Online Safety Act 2023 (Category 1, Category 2A and Category 2B Threshold Conditions) Regulations 2025

Baroness Jones of Whitchurch Excerpts

Monday 24th February 2025 Lords Chamber

Moved by

[Baroness Jones of Whitchurch]

That the draft Regulations laid before the House on 16 December 2024 be approved.

Relevant document: 13th Report from the Secondary Legislation Scrutiny Committee

[The Parliamentary Under-Secretary of State, Department for Business and Trade and Department for Science, Information and Technology (Baroness Jones of Whitchurch) (Lab)]

My Lords, as the Online Safety Act sets out, the Secretary of State must set thresholds for three categories of service: category 1, category 2A and category 2B. The services that fall into each of these categories must comply with additional duties, with category 1 services having the most duties placed on them. These duties are in addition to the core duties which apply to all user-to-user and search services in scope, including illegal content duties and child safety duties.

All categorised services must comply with transparency reporting duties. They must also have terms on parents’ ability to access information about how their child used a service, in the tragic event that their child dies. Category 1 and 2A services also have additional duties to tackle paid-for fraudulent advertising. They will also have to comply with enhanced risk assessment and record-keeping duties.

The most additional obligations will fall on category 1 services. These are the services with the most users, and which spread content easily, quickly and widely. To the extent it is proportionate to do so, category 1 services must give adults more choice about who they interact with and the content they see. That includes suicide, self-harm and hate-inciting content. Additionally, category 1 services must protect journalistic and news publisher content and content of democratic importance. The duties will also hold these companies to account over their terms of service, making sure that they keep the promises they make to their users.

The Act requires that specific factors must be taken into account by the Secretary of State when deciding the thresholds for each category. The threshold conditions for user-to-user services, categories 1 and 2B, must be set on user numbers, functionalities and any other characteristics or factors related to the user-to-user part of the service the Secretary of State deems relevant. For category 2A, they must be set on the number of users of the search engine, plus any other factors or characteristics.

For category 1, the key consideration is the likely impact of the number of users of the user-to-user part of the service and its functionalities on how quickly, easily and widely regulated user-generated content is disseminated by means of the service. For category 2A, the key consideration is the likely impact of the number of users of the search engine on the level of risk of harm to individuals from search content that is illegal or harmful to children. For category 2B, the key consideration is the likely impact of the number of users of the user-to-user part of the service and its functionalities on the level of risk of harm to individuals from illegal content and content that is harmful to children disseminated by means of the services.

These considerations formed the basis of Ofcom’s independent research and advice, published in March last year, which the Secretary of State had to consider when setting threshold conditions. Once in force, these regulations will enable Ofcom to set up a public register of categorised services, which it expects to publish this summer. Ofcom will then consult on the remaining draft codes of practice and guidance, where relevant, for the additional duties.

In laying these regulations before Parliament, the Secretary of State has considered Ofcom’s advice and decided to follow it. I know that this decision will not please everyone, so let me set out why it was made.

Ofcom’s research concluded that, as the number of users of a service increases, so does how widely content spreads. The statutory consideration of category 1 under the Act is

“how easily, quickly and widely regulated user-generated content is disseminated by means of the service”.

Therefore, it was concluded that user numbers should not be ignored. Setting thresholds for category 1 that take into account the size and reach of services is also essential to make sure we avoid inadvertently categorising hundreds of small, low-risk services.

I turn now to the regret amendment that the noble Lord, Lord Clement-Jones, has tabled before the House. It is disappointing that a regret amendment has been tabled. I understand that it is because of the noble Lord’s view that risk should be the main consideration for category 1. He would ideally like to see so-called “small but risky” services, such as small suicide forums, brought into scope.

I also want to acknowledge that the successful amendment from the noble Baroness, Lady Morgan, made it possible to create threshold combinations by reference only to functionalities and any other factors or characteristics. However, in practice this was difficult to do at the time.

In setting the threshold conditions, the Secretary of State must act within the legal framework, which means he still must consider easy, quick and wide dissemination of user-generated content for category 1. He must also act within the powers afforded to him in setting the thresholds, which does not allow for sub-delegation to outside parties, such as coroners or Ofcom.

Unintended consequences were considered, including unintentionally categorising hundreds of small, low-risk services. I want to be very clear through this that the Government did consider options to bring small but risky services into scope, including those proposed by many thoughtful people on this complicated issue, but ultimately a workable and robust condition for capturing small but risky services was not found.

--- Later in debate ---

I hope that in responding the Minister will follow not just the commitments that I made when I was in her place in a previous Parliament but the spirit that ushered that Act on to the statute book. It was a great example of cross-party working in this House. I feel rather existential; the noble Baroness, Lady Kidron, asked whether anything a Minister says at the Dispatch Box is worth it. The noble Lord, Lord Stevenson, pointed out that the Parkinson rule has been honoured more in the breach than the observance. I hope that in responding to the regrets that have been voiced in all corners of the House, the Minister will act in the spirit of the debates that gave us this landmark Act. We will continue to scrutinise it to make sure it does indeed make the United Kingdom the safest place to be online.

[Baroness Jones of Whitchurch (Lab)]

My Lords, I acknowledge all the hard work, and the cross-party consensus, that went into creating the Online Safety Act. For all the questions that noble Lords are raising today, it is still seen as being a global leader on online safety, so it is certainly nothing we should be ashamed of. I still believe it will be transformative when it is rolled out in the next few weeks and months, when it really will begin to have an impact. I pay tribute to those who did all that work at the time.

There has been a suggestion that we have just kowtowed in some way. I cannot tell noble Lords for how many hours, days and weeks my office and the Secretary of State’s office have pored over the detail of this to make sure that we feel we are doing the best we can to implement the Act in the way that was intended. Noble Lords who have read the draft statement of strategic priorities, which we sent to Ofcom, will see that we are reiterating a lot of the issues that colleagues around the Chamber are raising today. They are our priorities as well. It came down to the practicalities of some of the issues we were being asked to enforce. I hope that in my responses now I can address some of those questions.

I should be specific about the user number thresholds that have been chosen. In response to the noble Baroness, Lady Morgan, the noble Lord, Lord Parkinson, and others, just to put it on the record, I note that Ofcom recommended category 1 threshold combinations of either: user numbers of more than 7 million UK users in addition to the functionality of forwarding or resharing user-generated content and the characteristic of a content recommender system to be met; or user numbers of more than 34 million UK users and a content recommender system to be met.

Ofcom specifically set out in its research and advice, published last March, that it considered but discounted a recommendation that allowed for the categorisation of services for category 1 by reference exclusively to functionalities and characteristics. That was because the research indicated that user reach has an important role to play in content dissemination. Ofcom made a regulatory judgment on where to set the user number thresholds, based on an assessment of what comprised targeted and proportionate regulatory action. Ofcom also undertook sensitivity testing on the thresholds.

In this debate it has been clear that some, such as the noble Lord, Lord Clement-Jones, think there will be services—particularly, as we have been debating, small but risky services—that evade the core duties of the Act. I want to assure noble Lords that the legislation does not allow for that. All regulated user-to-user services and search engines, no matter what their size, will be subject to the existing illegal content duties and, where relevant, the child safety duties; the categories do not change that.

The codes on illegal content duties, which were laid in Parliament, have passed the objection period and may now be issued by Ofcom. The duties should be in effect next month. They will force services to put in place systems and processes to tackle illegal content and require services to name a senior person accountable for compliance. If a service is likely to be accessed by children, the child safety duties will require services to conduct a child safety risk assessment and provide safety measures for child users. We expect that these duties will come into effect this summer, on the basis that the codes for the duties will be passed by then. Together, the illegal content and child safety duties will mark the biggest material change in online safety for UK citizens since the internet era began. By Ofcom’s own assessment, the Act may cover up to 100,000 services of various sizes, showing that the legislation reaches far and wide to ensure important protections for users, particularly children, online.

The noble Lord, Lord Clement-Jones, my noble friend Lord Stevenson, and the noble Baronesses, Lady Morgan and Lady Kidron, asked why category 1 thresholds are not risk-based. I will now turn to that.

The decision of the Secretary of State to set the categorisation thresholds as per Ofcom’s recommendations, rather than deviating from its research, was as follows. When the OSA was introduced, category 1 thresholds were due to be assessed based on the level of risk of harm to adults from priority content disseminated by means of the service. As noble Lords will know, this was removed during the passage of the Bill by the then Government and replaced with consideration of the likely impact of the number of users of the service, its functionalities, and how easily, quickly and widely user-generated content is disseminated. This was a significant change and, while the risk of harm may be seen to be a more relevant factor, this is the position under the Act as it now stands.

As I have already acknowledged, the successful amendment from the noble Baroness, Lady Morgan—which was raised by the noble Lords, Lord Clement-Jones and Lord Parkinson—did make it possible to require threshold conditions on functionality and characteristics to be met without user numbers. However, as I have set out, the considerations within the Act, Ofcom’s research and advice, and the risk of unintended consequences have meant that it is not currently workable to ignore user numbers when setting a threshold for category 1.

[Baroness Morgan of Cotes (Non-Afl)]

The Minister is setting out a clear case, with which I, and I think many others in this House, disagree. To cut to the chase, the Minister has just said that the Government understand the amendment passed in this House on 19 July 2023 but have decided, on the advice of Ofcom, that that amendment does not work and therefore should be ignored. We should be clear that that is what has happened. The Government should own that decision and the House, when it votes on the amendment tonight, will decide whether it thinks that is an acceptable way to behave or an unacceptable way to behave.

[Baroness Jones of Whitchurch (Lab)]

I can only reiterate what I have already said: we took Ofcom’s advice after a great deal of scrutiny of why it had come to that piece of advice. Its advice was that the key factor to be taken into account was how easily, quickly and widely content is disseminated. That is the basis on which we made that decision.

[Lord Stevenson of Balmacara (Lab)]

Sorry to interrupt but, to return to the point made by the noble Baroness, Lady Morgan, is it the Government’s position that, although the law says it is permissible, and indeed was expected, that in making their decision about category 1 the Government would require Ofcom to ensure that both reach and risk were taken account of, the Government have decided that only reach will be taken account of?

[Baroness Jones of Whitchurch (Lab)]

Ofcom’s advice was that how easily, quickly and widely content is disseminated are the key factors that it needed to make the judgment. I cannot say anything more than that.

[Baroness Kidron (CB)]

I am sorry to interrupt, but maybe this would be a good moment to answer my question about the hierarchy of text in an Act versus the regulator’s advice. It was my understanding, when the House agreed to that amendment, that it was an instruction to the regulator rather than something “nice to have” if it decided later that it did not like it.

[Baroness Jones of Whitchurch (Lab)]

The SI before us today, based on Ofcom’s advice, is the best way that we can find, in terms of practicality, of enforcing what was written in the Act.

[Baroness Penn (Con)]

Does the Minister accept that the Act does not oblige the Secretary of State to follow Ofcom’s advice, and that the Government have a separate decision-making moment—a process—to consider that advice and reach their own decision? So it is not on Ofcom; it is on the Government. It is the Government who think it is the correct way forward to ignore what was previously in the Act.

[Baroness Jones of Whitchurch (Lab)]

The noble Baroness is right that that is a factor that we considered. The Secretary of State received Ofcom’s advice, duly reflected on it, looked at all the evidence and decided that we would abide by Ofcom’s advice on the issue. It was the Secretary of State’s decision, and that is why we have this SI in front of us today.

[Lord Russell of Liverpool (CB)]

The Minister heard the example that I gave and is aware of the harm that was done as a result of using the small channel Telegram. For harm to be done, the material does not need to be widely disseminated; it is disseminated through a very small group of hardcore believers in some of these strange cults, and that is how the harm is done. The fact that it is not widely disseminated is completely irrelevant. One person taking that onboard and then doing something unmentionable should be against the Act as it was written and as we understood it would be legislated for, with the approval of both Houses of Parliament. The breadth and extent of dissemination and the number of users are irrelevant.

[Baroness Jones of Whitchurch (Lab)]

My Lords, the whole “small but risky” issue that the noble Lord is raising is hugely close to our heart. We have engaged with Ofcom and pressed it to take more action on the sort of small but risky services that he is talking about. Our view is that they do not necessarily have to be dealt with under the categorisation process; there are other ways. Ofcom has assured us, in the way that it has come back to us, that there are other ways in which it is addressing them.

It is not as though they have been discarded. It is an absolute priority for this Government that we address the “small but risky” issue, and we are doing so. We are working with Ofcom to make sure that that is followed through. As I said when I opened this debate, the fact is that we have worked with Ofcom and it is setting up a task force to look at this, while separately we are looking at these issues. What more can we do? On the position at the moment regarding the rollout of the SI and the categorisation, the reality is that Ofcom’s research and advice, and the risk of unintended consequences, means that it is not currently workable to ignore user numbers when setting category 1 and so on.

[Lord Parkinson of Whitley Bay (Con)]

The Minister rightly said “currently” and, even if that is the case, why are the Government closing the door to having this option available to them and Ofcom later? She is right that Ofcom is doing a lot of work in ways other than categorisation, but surely she and her colleagues in government can see that this is a useful tool to have in the armoury in the fight against the sorts of harms noble Lords have been raising. Why are the regulations written so tightly as to close that off and avoid taking the concession that was so hard won by my noble friend Lady Morgan and others when the Bill went through Parliament?

[Baroness Jones of Whitchurch (Lab)]

My Lords, I can only say what I have already said on this. We are looking at “small but risky”. Ofcom is working hard on this, and we are working hard on this. We can review whether the categorisation process is working. As I have already set out, that option is available to us further down the line. But, at the moment, as with other parts of the Online Safety Act, we felt we needed to get on with it and put these measures into place. Already, the categorisation provisions will take another year or 18 months to come into effect, so it is not as though that is the most imminent part of the implementation of the Act. I hear what noble Lords say. None of these issues are off the table, but we just wanted to get the Act rolled out in as quick and as current a form as we could.

If I could move on, in response to the questions raised by the noble Baroness, Lady Kidron, and the noble Lords, Lord Pannick and Lord Parkinson, I am not able to share the legal advice, but, as I have said, the Secretary of State must act within the legal framework. The current thresholds are legally valid and have been considered by the Joint Committee on Statutory Instruments. In addition to small but risky services, even though in principle there is a provision that allows a user number threshold not to be met, it does not for example allow for sub-delegations to other parties such as coroners, which was another concern of the amendment from the noble Baroness, Lady Morgan.

The decision on the categorisation thresholds has led, as I have just been saying, some to assume that certain small high-risk services are being overlooked by the legislation. However, this is not the case, as they will be subject to the stringent illegal harm and child safety duties. I know that Members are aware that the categorisation of small but risky services would also not prevent or deter users who were determined to access harmful content on dedicated forums. Moreover, the noble Lord, Lord Clement-Jones, raised the question of small but risky services evading the core duties, such as the terms of service and user empowerment. Services that exist solely to host abusive or pro-suicide content, for example, will not have terms of service banning such content, so enforcing those terms would be ineffective in reducing harm.

In addition, the user empowerment tools will enable adult users of category 1 services to avoid certain types of content, such as harmful suicide content. We anticipate that these duties will be most beneficial when services have commercial incentives to prohibit harmful content and where users wish to avoid content they may otherwise see, but not where users are actively seeking out harmful content.

I hope that begins to explain the Secretary of State’s decision. I have to say, and have said, that it was a difficult one and, while we acknowledge the possibility of deviating from Ofcom’s advice and utilising the option to set threshold combinations without a user number, this would not have had the effect of meaningfully reducing harm on small but risky services but would risk regulating hundreds of small low-risk services.

Regarding Ofcom’s small but risky supervisor task force, which the noble Lord, Lord Clement-Jones, asked about, I am confident that Ofcom can effectively use that task force to address these issues. Ofcom already had plans to ensure compliance with the first duties that go live under the Act. These include using targeted enforcement action against small risky services where there is evidence of a significant ongoing risk of harm to users, especially children, and an apparent lack of safety measures in place. In serious cases, Ofcom can seek a court order imposing business disruption measures if there is evidence of continued non-compliance. This could mean asking a third party to withdraw from the service or asking an internet service provider to limit access.

I hope that, as the child safety and illegal content duties come into force this year and the work of the task force begins, those in this House who are concerned will be able to see how these services will not evade their responsibilities under the Act.

Regarding Wikipedia, in response to the questions raised by the noble Lords, Lord Clement-Jones and Lord Moylan, the Government are not in a position to confirm which services will be designated as category 1. Indeed, this is Ofcom’s statutory obligation once the regulations have passed and are in force. It is worth noting that many of the duties on categorised services are subject to the principle of proportionality. This requires Ofcom to consider measures that are technically feasible to providers of a certain size or capacity. Where a code of practice is relevant to a duty, Ofcom must have regard to a principle of proportionality. What is proportionate for one kind of service might not be proportionate for another.

The noble Lords, Lord Clement-Jones and Lord Moylan, also queried how Ofcom could make assessments against the definitions of certain functionalities, characteristics and user number thresholds in the statutory instrument. Once the regulations have been approved by Parliament, Ofcom will issue requests for information and will start assessing services against the threshold conditions.

I also understand that there has been concern that small low-risk platforms, such as local community forums, are being overburdened by the Act and its duties. I must reiterate that these platforms, often run by a small number of users, will not be captured by the categorisation thresholds debated today. At the same time, I acknowledge that the new illegal content and child safety duties will require some additional work from these types of services.

I assure those here today that the principles of proportionality and risk are embedded into the duties on services and Ofcom in relation to the codes of practice. This means that small and low-risk services should not be overburdened by the duties in the Online Safety Act. In efforts to ease the process for small services, Ofcom is providing support to online services to help them to understand their responsibilities under the UK’s new online safety laws. These can be found on Ofcom’s website.

My noble friend Lord Stevenson raised the question of engagement with relevant committees. I agree about the importance of parliamentary scrutiny of the implementation of the Online Safety Act and welcome the expertise Members of both Houses bring. The Government agree that it is vital that regulators are accountable for their services, including through existing annual reports and reporting requirements. We will continue to work with the House of Lords Communications and Digital Committee and the House of Commons Science, Innovation and Technology Committee to support their ongoing scrutiny, as well as any other parliamentary committees that may have an interest in the Act. I am more than happy to meet my noble friend Lord Stevenson to discuss how that could be progressed further.

In response to the noble Baroness, Lady Penn, I want to put on record that a letter was shared with the Delegated Legislation and Regulatory Reform Committee in response to concerns raised during the Commons debate.

I must again stress that the Secretary of State will be holding these thresholds and the wider regulatory framework under review going forward and the Government will take whatever action is necessary to tackle risky services of any size.

I would finally like to thank all those who have contributed today: the noble Lords, Lord Clement- Jones, Lord Pannick, Lord Moylan, Lord Stevenson, Lord Russell and Lord Knight, and the noble Baronesses, Lady Morgan, Lady Kidron, Lady Penn—and of course the noble Lord, Lord Parkinson, who continues to put valuable work, expertise and energy into making the UK a safer place, both online and in the material world. I specifically thank user safety groups that have engaged with the Government on this matter and, of course, the noble Lord, Lord Clement-Jones, for his dedication to his work on these issues.

I recognise that there are some who would like to see changes to this instrument and some who believe that the decisions of the Government do not align with the intentions of the Act. I hope they understand that every decision made by this Government is made with the intention of bringing about the Act in an important and timely way. For too long, children and adults in this country have had to grapple with an unsafe online environment, and the instrument that we have debated today shows real progress.

I do not shy away from the challenge we face in navigating the ever-changing online world. I recognise that the Act is imperfect. However, it is not the destination but a significant step in the right direction. There will always be more that we can do. Years of delay and lack of progress have come at an unfathomable cost for vulnerable children and adults, with lives cut short and families’ worlds turned upside down. It is time to deliver change. I hope noble Lords will consider the time pressure and the fact that we have to get on with the rollout of the Act. I urge noble Lords to approve this vital legislation today.

[Baroness Kidron (CB)]

I raised a number of questions and I would be grateful, if the Minister is not going to answer them in the moment, if she could write to me about the Joint Committee, the hierarchy of the Act and statements from the Dispatch Box versus this decision and other decisions.

[Baroness Jones of Whitchurch (Lab)]

My Lords, if I have not covered any issues, I will of course write to noble Lords to clarify any matters that are outstanding.

[Lord Clement-Jones (LD)]

My Lords, I shall be extremely brief. I thank all noble Lords who have contributed this evening. The noble Lord, Lord Stevenson, used the expression “emotions raised”. That is exactly what this regret amendment has done. There is real anger about the way in which this statutory instrument has been put together. I think many noble Lords who were involved in the Act were extremely proud of our work, as has been expressed.

The Minister has made a valiant attempt, but I am afraid that she has been given a hospital pass. It is quite clear that the Secretary of State did not have to accept the advice from Ofcom. Its advice about functionalities, as the noble Baroness, Lady Kidron, made absolutely clear, and the evidence that the noble Lord, Lord Russell of Liverpool, put forward, not to mention the evidence from the anti-Semitism foundation, all indicate that there is considerable belief around this House that we are not dealing with the high-risk but smaller sites such as Telegram, 8chan and 4chan.

In these circumstances, as I believe is accepted by many noble Lords across the House, the Government have got this completely wrong and it needs rethinking. Therefore, I would like to test the opinion of the House.