The UK’s Online Safety Act and EU’s Digital Services Act: What Online Service Providers Should Know

The OSA applies to all Services.

“User to user services” are internet services whereby content on the service (whether automatically generated or uploaded/shared by a user) may be accessible by another user (e.g., social media sites, online marketplaces, consumer cloud storage services).

“Search services” are search engines. The following services are exempt under the OSA: email services, SMS / MMS services, services that offer only live aural communications, services where a user is limited to posting or sharing a comment/review (or expressing a view on such a comment/review) (e.g., news publication websites), internal business services, services provided by public bodies and services provided in the course of education or childcare.

Some Services will be categorised as either Category 1, Category 2A, or Category 2B, depending on the number of users and functionality of the service. The Secretary of State has yet to publish the criteria for each category of Service, however, we understand that Category 1 Services will include those with the largest number of users, to which more stringent regulation will apply. 

The DSA applies to online intermediary services such as hosting services (including online platforms like social media sites, online marketplaces, and cloud storage services), as well as caching services, mere conduit services and online search engines.

The European Commission designates companies as “very large online platforms” and “very large online search engines” if they have 45 million or more average monthly active users. 

The European Commission has designed 17 “very large online platforms” and two “very large search engines.”  (Note that a “very large” designation will not necessarily translate into a “Category 1 Service” under the UK Online Safety Act and vice versa.)

Applies to Services that have “links to the United Kingdom,” i.e., if:

• they have a significant number of users in the UK.; and
• the UK is one of their target markets (or the only market).

Services may also be regarded as having links to the UK if they are capable of being used in the UK by individuals and reasonable grounds exist to believe that people in the UK face a material risk of significant harm from user-generated content or search content (as applicable), which is available on the Service. 

The OSA differentiates between the following:

• “Illegal content” relates to terrorism, child sexual exploitation and abuse, assisting suicide, threatening to kill, public order offences (harassment, stalking and fear or provocation of violence (including hate crime), supply of drugs and psychoactive substances, firearms and other weapons, assisting illegal immigration, sexual exploitation, pornography (including revenge pornography), assisting crime and fraud.
• “Harmful content” is age-inappropriate, relates to pornographic content or other material that does not meet a criminal threshold but promotes, encourages or provides instructions for suicide, self-harm or eating disorders, depicts or encourages serious violence and/or relates to bullying. For content to be “harmful,” it must fall within the Secretary of State’s description of “priority content” for adults. For children, “harmful content” must fall within the Secretary of State’s description of “primary priority,” “priority” or otherwise “present a material risk of significant harm to an appreciable number of children”. These descriptions have not yet been published.

“Illegal content” includes any information or activity (including the sale of products or provision of services) that does not comply with EU law or the law of a Member State, irrespective of the precise subject of that law. The DSA therefore applies to content, as well as physical goods and commercial practices (including the sale of products and provision of services).

The DSA does not cover harmful content. However, the threshold for what constitutes illegal content differs among the Member States.

The OSA contains a variety of duties, the application of which will vary according to whether a Service is high-risk and likely to be accessed by children (i.e., Category 1, 2A or 2B).

All Services must use proportionate measures relating to the design and/or operation of the service to:

• Prevent individuals from encountering illegal content.
• Mitigate and manage the risk of someone using the service to facilitate a priority offence.
• Effectively mitigate and manage the risks of harm to individuals.

Systems and processes

All Services must use proportionate systems and processes to:

• Minimise the length of time any illegal content is present on the Service.
• Swiftly take down illegal content when made aware of it.

Services must also ensure that the following are designed to help protect individuals online:

• Functionalities, algorithms, and other features.
• Content moderation tools.
• User empowerment technologies to enable individuals to filter out content and/or non-verified users.
• User support and reporting mechanisms.
• Staff policies and practices (as well as any other relevant internal policies).

Terms of service and risk reporting

The OSA focuses in part on consumer protection. For example, a Service must ensure that its terms of service are applied consistently. Terms must also:

• Explicitly state how individuals are to be protected from illegal content.
• State whether any proactive technology is being used and if so, explain that technology.
• Be drafted in a way that is clear and accessible.

All Services must also carry out and publish risk assessments and transparency reports related to illegal and harmful content on their services. Category 1 Services must also summarise the findings of these risk assessments in their terms of service.

The DSA imposes a number of duties, the application of which varies according to the category and size of the online intermediary (“very large online platforms” and “very large online search engines” have the most obligations). 

Design and operation

Key obligations on intermediary services include:

• Implementation of measures to counter the dissemination of illegal goods, services, or online content.
• Prohibition on the use of dark patterns (deceptive or manipulative online interfaces).
• “Very large online platforms” and “and very large search engines” must also analyse the systemic risks arising from the platform.

Systems and processes

Key obligations on intermediary services include:

• Implementation of a mechanism that allows users to report illegal content through the intermediary service.
• Adoption of measures to ensure the traceability of online traders.
• Implementing measures to safeguard users, such as an obligation on online platforms to provide obligatory information to users when their content gets removed or restricted and providing such users with the possibility to challenge content moderation decisions.
• “Very large online platforms” and “very large search engines” must also offer users a system for recommending content that is not based on profiling.

Terms of service and risk reporting

Key obligations on intermediary services include:

• Issuing an annual transparency report (or a bi-annual report for “very large online platforms” and “very large search engines”).
• Providing clear terms of service that include the restrictions on the use of the service, content moderation policies and information regarding algorithmic decision-making.
• Disclosing the parameters used in their recommender systems.
• Compliance with far ranging transparency obligations.
• Providing information to authorities on any actions taken in response to takedowns and disclosure orders.
• Having a contact to communicate with authorities and users.
• Appointing a legal representative within the EU (if located outside the EU).

Services must ensure children (those under 18) do not access their platforms and are protected from the risk of harm arising out of using the Service. Additionally, all Services must:

• Conduct a child safety risk assessment (note that this needs to be more detailed for Category 1 Services).
• Have in place measures like age verification to prevent children from accessing harmful content.
• Provide information regarding child protection measures in their terms of service.

All intermediary services directed primarily at children (under 18):

• Terms of service must be easy for children to understand.
• Cannot serve ads based on a user’s personal data if they are reasonably certain the user is a child.
• Must put in place appropriate and proportionate measures to ensure a high level of privacy, safety and security.

Category 1 and Category 2A Services must:

• Prevent individuals from encountering fraudulent advertisements in or via search results.
• Minimise the length of time users see fraudulent advertisements.
• Swiftly ensure individuals no longer encounter fraudulent advertisements if alerted by an individual that such content may be on the platform.

Online platforms must ensure users receive information in relation to online advertising that:

• Makes clear that the content is an ad.
• Identifies the advertiser or sponsor.
• Details parameters used to display the advertisement, including information on how the user can change those parameters.

Online platforms must provide users with functionality that enables them to declare their content a “commercial communication.”

“Very large online platforms” and “very large search engines” must also provide a user with the following information:

• Whether the advertisement was targeted.
• The relevant parameters used, and the number of recipients reached.

The OSA has created the following new criminal offences for posters of content (not the Services or their directors/employees):

• Harmful or false communications, where a person sends a communication that they know to be false, with the intention to cause non-trivial emotional, psychological or physical harm (punishable by up to 51 weeks imprisonment).
• Threatening communications that pose or convey a threat of serious harm (up to 5 years imprisonment).
• Cyberflashing, where a person sends unsolicited sexual images via social media or data sharing services (up to 2 years imprisonment).
• Flashing, aimed at stopping epilepsy trolling (up to 5 years imprisonment).
• Assisting or encouraging self-harm online.

The DSA does not create any criminal offences. However, online intermediaries will not be able to benefit from the law’s exemption from liability in relation to illegal content if they have actual knowledge of the illegal content and fail to act against it.

Ofcom will have the power to fine Services up to £18 million or 10% of their annual global turnover, whichever is greater.

Each EU Member State will appoint a Digital Services Coordinator with responsibility for supervising intermediary services established in their Member State (or the European Commission in relation to “very large online platforms” and “very large search engines”). The Digital Services Coordinators (or the European Commission where applicable) will be able to act against intermediary services by way of fines of up to 6% of global annual turnover, and for the most serious contraventions, a temporary suspension of service.

Service recipients (or an association mandated on their behalf) may file complaints against intermediary services for breach of the DSA with the relevant Digital Services Coordinator. Service recipients also have a right to seek compensation for loss or damages (subject to national Member State law).