;
• have in place effective and easy-to-find content reporting and complaint mechanisms, so that users that encounter illegal content (including illegal suicide and, if the offence is brought into force, self-harm content) can report it and see action taken;
• in the case of medium or high-risk services that use algorithms to recommend content to users, measure the risk that changes to algorithms increase the chance of users' exposure to illegal content (including illegal suicide and self-harm content);
• in the case of user-to-user services: have in place content moderation systems or processes that are designed to take down known illegal content (including illegal suicide and self-harm content) swiftly; and
• in the case of search services: have systems and processes in place that are designed so that search content that is illegal content is deprioritised or deindexed for UK users. In addition, our draft Codes of Practice include a proposal that search services should provide crisis prevention information in response to search requests that contain general queries regarding suicide

6 Section 41 of the Act 7 Ofcom, ‘Consultation: Protecting people from illegal harm online’, November 2023. See: Volume 4: How to mitigate the risk of illegal harms – the illegal Content Codes of Practice, Annex 7: Illegal Content Codes of Practice for user-to-user services and Annex 8: Illegal Content Codes of Practice for search services.

Classification: HIGHLY SENSITIVE and queries seeking specific, practical or instructive information regarding suicide methods. This information should include a helpline and links to freely available supportive information provided by a reputable mental health or suicide prevention organisation. It should also be prominently displayed to users in the search results. Ofcom’s illegal harms consultation: Illegal Content Judgements Guidance Our illegal harms consultation includes a draft version of Ofcom’s Illegal Content Judgements Guidance.8 This document provides guidance to in-scope services on how they may identify illegal content (content which may be reasonably inferred to amount to a relevant offence) including under Section 2 of the Suicide Act 1961. In our draft guidance, we note the intentional act of encouraging or assisting the suicide (or attempted suicide) of another person is an offence and have proposed that, in certain contexts, the provision of specific, practical or instructive information on suicide methods – for example about how to take one’s life, and content inducing someone to enter into a ‘suicide pact’, are likely to be able to be inferred to be illegal content. Our draft guidance therefore suggests that content of this type should be removed from services in order for providers to be compliant with their illegal content safety duties. We are seeking further evidence and feedback from stakeholders on these proposals as part of our consultation. After Ofcom’s illegal harms consultation and statement Once we have completed our illegal harms consultation, we are required to publish a statement setting out our response to issues raised by stakeholders, and our final policy decisions. The Online Safety Act requires Ofcom to submit our Codes of Practice on illegal harms to the Secretary of State and to publish associated guidance within 18 months of Royal Assent. Once we issue our statement, services will have three months to undertake their illegal content risk assessments. At this point we will also submit the Codes of Practice to the Secretary of State, which, subject to their approval, are to be laid in Parliament for 40 days. Following approval by Parliament, the Codes will come into force 21 days after they have been issued. At this time the illegal harms safety duties become enforceable, and we can begin investigations and – following the conclusion of those – impose sanctions if we find that services are not compliant with these duties. Phase Two: Phase Two will focus on child safety and include a consultation on protecting children, to be published in Spring of 2024. The consultation will include our proposals for:
• Draft guidance for services on carrying out their Children’s Access Assessments
• Ofcom’s analysis of the causes and impacts of harms to children
• Draft guidance on carrying out Children’s Risk Assessments
• Draft Codes of Practice setting out recommended measures to protect children online.

8 Ofcom, ‘Consultation: Protecting people from illegal harm online’, November 2023. See: Volume 5: How to judge whether content is illegal or not? (Illegal Content Judgements Guidance) and Annex 10: Online Safety Guidance on Judgement for Illegal Content.

Classification: HIGHLY SENSITIVE The Act places requirements on services that are likely to be accessed by children to protect children from content which is legal but harmful to them. Services which are required to comply with the safety duties protecting children will be under a duty to operate a service using proportionate systems and processed designed to prevent children of any age from encountering ‘primary priority content that is harmful to children’. Content which ‘encourages, promotes or provides instructions for suicide’ or ‘for an act of deliberate self-injury’ has been designated as ‘primary priority content’ under the Act. Regulated services will have three months to carry out Children’s Access Assessments after we publish our final Guidance. If they conclude that they are likely to be accessed by children, then they will have to carry out Children’s Risk Assessments. We intend to publish our final Guidance on Children’s Access Assessments in early 2025. Our main statement on the Children’s Safety Duties will follow in Spring 2025. This will allow services to complete their initial Children’s Access Assessments and determine whether they need to comply with the children’s safety duties, before the requirement to carry out Children’s Risk Assessments comes into force. At that point (Spring 2025), relevant services will have three months to carry out a Children’s Risk Assessment. At the same time, we will submit the children’s Codes of Practice to the Secretary of State. Subject to the Secretary of State’s approval, they will then be laid in Parliament for 40 days. Following approval by Parliament, the codes will come into force 21 days after they have been issued. At this time the children’s safety duties become enforceable, and we can begin investigations and impose sanctions for non-compliance. Assuming Parliament immediately approves the codes, we expect the duties to become enforceable in Summer 2025. Phase Three: Phase Three of online safety focuses on transparency, user empowerment, and other duties which will apply to Category 1 services.9 The user empowerment duties in particular will include a duty to include, to the extent that it is proportionate to do so, features which adult users may use or apply if they wish to increase their control over certain kinds of content including content which encourages, promotes or provides instructions for suicide or an act of deliberate self-injury. We plan to issue a Call for Evidence regarding our approach to phase three in early 2024. Regulation of Video Sharing Platforms In addition to our preparation for the implementation of the online safety regime, Ofcom has also been responsible for regulating UK-established video sharing platforms (VSPs) since November 2020. The scope of the VSP regime is much narrower than that of the Act, applying only to services that meet the definition of a VSP under Part 4B of the Communications Act 2003 and have the required connection with the UK10 and to protecting users from material included in videos only. We include a brief summary of the main provisions of the VSP regime which are potentially relevant to the broader points covered in the report.

9 ‘Category 1’ refers to certain user-to-user services categorised based on user numbers and functionalities. Services in this category are subject to additional duties related to transparency, user empowerment and protection of democratic and journalistic content. ‘Category 1 threshold conditions’ are set the Secretary of State, with advice provided by Ofcom. Ofcom will then be responsible for designating services into categories according to these thresholds. 10 See section 368S of the Communications Act 2003. A full list of notified services may be found on the Ofcom website: Notified video-sharing platforms - Ofcom; they include, among others, TikTok, Twitch and Snap

Classification: HIGHLY SENSITIVE Under the VSP Framework, VSP providers are required to take safety measures as are appropriate to protect children (under 18s) from videos containing ‘restricted material’. Importantly, they must also ensure that the measures they take are implemented effectively. ‘Restricted material’ includes material which might impair the physical, mental, or moral development of under 18s. The relevant legislation does not specify particular examples of such material. However, in our guidance for providers on measures to protect users, we state that VSPs should consider a range of harms, including self-injurious content which may cause physical harms, such as material promoting eating disorders, self-harm and suicide. It is for each VSP provider to decide what safety measures to take that are appropriate and proportionate for protecting children on their service from videos containing potentially harmful material. Where we have concerns about the measures a platform has in place, we will consider taking further action to push improved outcomes for children. This may include, where appropriate, targeted supervision or the use of enforcement powers. Our learnings under the VSP regime will help us prepare for the broader online safety regime.

iii. Conclusion The death of Ms Macdermott highlights the tragic impact that suicide and self-harm content can have. Ofcom is committed to addressing the risk of harm from such content effectively and proportionately. Government and Parliament have signalled the importance of tackling such content by designating illegal suicide content as a priority offence and legal suicide content as primary priority content that is harmful to children, and our strategic priorities reflect this. As we have set out in our approach to implementing the Online Safety Act, once the regime is in force we expect change. Specifically, we anticipate implementation of the Act will ensure people in the UK are safer online by delivering four outcomes:
• stronger safety governance in online firms;
• online services designed and operated with safety in mind;
• choice for users so they can have meaningful control over their online experiences; and
• transparency regarding the safety measures services use, and the action Ofcom is taking to improve them, in order to build trust. We have set out that we will expect all in-scope services to have appropriate trust and safety measures tackling the full range of harms listed in the Act. In particular, we want to see wider deployment and improvements in services’ measures to address areas which pose the greatest risk to people, including illegal and harmful suicide content, to protect UK users, especially children. We are committed to working with industry to ensure compliance with these duties, and to this end our draft illegal harms Codes of Practice include specific measures which we propose would allow services to meet their duties in an effective and proportionate manner. We will ensure that through consulting on our proposals we seek input and engagement with external experts. We will also work directly with services to promote compliance, including – where appropriate – through targeted supervision. Where we identify non-compliance, we will not hesitate to take enforcement action where appropriate to protect users from harm. We will have the powers to require non-compliant service

Classification: HIGHLY SENSITIVE providers to take remedial action and to impose financial penalties where necessary, as well as powers to seek business disruption measures in serious cases.11 Evidence included in reports from coroners and other experts will play an important role in our policy proposals and response as we implement the regime, and we will of course take the evidence in your report into account as we continue our policy development. We hope that this response provides helpful information about the significant steps Ofcom is taking as we continue to work through the implementation of the Act. If further information or clarification is required, we would be happy to provide this.

Dear Mr Rogers,

Thank you for your correspondence of 3 January to the Secretary of State for Culture, Media and Sport, , regarding your Regulation 28: Report to Prevent Future Deaths regarding the tragic death of Chloe Elizabeth MacDermott. Your correspondence was passed to the Department for Science, Innovation and Technology due to our responsibility for points raised in the report, including the Online Safety Act (the act).

First and foremost, I would like to extend my deepest condolences to the family and friends of Chloe. The government recognises that the internet can, in some cases, be used to access appalling content with devastating consequences. As you may know, the act received Royal Assent in October last year. This legislation will force companies to take more accountability for the safety of their users. I will address matters (2)-(8) from the report in my response, as per my department's remit and having engaged with the Ministry of Justice on the areas which fall into their remit.

As you will be aware, under section 2(1) of the Suicide Act 1961 (as amended by section 59 of the Coroners and Justice Act 2009) it is an offence for a person to do an act capable of encouraging or assisting the suicide or attempted suicide of another person, with the intention that their act will encourage or assist the other person to commit or attempt to commit suicide. The person committing the offence need not know the other person or even be able to identify them. An offence may be committed whether or not a suicide or attempted suicide takes place. Section 2(1) of the Suicide Act 1961 applies when the act of encouraging or assisting suicide is committed in England or Wales. Forums causing concern, such as the one mentioned in your report, are often hosted outside the UK, which may prevent successful prosecution due to issues related to jurisdiction and enforcement. Under common law rules in cross-border cases, however, the courts of England and Wales will have jurisdiction over an act done outside the jurisdiction if it has a "substantial connection" with the jurisdiction (unless it could be argued that the conduct ought to be dealt with by the courts of another country). Whether or not this test is met in any individual case will be a matter for the Court.

Providing information about or discussing the issue of suicide, where there is no intention to encourage or assist suicide, is not an offence. There can, of course, be a fine line between simply providing information about suicide, sharing content that unintentionally has the effect on an individual of encouraging them to take their life, and someone intentionally encouraging a person to take their own life. There is a difficult balance to be struck between reducing the availability of harmful material and allowing the positive contribution that the internet can provide for those seeking help and support to overcome suicidal feelings. The 1961 criminal offence has a high threshold to avoid criminalising people who are expressing suicidal feelings and those offering them support.

I will now turn to the provisions in the act, and how the regulatory framework will address online suicide content, such as the type of content that Chloe may have accessed before her death. The act's illegal safety duties will apply to all in-scope 'user-to-user' services which allow users to post content online, or to interact with each other - including online forums. This means that once these duties are in force, they will be required to have systems and processes in place to proactively prevent users from encountering priority illegal content via their service and to minimise the length of time for which such content is present. The priority offences are set out in schedules 5, 6 and 7 and includes content that amounts to an offence under the Suicide Act
1961. This will help to protect all users - children and adults - from encountering this appalling content. The act also creates a new offence of intentionally encouraging or assisting serious self-harm. This offence applies to acts committed outside the UK if the act is committed by a person habitually resident in the UK. In other circumstances, the common law rules on jurisdiction will apply as with offences under the Suicide Act 1961. All in-scope user-to-user services will be required to put in place systems and processes that allow them to rapidly remove content where it reaches the threshold of this offence.

Search services will also have targeted duties that focus on mitigating and minimising the risk of users encountering illegal search content, including illegal suicide and self-harm search content. This includes, under section27(4), a requirement for search services to take or use, where proportionate, measures to be applied to the services' user support measures. The regulator now responsible for online safety, Ofcom, will recommend measures that search services can put in place to achieve these objectives. These could include removing results for sites that are known to host illegal suicide and self-harm content such as the forum you reference in your report, as well as signposting users that search for suicide methods away from this material and towards sources of support, which you highlight as a measure that was non-existent on the site Chloe had accessed. These duties will play a key role in reducing the volume of user traffic directed to websites with illegal suicide and self-harm content, reducing the ease at which users can find these kinds of horrifying sites and content.

It is especially important that children are protected from encountering content that may encourage them to self-harm or take their life. The act therefore places additional requirements on relevant in-scope online services to shield their child users from content that is legal, but nonetheless presents significant harm to them. All in-scope user-to-user services that are likely to be accessed by children will need to put in place systems and processes to prevent children of all ages from encountering legal content that encourages, promotes, or provides instructions for suicide or deliberate self-injury. Ofcom will recommend the measures companies can put in place to fulfil this objective. Many services prohibit this kind of content on their service, but where services actively permit it the act places more robust requirements on them - in acknowledgement of the serious risk this content poses to children. User-to-user services that allow these types of content are required to put in place systems and processes to prevent children from accessing this damaging content, including the use of highly effective age verification or age estimation solutions.

The government is acutely aware that users may decide to use virtual private networks (VPNs) to bypass protections, which is an issue you have raised. Under the act, in scope services will need to consider any risks arising from how their service is used as part of their illegal content and child safety risk assessment duties and then effectively mitigate and manage risks that they identify. Service providers may therefore be required to think about how safety measures they put in place could be circumvented - including through the use of VPNs - and take steps to prevent that or risk being treated as non-compliant. Ofcom is currently running a public consultation on its draft 'illegal content duties' codes of practice and details of this are on its website: https://www.ofcom.org.uk/consultations-and-statements/category-1/protecting-people- from-illegal-content-online.

There will be sites and services that choose not to comply with the act's regulatory framework. In these instances, Ofcom has a suite of robust enforcement powers to support its regulatory functions. These extend to instances where companies are based overseas but have a significant number of UK users or the UK as a target market. Ofcom's powers include the ability to apply to the court for business disruption measures. These are court orders that require third parties (those who provide an access facility to such services, such as internet service providers) to prevent, restrict or deter access to non-compliant services in extreme circumstances.

Every suicide is a tragedy, and it is essential that the vital protections delivered for users by the act come into force as soon as possible. My department is working closely with Ofcom to ensure that the implementation of the framework is as short as possible and all users, especially vulnerable users, get the online protections they so greatly need and deserve.