Online Safety Act 2023 (Qualifying Worldwide Revenue) Regulations 2025

Lord Leong Excerpts

Monday 8th September 2025 Grand Committee

Moved by

[Lord Leong]

That the Grand Committee do consider the Online Safety Act 2023 (Qualifying Worldwide Revenue) Regulations 2025.

Relevant document: 31st Report from the Secondary Legislation Scrutiny Committee

[Lord in Waiting/Government Whip (Lord Leong) (Lab)]

My Lords, as set out in the Online Safety Act 2023, Ofcom is empowered to make regulations that define how the qualifying worldwide revenue—QWR—of a provider of a regulated service is to be determined, along with the relevant qualifying period. The Act requires Ofcom to send the draft regulations to the Secretary of State, whose role is to then lay them before Parliament. In accordance with this process, the Secretary of State for DSIT laid the draft QWR regulations on 26 June 2025.

Defining QWR is critical to establishing the fee regime whereby providers of regulated services pay a fee to Ofcom to fund the costs of online safety regulation. The regulations are also a key part of informing a penalties regime that will act as a suitable deterrent to non-compliance among providers in scope of the Online Safety Act.

The regulations define QWR in relation to fees as the total revenue of a provider referable to the provision of regulated services—that is, revenue generated from relevant parts of a service, including parts where user to user, search or certain pornographic content may be encountered from anywhere in the world.

The regulations account for the apportionment of qualifying revenue in cases where direct attribution to relevant parts is not possible. In these cases, providers must apportion revenue to relevant parts using a “just and reasonable” method.

The qualifying period for calculating QWR is defined in the regulations as the calendar year two years prior to the fee-charging year. For example, for the 2026-27 charging year, the qualifying period will be 1 January to 31 December 2024.

The Act empowers Ofcom to issue penalties to non-compliant providers up to £18 million or 10% of their qualifying worldwide revenue, whichever is higher. In cases where Ofcom has found joint and several liability for a contravention of the Act within a group of entities, the regulations define QWR as the total of all worldwide revenues received by the provider and its group undertakings, whether or not that revenue is referable to a regulated service. Ofcom’s view is that the approach set out in regard to penalties will act as a suitable deterrent to non-compliance.

For both fees and penalties, in defining QWR Ofcom’s view is that the use of worldwide revenue reflects the global nature of online services and ensures fairness across providers—and, further, that this is consistent with the Act, which applies to any service with links to the United Kingdom, regardless of whether the service in question is a UK company.

During the passage of the Act through Parliament, it was agreed that the taxpayer should not be liable for paying for online safety regulation but rather that the providers of regulated services in scope of the Act should fund the regulatory regime. Following a public consultation between October 2024 and January 2025, Ofcom has recommended that the Secretary of State consider setting the QWR threshold at £250 million. In practice, this means that providers whose QWR meets or exceeds the threshold will be liable to pay fees to Ofcom unless they are exempt. Ofcom believes that this recommendation balances proportionality and workability, while limiting the impact on SMEs. As set out in the Act, the Secretary of State must now consider this advice and set the final threshold in a separate statutory instrument later this year. Ofcom will then consult on guidance relating to its Statement of Charging Principles, publish the final statement and begin invoicing providers in the 2026-27 financial year.

In accordance with its duties under the Act, Ofcom has drafted these regulations, and it is now for both Houses to consider them.

--- Later in debate ---

[Viscount Camrose (Con)]

My Lords, this statutory instrument forms a key part of the regulatory framework underpinning the Online Safety Act 2023, a significant and necessary piece of legislation that forms part of my party’s legacy in government. I am very proud of the small contribution that I made to its passage through your Lordships’ House. That Act’s core aim is to make the online world safer, particularly for children and vulnerable users—an aim that all of us in this Committee support fully.

That said, let me make a brief point; it does not go directly to this instrument but it is, I think, a point worth making. I am concerned by how controversial the Bill seems to have become in certain quarters—indeed, much more controversial than it deserves to be. Part, though not all, of that is perhaps due to the previous Secretary of State’s rather aggressive rebuttal of some of the claims made about it. So I express my hope and wish that the new Secretary of State will be more emollient in his debate in order to carry people with him, because it is so important that the public come along with the Bill.

This instrument sets out how Ofcom will calculate the qualifying worldwide revenue of regulated service providers. As the Minister has outlined, this matters for two reasons: first, to determine Ofcom’s fees and, secondly, to establish maximum penalties for breaches of up to 10% of global revenue or £18 million, whichever is higher.

Most notable, of course, is the use of worldwide revenue as the basis for both fees and penalties. Although this ensures consistency and deters underreporting, the concern was raised during the public consultation that it can prove disproportionate for providers with only limited UK operations. I hope that, when he comes to speak, the Minister can give a bit more clarity on this point. Has a formal assessment been carried out in this specific area? What safeguards exist to prevent excessive penalties in cases of genuine error?

There is also the question—the noble Lord, Lord Stevenson of Balmacara, set this out clearly so I will not go into it much—of the interpretation of terms such as “just and reasonable”, particularly in revenue apportionment and currency conversion. Consistent application will of course be critical. How will disagreements be resolved and what guidance will providers receive?

I would also be grateful for clarification on Regulation 4(3)(b), which refers to

“parts where search content may be encountered (in the case of search services and combined services)”.

Ofcom has indicated that both “search” and “user to user” can include the functionality of AI chatbots. I am pleased that it has clarified this point but, if that is so, it raises an important issue: in cases where an entity is to be fined for an unsafe AI chatbot, which service is considered referable? Is it the chatbot service itself, or is the chatbot to be considered an amalgam of a user-to-user service and a search service?

If it is to be just the chatbot service—these are, of course, increasingly being used as search services—many of them generate very little revenue. In fact, AI is frequently loss making for many of the large organisations operating in this space. Could their qualifying worldwide revenue, at least as defined, be negative in such cases? If so, how would that be treated under the regime?

Of course, we welcome the exemption for services with under £10 million in UK referable revenue—we feel that that is a sensible threshold—but are the Government willing to review it if evidence shows that it is deterring legitimate or public interest platforms from entering or remaining in the UK market?

These regulations are a necessary step. They must be implemented fairly, not just for the global giants but for those trying to do the right thing. In closing, I thank the Minister for stepping in at short notice to guide us through this—it was no doubt a not wholly welcome surprise. I hope that the Government will have plans in place to monitor the regime’s impact actively and closely to ensure that Ofcom’s guidance is transparent and consistent and that they will remain open to adjusting thresholds or definitions if unintended consequences should arise.

[Lord Leong (Lab)]

I thank all noble Lords, especially my noble friend Lord Stevenson, the noble Baroness, Lady Humphreys, and the noble Viscount, Lord Camrose, for their valuable contributions to this debate. The noble Viscount, Lord Camrose, should be really proud of his legacy in taking the Online Safety Act through Parliament. It is due to him that we are now implementing these regulations.

I shall now respond to the various questions raised by noble Lords and to the Secondary Legislation Scrutiny Committee in its report on this instrument. The total amount of fees collected must not exceed the annual cost of Ofcom’s exercise of its online safety regulation functions. The cost may vary from year to year. Ofcom’s expected annual costs for online safety services for 2025-26 are close to £92 million, which includes regulatory activities and what Ofcom calls common costs, which are its running costs, allocated to all sectors that it regulates. Ofcom’s annual costs will vary depending on the level of regulatory activity undertaken in any given year, and those for online safety for 2026-27 will be published in the 2027 tables. Ofcom’s duties under the Act are extensive, and this will allow it to deliver effectively.

Service providers whose qualifying worldwide revenue is at or above a revenue threshold that we are discussing, and which these regulations will allow Ofcom to consult on and set, will need to pay approximately 0.02% to 0.03% of their qualifying worldwide revenue in fees. The Secretary of State will determine the threshold figure, having taken advice from Ofcom, which recommends a threshold of £250 million. If implemented, that means that only the largest companies will be in scope of fee paying. For example, a company with a qualifying worldwide revenue of £250 million can expect fees to constitute something like £50,000 to £75,000, using the formula of 0.02% to 0.03%.

Ofcom has robust enforcement powers available to use against companies that fail to fulfil their duties and will be able to issue enforcement decisions. That is in response to a question posed by my noble friend Lord Stevenson. This includes non-payment of fees, which is explicitly covered under Section 141 of the Online Safety Act.

Ofcom’s authority to collect fees is set up, as I said earlier, under Section 84 of the Act. Its authority to collect penalties is also set up under Schedule 13. If a provider of a regulated service does not pay its fee to Ofcom in full, Ofcom may give the provider a penalty notice specifying the outstanding sum and a date on which it must be paid. It may also bring legal proceedings for the recovery of the whole or part of the amount due.

I will write to my noble friend Lord Stevenson on the issue of Ofcom’s future receipts being lower than its costs.

--- Later in debate ---

[Lord Stevenson of Balmacara (Lab)]

I am grateful to my noble friend for trying to explain the “just and reasonable” approach. Just to unpick what he said, what is Ofcom consulting about? There seems a disjuncture in what we are trying to do here. We are going to pass this regulation tomorrow—it will be in force in a couple of weeks, according to Ofcom—yet we still do not know whether Ofcom has completed its discussion about whether companies are prepared to accept “just and reasonable”. Is that a fair summary of where we are?

[Lord Leong (Lab)]

My noble friend makes a good point. Ofcom is consulting on the guidance to help providers understand the ways of apportioning revenue in a “just and reasonable” manner. Its guidance will hopefully be published in the last quarter of this year. Until such time, I am sure there will be further guidance for providers along the way.

To come back to the scrutinising of legislation, ongoing parliamentary scrutiny is crucial. Indeed, the Online Safety Act requires Ofcom’s codes to be laid in Parliament for scrutiny. The Secondary Legislation Scrutiny Committee continues to provide vital scrutiny of statutory instruments and has drawn special attention to several instruments that my department has laid in the past few months. It identified the instrument we are debating today as an instrument of interest. The Science, Innovation and Technology Select Committee and the Lords Communications and Digital Committee also play a vital role in scrutinising the regime.

Finally, the Secretary of State is required under Section 178 of the Act to review the effectiveness of its regulatory framework between two and five years after key provisions of the Act come into force. A report of the outcome of this review will be published and laid before Parliament.

Ofcom has said in response to the SLSC that it will review the information from providers and is able to use its powers to require further information under Section 100 of the Act should it need further details to scrutinise the approach taken by the provider—that is to do with the “just and reasonable” method. Ofcom has stated that it has access to sufficient expertise to make this assessment.

The noble Viscount, Lord Camrose, asked about exemptions. Under the Act, Ofcom has the power to make or revoke exemptions and this must be approved by the Secretary of State. Ofcom is proposing to exempt service providers whose UK referral revenue is less than £10 million. We will consider that carefully before deciding whether to approve the exemption. I am sure noble Lords will know that about 60 companies would probably fall within the bracket of the Ofcom fees regime—the majority of which are non-UK companies. I am sure noble Lords will also know that most of these companies have revenues in excess of £250 million. I would have thought that there are not many companies with revenue of less than £10 million.

In the last 12 months, we have seen key elements of the Online Safety Bill progressed and implemented. Many of Ofcom’s powers are now in effect. Platforms are now legally required to protect children from harmful content, including rolling out highly effective age assurance to tackle pornography, suicide, self-harm and eating disorder content. This instrument will bring us one step closer to a fully implemented online safety regime, ensuring that companies raising revenue from online services cover the cost of regulation—not taxpayers—and take responsibility for keeping our children safe online.

Motion agreed.