As the deadline approaches for the UK to categorise online services under its new Online Safety Act (OSA), where might the lines be drawn, and what do you do if you disagree?
Introduction
Since the OSA became law at the end of 2023, its regulator, the Office of Communications (Ofcom), has been busy tackling its various obligations under the act to put in place the foundations of the new regime. One such obligation is to provide advice to the government on where the thresholds should be set for Category 1, Category 2A and Category 2B services. Under the OSA, should you fall within one of these categories, you will have additional duties to meet beyond the universally applicable duty to minimise illegal content on your service and mitigate harm it may cause.
The task of categorisation is shared between Ofcom and the government. Ofcom produces its advice (following a public consultation on categorisation), the government considers, follows or ignores it, and then passes secondary legislation setting the categorisation thresholds. Once the legislation has been passed, Ofcom publishes a categorisation register, placing certain in-scope services into categories as it sees fit. In its timeline for implementation, Ofcom anticipated that it will publish the register by the end of 2024. However, an Ofcom spokesperson last week confirmed that it would be “updating” that timeline shortly and it appears that publication of the register will now happen in early 2025 instead.
We therefore have time to reflect upon Ofcom’s advice to the government on categorisation thresholds (published in March 2024) and to consider how any challenge to the categorisation register might be effected.
How will categorisation work?
In summary, Ofcom’s advice recommends:
- There are two alternative conditions which would place a service in Category 1:
- More than 34 million UK users + content recommender system
- More than 7 million UK users + content recommender system + users can forward/reshare user-generated content (UGC)
Category 1 providers – user-to-user (U2U) services – are subject to the most demanding obligations, including ‘user empowerment’ duties aimed at allowing adult users more control over legal but harmful content.
- For Category 2B providers, the condition is: more than 3 million UK users + users can send direct messages
- For Category 2A providers, the condition is: more than 7 million UK users + not a vertical search service (i.e., specialist/topical search engines)
Category 2A providers (search services) have additional transparency obligations and duties relating to fraudulent advertising.
Ofcom’s advice is striking in that each condition has both a size and a functionality requirement. This is surprising because, shortly before the OSA was passed, a small but significant amendment was introduced by Parliament to make clear that Ofcom could set conditions which were based only on size or, more likely, functionality. This was to reflect a long-debated concern that small but high-risk services (such as chat rooms encouraging hate crimes) could otherwise slip through the net. Ofcom also has the power, under the OSA, to add a size/functionality condition for any other “characteristic” it considers relevant (e.g., user base, business model).
Despite these deliberate additions to the OSA, Ofcom appears to have declined the opportunity to stipulate conditions based upon functionality alone, or to specify particular characteristics in its conditions. It explained that this is a result of its research, which focussed on risk of virality of content, and which revealed that size plays a determinative role in the speed and breadth with which content spreads. It goes onto explain that it therefore considers that imposing both size and functionality requirements in each condition allows it to achieve ‘targeted and proportionate regulatory action’.
What does this mean for in-scope services? It’s important to stress that the government may choose not to adopt Ofcom’s recommendations, particularly if it feels that doing so would ignore a clear Parliamentary intention. However, should the advice be followed, Ofcom estimates that nine companies will be caught by the first Category 1 condition, and 12 to16 companies by the second. Identifying the nine services, based on size alone, isn’t too challenging, but the remaining 12 to 16 services with under 34 million users requires slightly more guesswork. Ofcom anticipates two search services falling within Category 2A, and – again – these are easy to identify. But the very fact that Ofcom estimates that ‘approximately 25-40 services’ (a wide range) may fall within Category 2B demonstrates that even the regulator itself cannot yet predict where the lines will be drawn.
How do I challenge categorisation?
Categorisation was always going to be controversial. A tacit acknowledgment of this is built into the OSA, with a specific provision (in section 167) having been made for the venue where and procedure by which any challenges to categorisation are to be handled. Two features of the challenge procedure are of note:
- Challenges are to be heard in the Upper Tribunal of the UK’s Regulatory Chamber. The Upper Tribunal is usually a court of second instance – i.e., a venue for hearing appeals from the First-Tier Tribunal – but, perhaps recognising the undesirable uncertainty and delay which would result from multiple tribunal appeals, the lawmakers have seen fit to leapfrog the First-Tier Tribunal and send disputes directly up.
- Perhaps more significantly, the procedure by which appeals are to be made is judicial review. This is a set of principles which applies to appeals against decisions made by a public body. Critically, judicial review proceedings do not permit a full review of the merits of the underlying decision, but rather enable appellants to challenge decisions if they can show that the procedure by which the decision was reached was legally flawed or that the decision was otherwise unlawful. Judicial review has the added advantage of speed – challenges must be brought within three months of the decision being made, and proceedings progress and conclude relatively quickly thereafter.
What does being confined to judicial review proceedings mean for a service which considers itself wrongfully categorised by Ofcom? There are only three grounds upon which a decision can be challenged:
- Irrationality – To succeed on this ground (which is rare), a service would have to demonstrate that its categorisation was so irrational that no reasonable regulator would have made that determination.
- Fairness – If it can be shown that Ofcom did not follow fair procedures in reaching its categorisation decision, then this ground could be relied upon.
- Illegality – If Ofcom takes account of considerations which lawfully it cannot, or fails to take into account considerations it is required to, then this would be a reason to challenge a decision.
The OSA appears to be designed to minimise challenges from individual services, by including the somewhat convoluted process of threshold-setting via consultation, advice and secondary legislation first. The result of this process is that Ofcom will have some fairly concrete, tangible measures against which to make its assessment of each category. As currently drafted, Ofcom’s advice avoids any real scope for discretion – focussing as it does on the number of UK users and functionality, both of which an assessment is relatively hard (although not impossible) to get wrong, and hence to challenge. If conditions were to be drawn up which focussed either only on functionality or, as the OSA permits, also included ‘characteristics’ which were deemed relevant, then one can see how the scope for challenge might increase.
It remains likely that certain services will nevertheless feel sufficiently aggrieved with their categorisation, so that as a matter of business necessity, they have no choice but to attempt a challenge by way of judicial review of Ofcom’s decision. Not least because section 167 of the OSA stipulates that services need not comply with the relevant Category 1/2A/2B duties pending an appeal. There isn’t a great deal of fodder provided in the OSA for would-be challengers to shoot at, but such companies could focus their attention on:
- Section 95(7)(a) which requires Ofcom to provide ‘a description of the service that, in Ofcom’s opinion, meets the relevant threshold conditions’. Whilst this subsection stops short of being a requirement to provide a full statement of reasons for categorisation, it may be that Ofcom’s description reveals, for example, a failure to take account of relevant factors.
- Section 95 (9) which states that ‘Ofcom must take such steps as are reasonably practicable to obtain or generate information or evidence for the purposes of the assessment’. Not a particularly prescriptive subsection, however, this may provide scope for would-be challengers to scrutinise the process and the evidence upon which the categorisation decision was based (or not, as the case may be).
If successful, an appellant would obtain an order from the Upper Tribunal, quashing Ofcom’s categorisation decision. The decision would then be remitted to Ofcom for reconsideration –possibly with a requirement to follow any directions which the Upper Tribunal has seen fit to make. It should be noted, however, that this by no means guarantees that a different decision will then be reached.
One final thought: If the grounds for judicial review are limited, and in the case of online safety are limited further by the fact that Ofcom will simply be following preset threshold conditions, then should would-be challengers consider a challenge at an earlier stage? It is legally feasible to challenge secondary legislation by way of judicial review. For any services which, having reviewed the final thresholds set in the regulations, believe they may find themselves on the wrong side of the cusp, could there be value in forestalling the categorisation process with a judicial review of the legislation itself? Individual services may prefer to take their chances when Ofcom draws up the register but – bearing in mind the way in which Ofcom has approached its advice on thresholds – there may well be scope for a pre-emptive challenge if the government chooses to incorporate that advice into legislation.
Contributors
Bryony Hurst