UK’s Online Safety Act: Navigating the New Regulations for Tech Startups
In 2023, the UK’s Online Safety Act came into force, introducing new rules for online content. The act, overseen by Ofcom, the UK’s communications regulator, places obligations on many tech startups and small businesses. Platforms providing user-to-user services, such as messaging sites and gaming apps, are now legally required to implement measures to remove illegal content, with penalties for non-compliance potentially reaching £18 million or 10% of global revenue.
What Does This Mean for Startups?
Startups must now take steps to remove illegal content quickly and reduce the risk of “priority” criminal content appearing. The specific measures required vary based on the business’s size and nature.
Ali Hall, Online Safety Supervision Principal at Ofcom, explained that the definition of “appropriate measures” depends on the online service. “What’s right for a social media platform with millions of users, won’t be the same for a small community forum”.
Certain measures apply universally. Businesses must designate someone responsible for online safety, clearly define prohibited content in their terms and conditions, and implement efficient content review processes, including removing illegal materials that violate their terms. Additionally, they must provide users with a mechanism to report inappropriate material, which means establishing a procedure to handle complaints.
“The rules are proportionate and we expect different things from large, high-risk services and small, low-risk services,” Hall said. “The key requirement is that online services have systems and processes to take down illegal content swiftly, once it has been identified.”
Costs and Resources for Compliance
While the precise cost of implementing these regulations varies, Ofcom offers budget-conscious startups cost-effective options. Hall recommends using Ofcom’s online toolkit, which provides a step-by-step guide and tailored recommendations. He stresses that companies have flexibility in how they respond to the Act. “Many of our recommended safety measures are ‘principles-based’, meaning that there’s flexibility about how you implement them,” Hall said.
“Online services should enable users to submit complaints. [But] some services may offer a web portal or ‘help centre’, while small or low-risk services may simply provide an email address through which users can submit reports or complaints.”
Immediate Steps and Deadlines
Businesses must conduct a children’s access assessment to determine if their service is likely to be accessed by under-18s. For those that are, the deadline for initiating the assessment was April 16th and must be completed by July this year. Other responsibilities include keeping risk assessments up-to-date (reviewed at least every 12 months) and conducting a new evaluation if significant changes are planned.
“There are foundational steps that everyone should follow – but if your service is large or high risk, there will be more to do,”
“By now, everyone running an online service in the scope of the Act should have completed the first illegal content risk assessment. That will help decide if you’re at higher risk and whether you should consider more of our recommended safety measures.”
Supporting Tech Growth
Ofcom acknowledges the potential for new safety legislation to create administrative hurdles for tech startups. They aim to support innovation while ensuring compliance.
“Small tech platforms are crucial for economic growth in the UK and we want to support that through proportionate regulation,” Hall states. “That’s why we’re producing resources and tools to help make the compliance process easier.”
While the penalties also appear substantial, Hall clarifies that Ofcom is not trying to hinder tech startups, many of which already face economic challenges. “Unfortunately, we also know that harm can exist on the smallest services as well as the largest,” he noted. “We intend to focus our enforcement on services where the risk and impact of harm is highest [and] will only take action where it is proportionate and appropriate.”
