Over nearly four years, four prime ministers and five secretaries of state, the UK’s online safety bill appears to be approaching its messy final stages. This can be the ugly bit of lawmaking, even without internecine warfare in the Conservative party to manage.
A bust up over freedom of speech forced changes on how so-called “legal-but-harmful” content should be treated when viewed by adults. The rules remain in place for children — and seem likely to go further by introducing the threat of prison sentences, as well as large fines, for senior managers who fail to protect under-18s online.
Every element of an increasingly unwieldy and complicated package has been dissected since the online harms white paper was published in 2019. The wrangling continues. The eventual legislation will be an ambitious attempt to regulate the social media world in particular, one that presents huge challenges in terms of its implementation and enforcement. But the bill has drifted from its original intent, in a way that is probably unhelpful for everyone.
Nobody really knows how this regulation will work in practice. Much of the detail is pushed to regulator Ofcom to determine, through codes of conduct for example, and into secondary legislation. Social media companies, such as Meta, Snap and TikTok, are grappling with how age verification could work. There is a big question outstanding, says Ellen Judson at think-tank Demos, about what the acceptable margins for error might be in either the policing of users’ ages, or the control of restricted content.
The original intention — and what underpinned the slightly grandiose ambition to make the UK the “safest place in the world” to be online — was to avoid some of this complexity. Rooted in work done by charitable foundation focused on wellbeing Carnegie UK, the idea was that regulating complex areas is best done by a duty of care approach, rather than having reams of rules. One example, used by Carnegie, was the 1974 Health and Safety at Work Act, which replaced thousands of pieces of legislation putting the burden back on to companies to assess the risks, put in place solutions and deliver decent outcomes, in terms of the safety of their employees.
The impossibility of vetting millions of pieces of content, or in having rules specifying the ever-changing nature of potential harm online, meant that a so-called systems approach, focused on corporate policies and processes to reduce harm, made more sense. This is not particular to tech: in the realm of financial, rather than mental, health regulators are asking banks and insurers to consider “foreseeable harm” and consumer outcomes from the inception of products, rather than waiting for regulatory action when things go wrong.
In tech, it had the advantage of encompassing the product design, user nudging or algorithmic promotion of harmful material rather than just what stayed up or got taken down. In essence, it introduced regulatory grit into the ‘move fast and break people’ — sorry, things — ethos of the tech sector.
What is left now looks like a regulatory hodgepodge, something that the parliamentary process could yet address. In removing the measures around legal-but-harmful content for adults, such as promotion of self harm, eating disorders or suicide, the government also cut some requirements such as risk assessments that underpinned the duty of care approach.
The replacements look pretty weak (such as enforcing terms of service) or stray into content moderation (such as the ability for users to filter out certain harmful, abusive or hateful content). This doesn’t address the issue of vulnerable people being bombarded with harmful content (or even require the provision of information on how a company handles the issue). It also brings more operational complexity for platforms, notably with a total shift in regulatory approach on a user’s 18th birthday.
The lack of agreement within the Conservative party in parliament has generated some semblance of accord from campaigners and some tech groups outside it. But the ambition to be world-leading has resulted in a regulatory incoherence that will need resolving to be workable.
