[co-author: Mo Swart]

On 25 March 2024, the UK Office of Communications (Ofcom) published its research and advice to the Secretary of State (SoS) on the threshold conditions that it considers appropriate to determine whether a service falls into Category 1, 2A or 2B under the Online Safety Act (OSA). Category 1 and 2B apply to user-to-user services, whereas Category 2A applies to search services. This advice forms part of Ofcom’s phased approach to implementing its codes and guidance for categorised services under the OSA.

These categories are reserved for the highest risk and highest reach services. In line with the OSA’s risk-based approach, any services falling into one of these categories (which are referred to as ‘categorised services’) will be required to comply with additional duties and obligations. See our November 2023 alert for further information on these duties and obligations, along with what services are in scope of the OSA.

Although it is not final, the SoS must consider this advice before setting the threshold conditions in secondary legislation. The advice will therefore be helpful to service providers as it offers a good indication of what category their service(s) are likely to fall into (if any) and insights into Ofcom’s key concerns.

Proposed category thresholds
Overview

*Based on Ofcom’s preliminary analysis using the data collated as part of its research and advice.

User-to-user services: Category 1 and Category 2B

Category 1
What conditions does Ofcom recommend?

Ofcom has advised that Category 1 services should be those services that fulfil either of the following sets of conditions

How many services are likely to be in scope?

Ofcom’s preliminary analysis suggests that approximately 12 – 16 services may meet one or both of the thresholds for Condition 1 and Condition 2, which Ofcom believes to be an appropriate number of services to be captured under Category 1.

How are the relevant functionalities defined for Category 1?

• Content recommender system – An algorithmic system (using a machine learning model or other technique) that determines or otherwise affects the way in which users on the service encounter content (including user-generated content) on the service. This would include, for example, a service which recommends certain content to its users based on their previous activity and/or preferences.
• Forwarding or resharing user-generated content – A functionality that allows users to forward or reshare content that has already been uploaded by a user (user-generated content) with other users on the service. This would include, for example, a function or a service allowing a user to forward another user’s direct message or post. Notably, this can apply even if third-party content also can be forwarded or reshared.

From its research, Ofcom considers that these two functionalities play the most significant role in the dissemination of content on user-to-user services. This is because they allow content to be disseminated quickly, widely and easily with users.

Category 2B
What conditions does Ofcom recommend?

Ofcom has advised that Category 2B services are those that fulfil both of the following:

How many services are likely to be in scope?

Ofcom’s preliminary analysis suggests that approximately 25 – 40 services may meet the thresholds for Category 2B.

How are the relevant functionalities defined for Category 2B?

• Direct messaging –A feature that allows a user to send content directly to, or receive such content directly from, another user on a part of the service. This requires some form of private or closed component so that the communication can be exchanged (initially at least) without other users being able to encounter it. This would include, for example, a private messaging function on a gaming platform.

Ofcom considers this feature to be high risk as, in particular, it allows users to directly disseminate illegal and harmful content to users that are children without other users being able to see or access such content.

Search services: Category 2A

What conditions does Ofcom recommend?

Ofcom has advised that Category 2A services should be those services that fulfil both of the following:

How many services are likely to be in scope?

Ofcom’s preliminary analysis suggests that two services may meet the specified UK user number threshold as they have a significantly higher user reach than the rest of the market (reaching 85% and 43% of UK users, respectively). Ofcom is mindful that, in time, other search service providers may become popular with UK users, and so has purposefully set a user number threshold that would capture these search services at an appropriate stage in the future.

How are the relevant types of services defined for Category 2A?

• General search services – Services that use bots to find content across the web, build an index of URLs and use algorithms to rank the content based on relevance to the search query.
• Downstream general search services –Services that provide access to content from across the web but are distinct in that they obtain (or supplement) their search results from those general search services.

Ofcom proposes excluding vertical search services (search services focused on a specific topic or genre of content) from this category. This is because it considers that such services present a lower risk of harm due to their limited functionalities (i.e., they only provide access to a subject-specific curated index of addresses).

Interestingly, Ofcom did not have sufficient evidence to draw robust conclusions on the impact of generative artificial intelligence or search prediction on the level of content that is illegal or harmful to children. We therefore expect that Ofcom will conduct further research on this in the future.

Measuring numbers of UK users

Ofcom advises the SoS to set out the principles for determining how to calculate UK users in the secondary legislation. Given the complexities around calculating user numbers across various services, it also advises the SoS to adopt a principled, rather than prescriptive, approach. This means that the calculation will vary depending on the type of service in question and the way in which it is used by its users. We anticipate that this approach will be welcomed by many service providers, as it introduces a certain level of flexibility and practicality to this potentially time- and resource-consuming task

Next Steps

In terms of next steps, Ofcom and the SoS intend to do the following:

• Secondary legislation – The SoS will now consider this advice as part of determining the Category 1, 2A and 2B threshold conditions to be set out in secondary legislation.
• Information gathering –Once the secondary legislation has passed (planned for summer 2024), Ofcom will gather further information, which will include requesting information from service providers using its statutory powers (for example, information about user numbers).
• Register –Ofcom will analyse the information it has gathered against the final thresholds and then publish a register of categorised services and emerging Category 1 services (planned for the end of 2024). Emerging Category 1 services are those that meet 75% of the Category 1 user number threshold, in addition to other threshold conditions that may be set out in the secondary legislation.
• Call for evidence on additional duties – In parallel to this advice, Ofcom also has published a call for evidence on the additional duties that will apply to categorised services. Potentially in-scope service providers and other interested stakeholders are invited to respond to the questions set out in the call for evidence by 20 May 2024.
• Draft proposals –Ofcom has advised that it will publish draft proposals on the additional duties on categorised services at the start of 2025.

[View source.]