Communications and Digital Committee
Tuesday 15th September 2026
Skip to latest contribution
This debate has concluded
(began 1 month, 3 weeks ago)
Watch LiveSkip to latest contribution
This debate has concluded
14:17
Baroness Keeley
-
-
Baroness Keeley
Two one. Good afternoon, everyone, and welcome to this meeting of the Communications and Digital Committee. Today we are holding our second evidence session in our inquiry on the Online Safety Act. The Act established Ofcom as UK's online safety regulator. So I'm very pleased that we have representatives from Ofcom here today at this early stage of the work. Thank you all for joining us. Could I start to, by asking each of you to introduce yourself and your role at Ofcom? So can we.
14:17
14:17
14:17
14:17
14:17
14:17
14:18
Speaker 1
-
Speaker 1
Yes, I'm very happy to. I'll pass over to Mark, who's been overseeing this work. And I suppose just a quick introduction. We see there have been three major pieces of work that we're balancing. One is the implementation of the act, where we're getting relatively close to the end on that. The second is driving compliance with the Act and look forward to going into detail on that. And then third is the social media ban and related new duties that are coming, coming ofcoms way.
And our job is really to balance those three. Mark, can I pass over to you?
And our job is really to balance those three. Mark, can I pass over to you?
14:18
Lord Knight of Weymouth
-
-
Lord Knight of Weymouth
Yes. I'll try to go through it fairly briefly. And then of course, happy to take follow up questions. So the committee will be aware that there are three major planks to the Online Safety Act. Duties regarding illegal harms. Duties regarding the protection of children from certain types of legal material, and then particular duties applying to categorize services and our judgment when the act was passed in late 2023, was that the priority was to bring the duties into force as quickly as possible, and the act required us to write codes of practice for illegal harms and protection of children in order to to do that.
So the first focus of our work was to bring those duties into force. That took around 18 months from passage of the act. There's a statutory deadline which we met to bring the protection of children codes into force. So since early 2025, those duties have been enforced and we've been able to take action against them. The third part of the act, again, as the committee will be aware, was delayed as a result of Wikimedia's judicial review of the categorisation process, which completed last summer.
So that has been slower than our original roadmap intended. We published the Register of Categorised Services last summer, and a consultation on the duties that apply to categorised services, and that consultation is about to conclude. And probably the final thing I'll say is, of course, the Act has been amended since the original passage, particularly through the Crime and Policing Act, for example, which brought in new priority offences. So we've also been implementing those.
The new offences relating to cyberstalking and serious self-harm came into force earlier this summer and will be publishing proposals on the 48 hour take down duty for non-consensual, intimate imagery later this year. So that's where we are currently. By around the middle of next year, we would expect to complete that work on categorised services. But of course, the other big thing that's changed more recently is the government's new plans for online safety, including the social media ban and possible regulation of AI services.
And I'm sure we'll come back to that. But we're talking to government at the moment about the implications of that for our work programme and resources. Yeah,
So the first focus of our work was to bring those duties into force. That took around 18 months from passage of the act. There's a statutory deadline which we met to bring the protection of children codes into force. So since early 2025, those duties have been enforced and we've been able to take action against them. The third part of the act, again, as the committee will be aware, was delayed as a result of Wikimedia's judicial review of the categorisation process, which completed last summer.
So that has been slower than our original roadmap intended. We published the Register of Categorised Services last summer, and a consultation on the duties that apply to categorised services, and that consultation is about to conclude. And probably the final thing I'll say is, of course, the Act has been amended since the original passage, particularly through the Crime and Policing Act, for example, which brought in new priority offences. So we've also been implementing those.
The new offences relating to cyberstalking and serious self-harm came into force earlier this summer and will be publishing proposals on the 48 hour take down duty for non-consensual, intimate imagery later this year. So that's where we are currently. By around the middle of next year, we would expect to complete that work on categorised services. But of course, the other big thing that's changed more recently is the government's new plans for online safety, including the social media ban and possible regulation of AI services.
And I'm sure we'll come back to that. But we're talking to government at the moment about the implications of that for our work programme and resources. Yeah,
14:21
14:21
Lord Knight of Weymouth
-
-
Lord Knight of Weymouth
Our current programme envisages the duties on categorised services all being in force in the middle of 2027. So that would be the point at which the initial set of duties are fully in force. But as I say, that's subject to ongoing discussions with government about how we sequence that with other work that's that's coming.
14:21
14:21
Speaker 1
-
Speaker 1
I'll take that one. So I mean, to step back from this. We were fully loaded in terms of the amount of work we had to do before the social media ban was announced. You know, we've recognised how important this is and we've moved staff to work directly on the social media ban since that announcement earlier in the summer, you know, but I think it's kind of clear that without extra staff and extra funding, then something will have to give.
And so we were very pleased to have the government's commitment back in June that they would provide extra funding so that we were able to balance both of these. We submitted a detailed business plan in July on that, and we are in detailed discussions with the government at the moment, and that's both on funding and sequencing, because there's a big body of work. As Mark was setting out, we will be looking to then set out a roadmap by the end of this year.
So a revision in terms of how we're able to deliver all of the bits. Our view is this is doable as long as it's resourced and sequenced. Right. Okay.
And so we were very pleased to have the government's commitment back in June that they would provide extra funding so that we were able to balance both of these. We submitted a detailed business plan in July on that, and we are in detailed discussions with the government at the moment, and that's both on funding and sequencing, because there's a big body of work. As Mark was setting out, we will be looking to then set out a roadmap by the end of this year.
So a revision in terms of how we're able to deliver all of the bits. Our view is this is doable as long as it's resourced and sequenced. Right. Okay.
14:23
14:23
Lord Knight of Weymouth
-
-
Lord Knight of Weymouth
Yeah, I think there's a few things that I would say. First of all, I think the process of consultation we've learned a lot more about because, as I said, we were keen to begin the process of bringing the duties into force so quickly. And we published our initial proposals about regulating illegal harms very shortly after the act passed. And of course, at that point, we hadn't had much time to engage with industry or to use our formal information gathering powers to understand current practice, or indeed to engage with civil society about what campaigners and expert bodies thought was possible.
So that first piece of work, although I think it was the right judgment to try to bring the duties into force as quickly as possible. I think we've learned more about how we engage effectively with stakeholders, both in industry and in civil society , as we go through the process of making policy. So, for example, with the work on women and girls and the guidance that we published last year, that was done in a very collaborative way, at least we felt it was very collaborative with the women's sector and with regulated services, so that we could understand and push further through that policy work than we were, than we had been able to initially.
And we're taking the same approach where we can, to the duties on categorised services. So, for example, on transparency reports, we've had a lot of conversations with civil society about what what information they would find useful to see in the in the public domain. So that's one area. And I think the second area I would emphasize is the the impact of what's known as the safe harbour in the Act. And we'll probably come back to this as well.
So I won't say too much about that now, but it's become clearer to us the extent to which the codes of practice act as a kind of framework for companies to comply with the act, which can be very positive because the codes give clear indications to companies about what they need to do to comply. But they can also be limiting, because if it's too straightforward for companies to demonstrate that they take all the steps in the codes, then they're deemed compliant with the duties.
And that. Right.
So that first piece of work, although I think it was the right judgment to try to bring the duties into force as quickly as possible. I think we've learned more about how we engage effectively with stakeholders, both in industry and in civil society , as we go through the process of making policy. So, for example, with the work on women and girls and the guidance that we published last year, that was done in a very collaborative way, at least we felt it was very collaborative with the women's sector and with regulated services, so that we could understand and push further through that policy work than we were, than we had been able to initially.
And we're taking the same approach where we can, to the duties on categorised services. So, for example, on transparency reports, we've had a lot of conversations with civil society about what what information they would find useful to see in the in the public domain. So that's one area. And I think the second area I would emphasize is the the impact of what's known as the safe harbour in the Act. And we'll probably come back to this as well.
So I won't say too much about that now, but it's become clearer to us the extent to which the codes of practice act as a kind of framework for companies to comply with the act, which can be very positive because the codes give clear indications to companies about what they need to do to comply. But they can also be limiting, because if it's too straightforward for companies to demonstrate that they take all the steps in the codes, then they're deemed compliant with the duties.
And that. Right.
14:25
14:25
Baroness Keeley
-
-
Baroness Keeley
fine. Thank you. So in our first evidence session, we we had the children's commissioner who in fact is clearly is the most senior safeguarding person in the country for children. So that's why we had her as our first session, she said she told us that she had requested to see the risk assessments that online services must now produce, and that Ofcom would not provide them. So are you able to give us any further detail on that?
14:26
Speaker 1
-
Speaker 1
I'm happy to take that point. So we have worked very closely with the children's Commissioner. I mean, the children's Commissioner has been running a panel of children for us, which has been a very important input for us into our policy making and, you know, generally have really valued the insights they've been able to provide from from lived experience. I mean, on this particular point, we haven't received a formal request in terms of making the risk assessments available to them.
The important thing here is that under section 303 of the Online Safety Act, we have a requirement that we need to get the consent of a company before we're able to share it with a third party, but we're very happy if the children's commissioner wants to provide us with a formal notification that they'd like. This will then liaise with the companies and see if they're prepared to release.
The important thing here is that under section 303 of the Online Safety Act, we have a requirement that we need to get the consent of a company before we're able to share it with a third party, but we're very happy if the children's commissioner wants to provide us with a formal notification that they'd like. This will then liaise with the companies and see if they're prepared to release.
14:27
14:27
14:27
14:27
14:27
14:27
14:27
14:27
14:27
14:27
14:28
Speaker 1
-
Speaker 1
Would you like me to take the first one? I mean, this is the fundamental question, isn't it? And you know, we are here to make life safer online. We are absolutely focused on making sure that we are driving significant change. We think there has been really big change that we've seen in the sectors that are covered by the Online Safety Act. We actually published a business survey earlier this week that was looking at 125 companies in this range, from small to large.
What they were saying was that 76% of them had completed a risk assessment. It was saying that 44 of them, 44% of them had implemented changes. So they were coming into. Compliance with the act, and that 59% felt that they had been fully or substantively implemented the requirements. I think that that was an interesting sort of, you know, dip into, you know, we have 100,000 services that are in scope of the act.
I think the thing that's been most visible has been the step up in the use of highly effective age assurance. And this was from July of last year where the requirement came into place. We've seen some of the very big services put age gates in place. I mean, that can include Reddit and Discord, for example. And if you look across the pornography sector, which I think is a real blight for children, the ease with which they're able to access pornographic material, we have highly effective age assurance that is being taken up across what is a very large sector.
And so we have all of the top ten porn services now have age gates in place. We have three quarters of the top 100 that have age gates in place, or they've chosen to geo block from from the UK. And we've seen a 23 fold increase in terms of the number of age checks that that are going on across the sample of 32 companies that that we looked at. We think this is substantively reducing the amount of porn that that children are able to see.
I think some of the stuff that's been much less visible has been the choice that a number of services have made to geo block their services. So this is when we get in touch, often to inform a company of its obligations under the Online Safety Act. And this can be through enforcement as well. And that company then chooses to block UK access to their sites. This has happened on a very prominent suicide forum, for example.
It's also happened on a range of file sharing sites that we were very concerned about in terms of the prevalence of child sexual abuse material there, and also on some that had legal but harmful material in terms of violent conduct and so forth. So we've seen that happening broadly where we've been less content, certainly less content has been in terms of some of the large services most used by by children. And so, you know, we were pleased earlier in this year to have some commitments secured from X in terms of hate and terror, takedown times from matter and from snap, particularly on grooming.
And we think that's going to be very important as those come through on those particular services. And, you know, generally when you look at our tracking indices on this, the overall effect we're underwhelmed by so far. But you know, what this is, is I think a one way ratchet that is going to be building up over time. And we're confident that the commitments that we've seen from some of the big services and the continuing momentum that we have is going to make a significant change over time.
What they were saying was that 76% of them had completed a risk assessment. It was saying that 44 of them, 44% of them had implemented changes. So they were coming into. Compliance with the act, and that 59% felt that they had been fully or substantively implemented the requirements. I think that that was an interesting sort of, you know, dip into, you know, we have 100,000 services that are in scope of the act.
I think the thing that's been most visible has been the step up in the use of highly effective age assurance. And this was from July of last year where the requirement came into place. We've seen some of the very big services put age gates in place. I mean, that can include Reddit and Discord, for example. And if you look across the pornography sector, which I think is a real blight for children, the ease with which they're able to access pornographic material, we have highly effective age assurance that is being taken up across what is a very large sector.
And so we have all of the top ten porn services now have age gates in place. We have three quarters of the top 100 that have age gates in place, or they've chosen to geo block from from the UK. And we've seen a 23 fold increase in terms of the number of age checks that that are going on across the sample of 32 companies that that we looked at. We think this is substantively reducing the amount of porn that that children are able to see.
I think some of the stuff that's been much less visible has been the choice that a number of services have made to geo block their services. So this is when we get in touch, often to inform a company of its obligations under the Online Safety Act. And this can be through enforcement as well. And that company then chooses to block UK access to their sites. This has happened on a very prominent suicide forum, for example.
It's also happened on a range of file sharing sites that we were very concerned about in terms of the prevalence of child sexual abuse material there, and also on some that had legal but harmful material in terms of violent conduct and so forth. So we've seen that happening broadly where we've been less content, certainly less content has been in terms of some of the large services most used by by children. And so, you know, we were pleased earlier in this year to have some commitments secured from X in terms of hate and terror, takedown times from matter and from snap, particularly on grooming.
And we think that's going to be very important as those come through on those particular services. And, you know, generally when you look at our tracking indices on this, the overall effect we're underwhelmed by so far. But you know, what this is, is I think a one way ratchet that is going to be building up over time. And we're confident that the commitments that we've seen from some of the big services and the continuing momentum that we have is going to make a significant change over time.
14:31
14:31
Speaker 1
-
Speaker 1
Well, look, we share the frustration. I mean, what we are doing here is looking to make a really significant cultural change across a number of companies that have acted with impunity for a long time. And, you know, these are corporate cultures that have built up over decades. And when you look at the fundamental architecture that's set up in the act, this is one of driving corporate change. This is why the approach into it has been via risk assessments rather than taking down content.
It's about making sure that incentives for leaders are changed. And I'm afraid that is something that takes a degree of time, especially when it's spread over such a broad set of sectors that we've got. So I absolutely share the frustration. I've come into this job to make sure that we are making life better, especially for children, but it's something that we are still at an early point on the journey of.
It's about making sure that incentives for leaders are changed. And I'm afraid that is something that takes a degree of time, especially when it's spread over such a broad set of sectors that we've got. So I absolutely share the frustration. I've come into this job to make sure that we are making life better, especially for children, but it's something that we are still at an early point on the journey of.
14:32
14:32
Lord Knight of Weymouth
-
-
Lord Knight of Weymouth
Well, just just one quick build on that. I think what we've seen is steps along the road, but still a long way to go to the destination. And to give you one example, Oliver was mentioning the work we've done with some of the biggest services on protecting children earlier this year. And some of those firms have made very positive commitments to make it harder for strangers to approach children. But we're not yet sure that they've got good enough ways of identifying who the children are, who are using their services, and therefore you can change one system.
But if you're not changing the whole system, then you're not you're not achieving the the goal. And there's still a long way to go.
But if you're not changing the whole system, then you're not you're not achieving the the goal. And there's still a long way to go.
14:33
14:33
Speaker 1
-
Speaker 1
Well, I mean, this is the I mean, this is what the act was primarily aimed for. And I think, you know, society has has said absolutely, there is not a freedom to operate in this space. And I think if you look at initiatives like the social media ban, there is a sense that there needs to be an intervention to address a problem that's there. But the act itself, of course, put duties on the companies.
And so it's clear that that is where the the duty lies for them. And I think society does not accept that companies are able to act in the way that they are at the moment.
And so it's clear that that is where the the duty lies for them. And I think society does not accept that companies are able to act in the way that they are at the moment.
14:34
14:34
Speaker 1
-
Speaker 1
So you in that question being you that the social media site. Yes. Yeah. So yes. And we certainly, I think will come on later to the enforcement process that we go through. I mean, as it stands, we if a company we suspect to be in breach, we will then we can launch an enforcement case against it. If they don't, then come into compliance with the act at the end, we have the option to have a business disruption measure that will stop their access to the UK.
Obviously, that's not taking down the site internationally. And, you know, the the territorial reach of this act only goes as far as the UK. We're very clear about that. But we have that opportunity to have business disruption measure which will be applied via a court.
Obviously, that's not taking down the site internationally. And, you know, the the territorial reach of this act only goes as far as the UK. We're very clear about that. But we have that opportunity to have business disruption measure which will be applied via a court.
14:35
14:35
Speaker 1
-
Speaker 1
Look, I think there's good anecdotal evidence that things are moving in the right direction. We've got a very significant monitoring and evaluation programme that we've put in place so that we are tracking exactly those sort of questions. So it's not just a case of seeing what changes have been made by the services, but also what the actual lived experience of people as it moves through. I certainly think that we are moving in the right direction on this, and this is against a background where we have seen the proliferation of AI over the last couple of years, which in many ways has been sucking things the other way.
But this has become a much easier way, for example, to create and then disseminate child sexual abuse material. For example, we're seeing a whole range of ways where harms can be supercharged. So certainly I think we have a sort of on the scales that the Online Safety Act, I think is making a significant impact. But we're also having an environment where AI think is supercharging a number of harms themselves.
But this has become a much easier way, for example, to create and then disseminate child sexual abuse material. For example, we're seeing a whole range of ways where harms can be supercharged. So certainly I think we have a sort of on the scales that the Online Safety Act, I think is making a significant impact. But we're also having an environment where AI think is supercharging a number of harms themselves.
14:36
14:36
14:36
Speaker 1
-
Speaker 1
Sure. Well, I'll start briefly and then Mark turn over to you. So, I mean, there have been a number of gaming services that have introduced age gates themselves. So Xbox, for example, steam as well. It's an important area of focus for us. It hasn't been absolutely front and centre for us, just to be clear in that obviously we're needing to prioritise as we go through and social media and protection of children through.
That has been something that's been higher on our list. But Mark, I'll turn it over to you.
That has been something that's been higher on our list. But Mark, I'll turn it over to you.
14:37
Lord Knight of Weymouth
-
-
Lord Knight of Weymouth
Yeah, I mean, I my main focus there has been on the interactions between different users of these games. And of course, in particular with services like Roblox, you know, we do have evidence of those platforms being used by people who wish, wish children harm. And the controls that we've recommended there in terms of age verification and ensuring that adults can't approach children they don't know, I think have been effective. I think there are broader issues with with gaming that aren't necessarily captured by the duties that we have to uphold violence in games, screen time.
You know, there's a whole host of questions which, you know, were maybe not uppermost in the debate when the act was first passed, or at any rate, were not captured by the the scope of the legislation. So in that sense, our engagement with gaming maybe is a little bit narrow. And but we have tried to focus on the issues where we think we can make a difference. And in particular, as I said, things like roadblocks have been a really important service for us.
You know, there's a whole host of questions which, you know, were maybe not uppermost in the debate when the act was first passed, or at any rate, were not captured by the the scope of the legislation. So in that sense, our engagement with gaming maybe is a little bit narrow. And but we have tried to focus on the issues where we think we can make a difference. And in particular, as I said, things like roadblocks have been a really important service for us.
14:38
14:38
14:38
14:38
Lord Knight of Weymouth
-
-
Lord Knight of Weymouth
So I think this is really important issue and not one that I can give you a simple answer to, because I think it's there are some complicated issues to weigh up. What I would say is that the original legislation, in effect, created sort of two parallel frameworks, almost. There is the risk based component where companies have to assess risks and take steps to mitigate the risks. And then there are the codes of practice and the safe harbour and the challenge that we see, and a number of stakeholders have highlighted the same challenge is that if companies do all the things in our codes of practice, then they're deemed to be compliant with the act, even if they still have risks that haven't been adequately addressed through those measures.
And and that that is a tension with the safe harbor. And I think it does cause us problems because it doesn't then give us a locus to go back to them and say, well, what about this problem that you've acknowledged and still haven't done anything about? Or at least we can do that on a kind of, you know, voluntary supervisory way. But we we can't we can't enforce. Now, the reason it's I can't give you a very straight answer is because the reason that that system was put in place was to give companies legal certainty about what they needed to do in order to comply.
And that legal certainty is also important to our ability to enforce against them. Because if companies if we're not clear with companies about what they need to do to come into compliance, then it's very hard for us to to successfully bring investigations against them. So the Act was trying to sort of have its cake and eat it, you know, to have this very broad risk based framework, but also create legal certainty for companies. Now, you know, I think I do I think we would be in a stronger position if there were a duty on companies to mitigate all the risks in their assessment, even if that required them to take steps beyond the codes of practice.
But we'd have to be really clear that that would not be an easy journey to enforce. And therefore, that's not necessarily a quick route to big fines or concluding investigations, but it gives us more scope to engage with firms. And I think personally, particularly for the biggest services, more flexibility in the way in which we engage them on the risks in their assessment would would be helpful in terms of us being able to hold them to account.
And and that that is a tension with the safe harbor. And I think it does cause us problems because it doesn't then give us a locus to go back to them and say, well, what about this problem that you've acknowledged and still haven't done anything about? Or at least we can do that on a kind of, you know, voluntary supervisory way. But we we can't we can't enforce. Now, the reason it's I can't give you a very straight answer is because the reason that that system was put in place was to give companies legal certainty about what they needed to do in order to comply.
And that legal certainty is also important to our ability to enforce against them. Because if companies if we're not clear with companies about what they need to do to come into compliance, then it's very hard for us to to successfully bring investigations against them. So the Act was trying to sort of have its cake and eat it, you know, to have this very broad risk based framework, but also create legal certainty for companies. Now, you know, I think I do I think we would be in a stronger position if there were a duty on companies to mitigate all the risks in their assessment, even if that required them to take steps beyond the codes of practice.
But we'd have to be really clear that that would not be an easy journey to enforce. And therefore, that's not necessarily a quick route to big fines or concluding investigations, but it gives us more scope to engage with firms. And I think personally, particularly for the biggest services, more flexibility in the way in which we engage them on the risks in their assessment would would be helpful in terms of us being able to hold them to account.
14:41
14:41
Lord Knight of Weymouth
-
-
Lord Knight of Weymouth
Susie, I want to say a little bit more about this, but simply enforcement is easiest when there's a clear requirement and we can point at what a company is doing and show that there's a gap. So age verification is relatively straightforward, not always straightforward, but relatively straightforward in the sense that it's a clear duty to use these tools to keep under 18 seconds off your platform. And we can look at the technology that they're using. And it's a quick test relatively.
Are they using one of our approved forms of age assurance or not? The sorts of obligations that I'm talking about here would be much broader. It would be to sort of do everything within everything reasonable to, to address risks and in that phrase, do anything reasonable is room for a very lengthy and litigious debate with companies about whether they are, in fact, doing everything that's reasonable. And that's why the sort of tension would arise for us in in enforcing that sort of broad duty.
I'm not saying that's a bad idea, but I'm saying that those are the issues that we reflect on when we think about reform in this area.
Are they using one of our approved forms of age assurance or not? The sorts of obligations that I'm talking about here would be much broader. It would be to sort of do everything within everything reasonable to, to address risks and in that phrase, do anything reasonable is room for a very lengthy and litigious debate with companies about whether they are, in fact, doing everything that's reasonable. And that's why the sort of tension would arise for us in in enforcing that sort of broad duty.
I'm not saying that's a bad idea, but I'm saying that those are the issues that we reflect on when we think about reform in this area.
14:42
Viscount Colville of Culross
-
-
Viscount Colville of Culross
Right? I mean, would it help if we if they looked at schedule four of the act in which the when it comes to the principles in which the codes of practice are drafted, you look at whether the measures are proportionate. Many of the people I've spoken to, campaigners who are concerned about this have said that that should be replaced by a duty of care, which would mean that any. Any new products that are provided by the which are which were created by the.
The providers would then have to make sure that there was a duty of care. They didn't harm the users. It seems like quite a clear target for you to be able to enforce.
The providers would then have to make sure that there was a duty of care. They didn't harm the users. It seems like quite a clear target for you to be able to enforce.
14:43
Lord Knight of Weymouth
-
-
Lord Knight of Weymouth
Yes. I don't actually think the word proportionate is the problem there, I think, is the nature of the safe harbour and the codes of practice. But I do think there are other problems in schedule four, and I'm very appreciative of the committee looking at this area. For example, schedule four also says that our codes of practice have to contain clear and detailed steps that companies must take. And again, the phrase clear and detailed puts the onus back on us to specify what the specific action is that a company has to take, rather than putting the onus on the company to take the steps that they need to take to address the problems that they're that they're encountering.
So, you know, we think that's an area that the government might want to think about, too.
So, you know, we think that's an area that the government might want to think about, too.
14:44
14:44
Speaker 2
-
Speaker 2
Yeah I can so. Essentially the the way the codes of practice work, as we said, is a safe harbour. Now, one of the challenges is to make sure that the codes are accessible and applicable to the huge range of services that are in scope. And as, as Marcus said, and as you have pointed out, we have the proportionality. All the measures we recommend have to be technically feasible, and the measures have to be clear and detailed.
So that is trying to strike a balance between having a clear rule that we can assess a company against and say, you are not taking this measure or you're not taking it effectively, which would then take them outside of the safe harbour. And at that point, you go back to the basic duty and say, okay, are you taking proportionate measures to protect children from harm? Whichever duty you're looking at, a duty of care, obligation is is definitely an alternative way of doing it.
There. Again, you would have that. I guess the desire to make sure, particularly in such a large sector with such a huge number of very small services, to make sure that the parameters of what that means are set out quite carefully. So I suspect you might come up against the same challenges again, but certainly the the safe harbour approach, what what we are finding from the enforcement perspective is for the largest services, which probably have a lot of quite sophisticated measures in place, but aren't necessarily enough to actually address the harm that may be occurring on their service.
They will argue, you know, very vociferously that they are within that safe harbour, so we can't take further enforcement action against them. So it is a challenge.
So that is trying to strike a balance between having a clear rule that we can assess a company against and say, you are not taking this measure or you're not taking it effectively, which would then take them outside of the safe harbour. And at that point, you go back to the basic duty and say, okay, are you taking proportionate measures to protect children from harm? Whichever duty you're looking at, a duty of care, obligation is is definitely an alternative way of doing it.
There. Again, you would have that. I guess the desire to make sure, particularly in such a large sector with such a huge number of very small services, to make sure that the parameters of what that means are set out quite carefully. So I suspect you might come up against the same challenges again, but certainly the the safe harbour approach, what what we are finding from the enforcement perspective is for the largest services, which probably have a lot of quite sophisticated measures in place, but aren't necessarily enough to actually address the harm that may be occurring on their service.
They will argue, you know, very vociferously that they are within that safe harbour, so we can't take further enforcement action against them. So it is a challenge.
14:46
Baroness Keeley
-
-
Baroness Keeley
I mean, building, building on from the duty of care approach, I think we quite often hear cited and understand the the principle of safety. By design. I mean, how important is that in all of the points you're making about enforcement? Because I think it goes back to the question that Lord story asked. You know, it's not unreasonable for us to expect platforms and providers of services to be safe by design and particularly around children.
So is that something that you're working on? How are you? How are you giving that effect, if you like, in what you're doing?
So is that something that you're working on? How are you? How are you giving that effect, if you like, in what you're doing?
14:46
Lord Knight of Weymouth
-
-
Lord Knight of Weymouth
Yeah, it's absolutely linked to, to this discussion. And there's a couple of angles to it. In one sense, the act is all about safety by design, because we're not a content regulator and we don't tell the companies when an item of content or an account or whatever it is, should be taken down. All of our focus is on how have they designed their services and put in place the right trust and safety frameworks around their services, and the right governance around their services, to try to make sure that they're mitigating risks.
So, so safety by design is right at the heart, but it is limited by this point about the safe harbour, because I think the concept of safety by design is exactly, as you've described it, about designing a service to try to remove risk as far as possible. And now it's never going to be possible to remove all risk from the type of services that we're talking about here. But we think that in the end, the codes of practice put and the approach to codes of practice put all the weight on Ofcom to identify what it is that companies need to change.
And I think the the sentiment of safety by design, which I completely agree with, is that the onus should be on the companies to identify what they need to do to to address risk.
So, so safety by design is right at the heart, but it is limited by this point about the safe harbour, because I think the concept of safety by design is exactly, as you've described it, about designing a service to try to remove risk as far as possible. And now it's never going to be possible to remove all risk from the type of services that we're talking about here. But we think that in the end, the codes of practice put and the approach to codes of practice put all the weight on Ofcom to identify what it is that companies need to change.
And I think the the sentiment of safety by design, which I completely agree with, is that the onus should be on the companies to identify what they need to do to to address risk.
14:48
14:48
Baroness Fleet
-
-
Baroness Fleet
Thank you very much. And following on from that, I mean, in August, you did actually say many large, well-resourced companies are not yet doing enough to make people safer online. And as you know, the Molly Rose Foundation in June this year argued that teenagers overall exposure to high risk suicide, self-harm, depression and eating disorder content on major social media platforms has hardly has barely changed in the previous year. I mean, that's pretty condemning of how effective a the act is and be the implementation.
So, I mean, what's your reaction, particularly to the the specific claims of, of, of Molly Rose, who we we believe we can trust. Do you disagree with what they've said or do you feel that that you don't have the powers to actually enforce what the large majority of sensible people want to have enforce? What actually is stopping you going further, faster? It can't just be a matter of of money and people.
So, I mean, what's your reaction, particularly to the the specific claims of, of, of Molly Rose, who we we believe we can trust. Do you disagree with what they've said or do you feel that that you don't have the powers to actually enforce what the large majority of sensible people want to have enforce? What actually is stopping you going further, faster? It can't just be a matter of of money and people.
14:49
Lord Knight of Weymouth
-
-
Lord Knight of Weymouth
Well, I pick up those specific points and Oliver might want to come back on the on the sort of broader questions. But as regards suicide and self-harm content, I think this does touch on another really important and not, I think, always well understood aspect of the act, which is about our ability to require them to use proactive monitoring tools to identify certain kinds of harmful content. So companies, as the committee will be aware, have two main ways of responding to harm.
They can receive reports and complaints and then take action retrospectively, or they can be using tools to proactively identify certain types of content and remove it before users are exposed to it, which clearly is, is is preferable. Now. Some of the firms tell us that they do use these automated tools, but we've not yet seen data from them to help us assess the effectiveness of those tools. And we're currently consulting on requirements to use these tools more widely.
The challenges in this area are really about the tension between use of those tools and users , privacy and freedom of expression. And because of concerns about privacy and freedom of expression, the act set out that we could only require those tools when we were convinced that they met certain thresholds for accuracy and effectiveness. And we are gathering evidence to try to stack up that case. And we'll be saying more about that .
Once we finalized our consultation in this autumn. We think those tools are key to dealing with the challenge that you've identified, but it's not clear on the face of the act that companies have to use them, and therefore we have to.
They can receive reports and complaints and then take action retrospectively, or they can be using tools to proactively identify certain types of content and remove it before users are exposed to it, which clearly is, is is preferable. Now. Some of the firms tell us that they do use these automated tools, but we've not yet seen data from them to help us assess the effectiveness of those tools. And we're currently consulting on requirements to use these tools more widely.
The challenges in this area are really about the tension between use of those tools and users , privacy and freedom of expression. And because of concerns about privacy and freedom of expression, the act set out that we could only require those tools when we were convinced that they met certain thresholds for accuracy and effectiveness. And we are gathering evidence to try to stack up that case. And we'll be saying more about that .
Once we finalized our consultation in this autumn. We think those tools are key to dealing with the challenge that you've identified, but it's not clear on the face of the act that companies have to use them, and therefore we have to.
14:51
14:51
Lord Knight of Weymouth
-
-
Lord Knight of Weymouth
Well, we talked a little bit about this area in our submission in the section about proactive tech. And as I say, it's not it's not a part of the legislation that has had a huge amount of discussion. We think it's right that we should have to think carefully before we require use of these tools, because they are very intrusive, because they require all material to be scanned by social media firms as it's uploaded. But we do think the case for that is strong.
And, you know, as I say, we're we're working on our proposals in this area at the moment. And we'll I think we'll have more to say about it before the the inquiry.
And, you know, as I say, we're we're working on our proposals in this area at the moment. And we'll I think we'll have more to say about it before the the inquiry.
14:52
14:52
14:52
Speaker 1
-
Speaker 1
I can start off on that one. Susie, maybe if you want to take more detail on it. So I mean, if you take the example of grok on on X at the beginning of this year, this was something that just suddenly kind of burst onto the scene over the Christmas period. We were on to this extremely quickly, and we had launched an investigation within two weeks. And I think that's a good example where you have a clear new harm that's emerged, which was happening at scale.
And we felt the need to to move extremely quickly on it. You know, what we take in general are the 140 or so priority offences that are set out in the act that sets out our homes. And, you know, we are in constant dialogue with government in terms of emerging areas. We were very early to say that we thought that chatbots wasn't properly covered by the act as it was going through. So we have that policy dialogue going on.
We are always looking to see where we can get the best intelligence in terms of where harms are emerging. So we have very close links with law enforcement. For example, we were talking about Molly Rose Foundation earlier and a lot of other civil society groups, and we're just making sure that we are able to really be a repository of that data and intelligence that can drive us both in terms of what are the things we focus on strategically, but what also are the particular cases that that we're taking? But, you know, to go back to the case, I think that was evidence that when things are really blowing up, we have that ability to move quickly and quicker than our international peers.
And we felt the need to to move extremely quickly on it. You know, what we take in general are the 140 or so priority offences that are set out in the act that sets out our homes. And, you know, we are in constant dialogue with government in terms of emerging areas. We were very early to say that we thought that chatbots wasn't properly covered by the act as it was going through. So we have that policy dialogue going on.
We are always looking to see where we can get the best intelligence in terms of where harms are emerging. So we have very close links with law enforcement. For example, we were talking about Molly Rose Foundation earlier and a lot of other civil society groups, and we're just making sure that we are able to really be a repository of that data and intelligence that can drive us both in terms of what are the things we focus on strategically, but what also are the particular cases that that we're taking? But, you know, to go back to the case, I think that was evidence that when things are really blowing up, we have that ability to move quickly and quicker than our international peers.
14:54
Baroness Elliott of Whitburn Bay
-
-
Baroness Elliott of Whitburn Bay
Some of the evidence, some of the information we've had from stakeholders, we look at what Jeremy Wright said in a Westminster Hall debate recently. He said he finds in the support for the idea that we have to know something will work before we try it. Is that the approach you take, and will that not make you miss things?
14:54
14:54
Baroness Elliott of Whitburn Bay
-
-
Baroness Elliott of Whitburn Bay
There's a feeling coming through from the stakeholders that you. Everything has got to be proved beyond, beyond any doubt before you'll start and take action and prove that things will work. What you're going to do before you start and do them, is that the approach you're taking? And, and isn't that a bit sluggish and going to keep you constantly behind the curve?
14:55
Speaker 1
-
Speaker 1
We recently, as an organisation published our risk appetites and on legal that that was that we have an open risk appetite. So, you know, we don't want to make sure that we are absolutely certain that everything is going to work before we're prepared to take action. I would also point out that we are operating in a highly litigious environment. And so, you know, we currently have judicial reviews being run against us on our fees regime twice by meta.
We have a raft of services that are bringing judicial reviews against us for trying to collect data so we can monitor and evaluate what's happening with the regime. And on our categorisation register that we published in July, we have four services that are appealing to the upper tribunal in terms of that. So we absolutely are looking to make sure that we can drive change the best way we can. We really want to use all of the opportunities we have.
And, you know, we've all come to work to make this happen, but also making sure that if we run unnecessary risks, we are going to get absolutely clobbered legally by what is a very deep pocketed individuals and firms. And we need to make sure we've got that balance right. You know, we are also learning as we go. And I don't want to claim that, you know, anybody is expert at online regulation yet, you know, this is something it's been 18 months running this particular regime.
And we are very keen to learn as we go through it. Why
We have a raft of services that are bringing judicial reviews against us for trying to collect data so we can monitor and evaluate what's happening with the regime. And on our categorisation register that we published in July, we have four services that are appealing to the upper tribunal in terms of that. So we absolutely are looking to make sure that we can drive change the best way we can. We really want to use all of the opportunities we have.
And, you know, we've all come to work to make this happen, but also making sure that if we run unnecessary risks, we are going to get absolutely clobbered legally by what is a very deep pocketed individuals and firms. And we need to make sure we've got that balance right. You know, we are also learning as we go. And I don't want to claim that, you know, anybody is expert at online regulation yet, you know, this is something it's been 18 months running this particular regime.
And we are very keen to learn as we go through it. Why
14:56
Baroness Elliott of Whitburn Bay
-
-
Baroness Elliott of Whitburn Bay
do you think it's coming across from the stakeholders? We've heard from that you are slow to react. So, for instance, the CEO of the Molly Rose Foundation said Ofcom's agility in identifying responding to new harms, describing your approach as slow and reactive, let. The children's commissioner likewise said that Ofcom has not been getting ahead of the harms. Why do you think that perception is? If you're telling me that's not what you're doing? So that's coming from various people.
It's not one person.
It's not one person.
14:56
Speaker 1
-
Speaker 1
Sure. Well, I think my observation on that is it is extraordinarily broad. And so this is something that is applying to over 100,000 services, and we need to make sure that we have got focus on particular areas to make any progress. I think if we spread ourselves thin across all of the 140 or so priority offences, nothing's going to happen. We're going to have a great press release. We can say that we are doing a particular thing.
We are not going to be able to drive systemic change in particular areas. And so I think, you know, when we are focusing on particular harms and areas of concern, there are inevitably other things that aren't a particular focus of us. And I think, you know, if that is your particular interest as a group, they all matter. They all matter a tremendous amount. But that is not where we're going to be putting our organisational focus at that particular time.
The time will come, I hope, for those things in time, but the very process of choosing means that there are certain areas where we're not going to be able to put much focus at this particular point. Thank you. Thank
We are not going to be able to drive systemic change in particular areas. And so I think, you know, when we are focusing on particular harms and areas of concern, there are inevitably other things that aren't a particular focus of us. And I think, you know, if that is your particular interest as a group, they all matter. They all matter a tremendous amount. But that is not where we're going to be putting our organisational focus at that particular time.
The time will come, I hope, for those things in time, but the very process of choosing means that there are certain areas where we're not going to be able to put much focus at this particular point. Thank you. Thank
14:58
Lord Kirkhope of Harrogate
-
-
Lord Kirkhope of Harrogate
Well, I think you've got a bit of a problem here, a bit of a perception difficulty, because what you're telling us all sounds utterly reasonable, but in the view of an awful lot of people, or at least the perception they have of you, is that you simply do not use your. I think the term used by the Children's Commissioner. You don't use your teeth. I don't want to get into any dental analogies at this point, but certainly there is a view.
There is a feeling that you're not using the powers that you have in an aggressive enough way. And in a way, I'm pointing slightly towards Miss Katie here, who's an enforcement enforcement officer, a lawyer. Is it because you are confined by the legal process that you don't behave in a more. I would use the word aggressive. Perhaps that's not the right word, but a more proactive way. Is it to do with the law? Is it to do with your reluctance to get into fights with others? And you've made a suggestion a moment ago that you've got to be very careful, obviously, because people take action, judicial review, all sort of things are hitting you.
I want to know, really, whether you think you've got enough going for you that you can actually do what you're supposed to do, and to do it in a sufficiently busy way, a noisy way that you actually then redeem yourselves, get the perception better, as well as getting some action.
There is a feeling that you're not using the powers that you have in an aggressive enough way. And in a way, I'm pointing slightly towards Miss Katie here, who's an enforcement enforcement officer, a lawyer. Is it because you are confined by the legal process that you don't behave in a more. I would use the word aggressive. Perhaps that's not the right word, but a more proactive way. Is it to do with the law? Is it to do with your reluctance to get into fights with others? And you've made a suggestion a moment ago that you've got to be very careful, obviously, because people take action, judicial review, all sort of things are hitting you.
I want to know, really, whether you think you've got enough going for you that you can actually do what you're supposed to do, and to do it in a sufficiently busy way, a noisy way that you actually then redeem yourselves, get the perception better, as well as getting some action.
14:59
Speaker 2
-
Speaker 2
So take that, please. Thank you for that question. I think I would start by responding that. I fully agree with that. We have to use our teeth. I will avoid dental analogies as requested, but but we do need to. And that has always been a significant part of our strategic approach. I do absolutely also agree that there is a perception problem. So enforcement is a critical part of any regulatory regime, but even more so in this scenario where it is entirely new.
There is no precedent nationally or internationally, and we are dealing with a sector who is, you know, has never been regulated and is incredibly unwilling to be regulated and unwilling to come into compliance. So the purpose of my role and my team's role is to really act as that incentive to make services change their behaviour, to make excuse me, the senior leaders of those services change their behaviors. They need to believe that Ofcom will take action.
They need to believe that Ofcom will impose meaningful penalties. That will that will hurt, and it will also make services elsewhere in the sector sit up and take notice. So I absolutely agree with that, where I would very respectfully disagree with the with the sense of us is, is whether we we haven't used our teeth. I think I think we are using our teeth. I think we are very active in using our enforcement powers.
Not all of them, not yet. I absolutely accept that we have a strong toolkit of powers for these first 18 months. We definitely have focused on using our more conventional powers, our, you know, duty, implying duties to contain information, the enforcement powers. I think there's a bit of a learning to walk before we run on that. And that is an area of focus for us. But just to run through a couple of statistics, we've opened six enforcement programs so far under the regime, just one last week, which is focusing on the deployment of hash matching technology to prevent the spread of non-consensual intimate imagery, which is obviously a huge priority for us.
We've opened 40 formal investigations over the last 18 months, and that covers more than 100 different services within those investigations. And the first one of those was opened into the suicide forum just a couple of weeks after the the illegal content duties came into force. Some of those earlier investigations were focused on smaller services with more straightforward breaches. Again, that was quite a strategic choice for us, but we're seeing our portfolio shift now to we've got three really very significant complex investigations open at the moment.
Oliver has mentioned the the investigation into X and the the issue around the Grock gen AI generating illegal content and sharing that on X. We also have an investigation into telegram, into the measures it has in place to to prevent the spread of child sexual abuse material and also into TikTok. And we have imposed £7 million of penalties so far. But I absolutely actually want to come back in. I can I absolutely do agree with you that this is something we need to do more of.
And as we look into the future, the near future, we are starting to build up to be able to use the rest of those powers and increase the aggressiveness. One example, if I may, just before I finish, is to say that we are we are starting to use, for example, the senior management liability power, which I know people have been very keen to us use. We are starting to to bare our teeth a bit towards that criminal liability side as well, which we'll start to make a real difference.
There is no precedent nationally or internationally, and we are dealing with a sector who is, you know, has never been regulated and is incredibly unwilling to be regulated and unwilling to come into compliance. So the purpose of my role and my team's role is to really act as that incentive to make services change their behaviour, to make excuse me, the senior leaders of those services change their behaviors. They need to believe that Ofcom will take action.
They need to believe that Ofcom will impose meaningful penalties. That will that will hurt, and it will also make services elsewhere in the sector sit up and take notice. So I absolutely agree with that, where I would very respectfully disagree with the with the sense of us is, is whether we we haven't used our teeth. I think I think we are using our teeth. I think we are very active in using our enforcement powers.
Not all of them, not yet. I absolutely accept that we have a strong toolkit of powers for these first 18 months. We definitely have focused on using our more conventional powers, our, you know, duty, implying duties to contain information, the enforcement powers. I think there's a bit of a learning to walk before we run on that. And that is an area of focus for us. But just to run through a couple of statistics, we've opened six enforcement programs so far under the regime, just one last week, which is focusing on the deployment of hash matching technology to prevent the spread of non-consensual intimate imagery, which is obviously a huge priority for us.
We've opened 40 formal investigations over the last 18 months, and that covers more than 100 different services within those investigations. And the first one of those was opened into the suicide forum just a couple of weeks after the the illegal content duties came into force. Some of those earlier investigations were focused on smaller services with more straightforward breaches. Again, that was quite a strategic choice for us, but we're seeing our portfolio shift now to we've got three really very significant complex investigations open at the moment.
Oliver has mentioned the the investigation into X and the the issue around the Grock gen AI generating illegal content and sharing that on X. We also have an investigation into telegram, into the measures it has in place to to prevent the spread of child sexual abuse material and also into TikTok. And we have imposed £7 million of penalties so far. But I absolutely actually want to come back in. I can I absolutely do agree with you that this is something we need to do more of.
And as we look into the future, the near future, we are starting to build up to be able to use the rest of those powers and increase the aggressiveness. One example, if I may, just before I finish, is to say that we are we are starting to use, for example, the senior management liability power, which I know people have been very keen to us use. We are starting to to bare our teeth a bit towards that criminal liability side as well, which we'll start to make a real difference.
15:03
Lord Kirkhope of Harrogate
-
-
Lord Kirkhope of Harrogate
But I ask as a lawyer to a lawyer, a simple question. You claimed in the that US suicide forum case that you basically had run out of legal routes. I mean, what I'm interested in is, are you therefore saying that the tools that are available to you to be nasty, including your dental tools on your teeth or whatever, that these are inadequate to do what you feel you have to do? I mean, where, you know, somewhere in this system, I believe there are in inadequacies .
And I really want to find out from you where those are.
And I really want to find out from you where those are.
15:03
Speaker 1
-
Speaker 1
Yeah. Just quickly before passing back to Susie. I mean, I think it's important just to have a sense of scale on this as well. So we have been the most active of any international regulator in this space. And I think, you know, part of the frustration and we would share it ourselves is that these things do take time. And I think if you look internationally, whether that be at the EU, Australia or indeed at the litigation in in the US, these are all taking 2 or 3 years.
Now. We want to be significantly quicker than that, but I think we are at that particular stage in the life cycle where we've launched a lot of this stuff, and it hasn't come in to land just yet. On business disruption measures, I think you're absolutely right. I think the stuff that isn't working there. But Susie, back to you.
Now. We want to be significantly quicker than that, but I think we are at that particular stage in the life cycle where we've launched a lot of this stuff, and it hasn't come in to land just yet. On business disruption measures, I think you're absolutely right. I think the stuff that isn't working there. But Susie, back to you.
15:04
Speaker 2
-
Speaker 2
So I'll answer that in two parts, if I may. One part is there is a sort of situational challenge in the sense that not only are we regulating this huge sector, but a lot of them are small services based overseas with no assets in the UK. That does make enforcement really challenging. And we have seen and it's been publicly flagged, and I know it is a concern that some services have not been paying their penalties.
We are taking very active steps to pursue that, to register judgment debts in the UK, to investigate where their assets may be. But we do have to be realistic about the challenges of getting judgment debts like that registered and acknowledged in overseas jurisdictions. So that is an automatic limitation. That brings us on to the business disruption measures. And that is something we have found very difficult, partly because, well, mainly because we may only apply to the court for business disruption measures where there is an evidence of ongoing non-compliance.
Now we're a service, as with the suicide forum that we investigated, effectively withdraws from the UK jurisdiction, it is no longer within our jurisdiction. The duties of the act only apply as the service operates in the UK. So that was where we felt that we could not go any further with that service. Similarly, we have seen services where they may have come into compliance, which is obviously what we really want to see.
We want to see them come into compliance. If we take some of the the adult sites, for example, in response to our enforcement, they have brought in effective age checks but then not paid the penalty. And because there is then no ongoing non-compliance, we are not able to apply for business disruption measures to be able to, on the basis just that they haven't paid their penalty, which would be incredibly helpful.
We are taking very active steps to pursue that, to register judgment debts in the UK, to investigate where their assets may be. But we do have to be realistic about the challenges of getting judgment debts like that registered and acknowledged in overseas jurisdictions. So that is an automatic limitation. That brings us on to the business disruption measures. And that is something we have found very difficult, partly because, well, mainly because we may only apply to the court for business disruption measures where there is an evidence of ongoing non-compliance.
Now we're a service, as with the suicide forum that we investigated, effectively withdraws from the UK jurisdiction, it is no longer within our jurisdiction. The duties of the act only apply as the service operates in the UK. So that was where we felt that we could not go any further with that service. Similarly, we have seen services where they may have come into compliance, which is obviously what we really want to see.
We want to see them come into compliance. If we take some of the the adult sites, for example, in response to our enforcement, they have brought in effective age checks but then not paid the penalty. And because there is then no ongoing non-compliance, we are not able to apply for business disruption measures to be able to, on the basis just that they haven't paid their penalty, which would be incredibly helpful.
15:06
15:06
Viscount Colville of Culross
-
-
Viscount Colville of Culross
Yes. Sorry. I just want to take you back to the suicide forum. There's been obviously a huge amount of concern . And you, Suzanne, have just have just raised the problem of suicide forum having withdrawn withdrawn to outside our territoriality. I also understand that the the the reason why you haven't been able to, to pursue this forum is because underage children have been using VPNs. And that means that you don't have the capacity to be able to, to, to deal with them.
However, I'm interested that the Australian Esafety Commissioner has now has now demanded that that gating against VPNs is should be a fundamental requirement for providers. I mean, when we started the Online Safety Act, there wasn't there wasn't any technology for age verification as a result of the Online Safety Act. As you've already said, they the companies created this technology. Shouldn't the same thing? Shouldn't we should the act be amended so that we can force the companies to, to, to deal with the problem of VPNs for underage users?
However, I'm interested that the Australian Esafety Commissioner has now has now demanded that that gating against VPNs is should be a fundamental requirement for providers. I mean, when we started the Online Safety Act, there wasn't there wasn't any technology for age verification as a result of the Online Safety Act. As you've already said, they the companies created this technology. Shouldn't the same thing? Shouldn't we should the act be amended so that we can force the companies to, to, to deal with the problem of VPNs for underage users?
15:07
Speaker 1
-
Speaker 1
I mean, I think this is a fundamental political decision that will certainly sit outside our remit. And what we've seen is that VPN usage certainly went up when we put age gates in place in July of last year, but not to such an extent that we feel that there's a whole sections of society that are walking around the act. I think within Australia they were saying that of the the children that weren't complying with the ban, that was about 8% that were using VPNs at the time.
But you can also see how this could become a bigger issue over time. And the government in the summer was actively considering whether it would make any recommendations on VPNs. And I think that Will needs to be the right forum that government liaising with with experts in Parliament on it, and we will absolutely get on with what we're told to do.
But you can also see how this could become a bigger issue over time. And the government in the summer was actively considering whether it would make any recommendations on VPNs. And I think that Will needs to be the right forum that government liaising with with experts in Parliament on it, and we will absolutely get on with what we're told to do.
15:08
15:08
15:09
15:09
15:09
15:09
Speaker 1
-
Speaker 1
I mean, just to add on that, I mean, Suzy was mentioning earlier that there's there's been a different stages of our enforcement, and the early stage has very much been on the smaller, largely pornography sites. I think as as time goes on and we move into the bigger sites, these have business assets in the UK. I think this issue as a proportion of our fine is going to really reduce over time, I think.
I think it looks acute at the moment. I think over time, as we are finding the bigger companies, if they're in breach of the act, this will be less of an issue.
I think it looks acute at the moment. I think over time, as we are finding the bigger companies, if they're in breach of the act, this will be less of an issue.
15:09
15:09
Baroness Caine of Kentish Town
-
-
Baroness Caine of Kentish Town
I just wanted to return to two issues. One was you talking about time for culture change and leadership and people realising their responsibilities. But that's in a massively fast moving set of industries where, frankly, from what you're saying, people aren't engaging necessarily in that long term culture change path. That being the case, do you think that's actually the right approach, or do you think there are other approaches which include the enforcement area and making those enforcement costs much harder, harsher a route? And also, in so doing, would that money then help you with the level of resources you need to actually regulate the sector? Because clearly, one of the things you were indicating earlier was you don't have the resource level, in your view, to deal with the scale of the problem that you're being charged with.
That's something, you know, I particularly been asking over various meetings.
That's something, you know, I particularly been asking over various meetings.
15:10
Speaker 1
-
Speaker 1
Yeah. So, so I absolutely agree with you that the, the culture is the thing in the end here. And what we fundamentally need to do is to change incentives in the boardroom. And this is where I think the growth of international regulation in this area, Canada recently has announced that it's moving into this space as well, alongside the litigation in the US in particular, I think is going to start having that really significant change because, you know, you no longer have a trust and safety team that are coming up to tell you that safety really matters.
You've got your CFO, you've got your strategic risk team telling you that you are having to provision for hundreds of billions of damages. And I think that fundamentally starts to change things. And I was talking to an executive who was drawing the analogy with data protection. This was something if you rolled the clock back, a generation was not being taken seriously in the boardroom. But suddenly you had the combination of, you know, big fines, really kind of much higher awareness.
And I think I hope that that is a useful analogy for us as well. But to your point, I think that absolutely has to be accompanied by, you know, financial penalties for companies that will really make them sit up and notice it. I think if we just expect that this is going to happen organically, I think we'll be disappointed. Yeah.
You've got your CFO, you've got your strategic risk team telling you that you are having to provision for hundreds of billions of damages. And I think that fundamentally starts to change things. And I was talking to an executive who was drawing the analogy with data protection. This was something if you rolled the clock back, a generation was not being taken seriously in the boardroom. But suddenly you had the combination of, you know, big fines, really kind of much higher awareness.
And I think I hope that that is a useful analogy for us as well. But to your point, I think that absolutely has to be accompanied by, you know, financial penalties for companies that will really make them sit up and notice it. I think if we just expect that this is going to happen organically, I think we'll be disappointed. Yeah.
15:12
Lord Knight of Weymouth
-
-
Lord Knight of Weymouth
Thank you. Before I move on to my question, I just want to touch on the VPN issue. I'm back in 2023. When the bill was going through this House, I tabled an amendment around the use of VPNs and its use to evade age verification, and the minister replied at the time that for clause 1116 to address the concerns around age assurance and age verification, the provider would have to account for the use of VPNs as a way of working around the age verification, and if the provider concluded that the VPN could be used to evade their age verification, age assurance, then then the section wouldn't apply.
Do you now agree with the minister, as he was then, in that that summary position.
Do you now agree with the minister, as he was then, in that that summary position.
15:13
15:13
Lord Knight of Weymouth
-
-
Lord Knight of Weymouth
might ask you to explain the what the minister's reply was. The minister essentially was saying that in order that you had to. That the provider, in order to be to satisfy you that the age verification and age assurance measures were were sufficient, would account for the use of VPN by children to get around the the age verification measures. Well, I'll say a quick word and then Susie might want to, to pick up on on how we've engaged in this in practice.
I think they do need to account for what I don't think they need to do under the terms of the act is prevent users from using VPNs to access their service. I don't think there's any obligation in the act that would amount to that, and we've certainly provided guidance to firms and taken action against firms when they've encouraged people to use VPNs as a way of getting around our restrictions. But yeah, as I say, I don't think there's anything in the act that would require providers if they perceived that a VPN had been used in the same way that if I use a VPN to try and buy tickets for Arsenal Football Club when I'm overseas, I can't do it because they can see it's a VPN.
Should they then prevent access to the service? Well, I mean, I think this gets to the point that Oliver was making earlier. You know, I think this is a bigger claim than we can give you an opinion on today. You know, VPN use is very widespread for all sorts of purposes. You know, we use VPNs in our corporate environment every day. So the question about whether there should be legislation to require firms to prevent access by VPNs, I think is one that would need a bigger debate.
It would be a significant intervention. I'm going to move on to the question that I'm tiered up to ask the . The recent settlement by meta in the US courts was eye catching. It was eye catching. First, as far as I'm concerned, with the sum of money that they were willing to settle to pay over a number of years, but that they considered that to be affordable. Was it $18 billion? Does that change the game for you in terms of the amount of money that you're after pursuing? When you take enforcement action?
I think they do need to account for what I don't think they need to do under the terms of the act is prevent users from using VPNs to access their service. I don't think there's any obligation in the act that would amount to that, and we've certainly provided guidance to firms and taken action against firms when they've encouraged people to use VPNs as a way of getting around our restrictions. But yeah, as I say, I don't think there's anything in the act that would require providers if they perceived that a VPN had been used in the same way that if I use a VPN to try and buy tickets for Arsenal Football Club when I'm overseas, I can't do it because they can see it's a VPN.
Should they then prevent access to the service? Well, I mean, I think this gets to the point that Oliver was making earlier. You know, I think this is a bigger claim than we can give you an opinion on today. You know, VPN use is very widespread for all sorts of purposes. You know, we use VPNs in our corporate environment every day. So the question about whether there should be legislation to require firms to prevent access by VPNs, I think is one that would need a bigger debate.
It would be a significant intervention. I'm going to move on to the question that I'm tiered up to ask the . The recent settlement by meta in the US courts was eye catching. It was eye catching. First, as far as I'm concerned, with the sum of money that they were willing to settle to pay over a number of years, but that they considered that to be affordable. Was it $18 billion? Does that change the game for you in terms of the amount of money that you're after pursuing? When you take enforcement action?
15:15
Speaker 1
-
Speaker 1
I would say it certainly changes the game, as I was saying earlier, in that I think that it really brings this into people's eye line in the executive suites when they're thinking about safety, you know, for us in terms of, you know, the level of fees that we are going to be able to the level of penalties that we are going to be able to impose. You know, it's determined by the act in terms of that being 10% of worldwide revenue.
So, you know, we've just been through that process with our fees regime in terms of determining what that qualifying worldwide revenue is across all of these big companies. So we now have those, those, those numbers there. And that will then be, you know, the process that will go through is working within that 10% limit here. And Susie and team have developed quite a detailed series of metrics in terms of how you determine what those numbers are.
But I don't think that we are going to be swayed by, you know, the sort of 18 billion number. And sorry, one point I should have got back to is, unfortunately, we don't get to spend it. So so you were saying so so any fines that we levy go back to the Treasury and we are funded as of this financial year by the companies themselves. So so we are not a draw on the public purse, but we don't get to keep any of the penalties that we Levy.
So, you know, we've just been through that process with our fees regime in terms of determining what that qualifying worldwide revenue is across all of these big companies. So we now have those, those, those numbers there. And that will then be, you know, the process that will go through is working within that 10% limit here. And Susie and team have developed quite a detailed series of metrics in terms of how you determine what those numbers are.
But I don't think that we are going to be swayed by, you know, the sort of 18 billion number. And sorry, one point I should have got back to is, unfortunately, we don't get to spend it. So so you were saying so so any fines that we levy go back to the Treasury and we are funded as of this financial year by the companies themselves. So so we are not a draw on the public purse, but we don't get to keep any of the penalties that we Levy.
15:17
Lord Knight of Weymouth
-
-
Lord Knight of Weymouth
Let me continue on. What was eye catching. It was also eye catching that this was very much about the the system design of the meta platforms rather than individual items of content and the harm that was related to that. And that felt like a an advance on the regime that we'd created in the Online Safety Act that we were really getting to the. We didn't quite the settlement didn't get to the algorithms and algorithmic harm, but it got to quite a lot of the other harms.
Is that instructive for you in whether or not we got the regime right here? Should I pick that one up? I mean, I would say a couple of things. I think a lot of what was agreed in the meta settlement when it comes to preventing harmful contact between adults and children, or between systems to prevent exposure to certain types of content, I think is very consistent with the framework of the act and with the codes of practice that we've got.
The one area where it went significantly beyond what the Online Safety Act does is in dealing with features and functionalities that are not about the type of content, but about the volume of consumption or the amount of screen time or the addictive effect of the platforms. And those were things which did feature in the parliamentary debate. You know, we'll both remember those. But the act did not, in the end, bring those into into scope.
Do you think it should if it was improved? Well, again, you know, these are judgments in the end for government and Parliament and but you have a job to try and make things safer for children. That's why you get up in the morning.
Is that instructive for you in whether or not we got the regime right here? Should I pick that one up? I mean, I would say a couple of things. I think a lot of what was agreed in the meta settlement when it comes to preventing harmful contact between adults and children, or between systems to prevent exposure to certain types of content, I think is very consistent with the framework of the act and with the codes of practice that we've got.
The one area where it went significantly beyond what the Online Safety Act does is in dealing with features and functionalities that are not about the type of content, but about the volume of consumption or the amount of screen time or the addictive effect of the platforms. And those were things which did feature in the parliamentary debate. You know, we'll both remember those. But the act did not, in the end, bring those into into scope.
Do you think it should if it was improved? Well, again, you know, these are judgments in the end for government and Parliament and but you have a job to try and make things safer for children. That's why you get up in the morning.
15:18
Speaker 1
-
Speaker 1
Yeah. But it's interesting. I mean, I think government has made quite a few commitments, hasn't it? I mean, in terms of, you know, the ban itself goes further. But then the commitments that they have in terms of curfews looks quite similar. There's bits on time limits, which I don't think are kind of part of the debate so far. I mean, what's interesting, of course, is this is one company and they've made commitments for between 5 and 10 years.
So Five and ten years. So this isn't even in perpetuity. And I think, you know, I, you know, you were one of the important architects of the act. I mean, I wouldn't be too tough on the act. I think there's something fundamental here about building an approach to risk and dealing with it . That I don't
So Five and ten years. So this isn't even in perpetuity. And I think, you know, I, you know, you were one of the important architects of the act. I mean, I wouldn't be too tough on the act. I think there's something fundamental here about building an approach to risk and dealing with it . That I don't
15:19
15:19
Speaker 1
-
Speaker 1
social media. platforms and not just meta. So I mean, we are formal powers are obviously those that are bounded by the Online Safety Act. But I think , as you saw earlier in the year, we called out some of the really big social media companies saying that we thought that it was an outrage, to be honest, that they weren't policing their minimum age properly. Now, we don't have the power to really enforce that, but we have the power to encourage people to go further, and we would certainly be encouraging firms to go further than their firm legal obligations under the Online Safety Act.
You know, and so we'd say to everybody, look, please, you know, we're all trying to do here is to drive better safety outcomes. If you've . Committed in one.
You know, and so we'd say to everybody, look, please, you know, we're all trying to do here is to drive better safety outcomes. If you've . Committed in one.
15:20
15:20
Lord Knight of Weymouth
-
-
Lord Knight of Weymouth
We would be very keen for you to commit in this as well. And then my final question, honest is. I guess what this looks like to me is that taking legal action on the basis of harm caused to. individuals puts the platforms in a much more difficult. position than taking them to court on the basis of compliance with a regulatory regime that Parliament has established. And and that takes us back to where we were with Viscount Colville and whether or not we'd be better getting rid of the codes and getting rid of the legal certainty which I.
15:21
15:21
15:21
Speaker 1
-
Speaker 1
Areas where the duty of care applies. I mean, my very quick response to that would be, and I hope it's been the kind of theme throughout. We're all, you know, really want to see change happen really quickly. But I do still feel we will look back on this as having been the very early days of the regime. And I think there are real dangers of kind of throwing babies out with.
bathwater at this particular point. I think there are a number of targeted interventions that can be made to improve it. I think, you know, the government has ideas that are going to augment the Online Safety Act. As it stands, we also don't have the same culture of civil litigation and class action in the UK. I can't see it quite having the same impact. You know, I think the the fundamental idea of putting the duty on the company, making sure that there is enough incentive for them to live up to that is a good principle.
We will be doing all we can to prosecute it.
bathwater at this particular point. I think there are a number of targeted interventions that can be made to improve it. I think, you know, the government has ideas that are going to augment the Online Safety Act. As it stands, we also don't have the same culture of civil litigation and class action in the UK. I can't see it quite having the same impact. You know, I think the the fundamental idea of putting the duty on the company, making sure that there is enough incentive for them to live up to that is a good principle.
We will be doing all we can to prosecute it.
15:22
Lord Tarassenko
-
-
Lord Tarassenko
I think I'd like to move on to the final question then. So it's Lionel. Yes. I get a very nice job of asking the final question. Before that, thank you for answering comprehensively for more. Now, this is both an easy and a hard question. And I'm aware, and it would be good , perhaps to leave that to one side that you have in discussions with government about AI chatbots and how to bring AI services into the scope of the act and so on.
But leaving that.
But leaving that.
15:22
15:22
15:23
15:23
15:23
15:23
15:23
15:23
15:23
15:24
15:24
Speaker 2
-
Speaker 2
fulfill what you've just been discussing? I think we'd need to think quite carefully about how we put that. alongside the kind of framework that already exists in the act, so I don't think this is a quick fix. I think it would need careful thought by better lawyers than me about how you would structure that. But yeah, I . Think that's
15:24
15:24
Speaker 4
-
Speaker 4
that we would want to look at. I would go back to the business disruption measures myself. That's very that's a very big. focus in my world. It's it's the strongest enforcement tool we have. And as we've already discussed today, we've found some real practical. challenges in deploying that in anger, which has been as. frustrating for me as it has been for for the general public.
So I won't rehearse the specific changes. We could come back to you if you wanted any more detail on that, but I do think some amendments there to make it work in a more .
So I won't rehearse the specific changes. We could come back to you if you wanted any more detail on that, but I do think some amendments there to make it work in a more .
15:25
15:25
Speaker 1
-
Speaker 1
So anything you can let us have in writing would be helpful. And the rules I'm not allowed to use. But I'd make the point that I think this is quite narrow and. specific in terms of change and marks. What I think is a lot of debate. I think that narrow one would be extremely helpful to have the committee support. I think I would go on proactive technology and making it easier for us to.
force the quite a long way down the chain for companies to to use proactive tech. So they are have more control over the . Content
force the quite a long way down the chain for companies to to use proactive tech. So they are have more control over the . Content
15:25
15:25
15:26
15:26