The detail of the first draft of the Online Safety Bill published on 12 May 2021 is set to have a major impact on a broad range of providers of internet platforms and services – not least the financial cost of compliance and the liability risk. Even before the Bill's publication, the government's full response in December 2020 to its Online Harms White Paper consultation gave a good idea of how it might shape up and the scale of its significance for the online industry.
Although the specific wording in the first draft of the Bill now gives a further sense of the types of services that are likely to be within its scope in some cases an element of uncertainty remains over what types of platform and service will fall within its remit.
The first draft identifies two primary categories – "user-to-user services" and "search services" – that could be within its scope, with different obligations tied to each. The draft Bill also sets out a list of services which, even if they are caught by these definitions, will fall outside the scope of the Bill's obligations. What types of online platform will be included in these categories and what will be considered as exempt?
User-to-user services are internet services that allow users to generate, upload or share content that can be encountered by other users on that service (whether the content is shared publicly or privately). This category of services would include user-generated content services such as social media platforms, video sharing platforms, dating services and peer-to-peer services.
But a service may still be a user-to-user service even if only a portion of it allows user-generated content to be shared; for instance, a site that is not dedicated to allowing this type of content but provides an online forum functionality within which users can interact and post.
The Bill also makes it clear that a user of a service will be deemed to "encounter" content created by others if that content can be shared with them via the service's functionality. This means that a service with the functionality to send direct messages to others – whether a dedicated instant messaging service or a website with user message functionality – will also be classed as a user-to-user service.
News sites and other websites which contain editorial content published by the provider of the service, without the ability for users to post their own content, would not fall within the definition of user-to-user services: and, even if a news publisher site has limited commenting functionality below its articles, this user content functionality may still be exempt.
Encompassing internet services that are, or include, a search engine and are not otherwise user-to-user services, the category of search services will clearly have within its scope the likes of the Google and Bing search engines. Even if only focussed on a specific topic or genre of content rather than the whole internet, services that search large numbers of websites or databases will also fall within this category. The fact that a search can be initiated by any means will also bring into scope search services provided via speech-based virtual assistants, such as Siri on Apple products, or Amazon's Alexa.
Importantly, if a service includes the ability to search just one website or database, it will not fall within the definition of a "search service". This means that a website will not be caught solely by virtue of having an internal search functionality, the results of which are limited to hits from that website.
Email, SMS, MMS and voice calls
Services – even if they are caught by the above definitions – that will fall outside the scope of the Bill's obligations include email, SMS, MMS and one-to-one live aural communications but only to the extent that each of these types of content are the only user-generated content enabled by the relevant service. However, video calling services and instant messaging through apps do not fall within these exempt categories.
The carve-out for email, SMS, MMS and voice calls was expected based on the government's white paper response, but will nevertheless disappoint those campaigners lobbying for the Bill to cover broader forms of fraudulent content, such as online scams in any guise, including via email and SMS.
Although the government's press release accompanying the Bill made a point of highlighting that "measures to tackle user-generated fraud will be included in the Bill", citing the example of romance scams or fake investment opportunities posted or sent by users of social media as being covered by the Bill, online fraud material will only be caught to the extent it is distributed via a regulated user-to-user service or search service.
Any scams targeted via email or SMS will very much remain outside the scope of the Bill. It remains to be seen whether pressure from consumer groups will lead to an expansion of the Bill in future iterations to incorporate scam content via other media, but it seems unlikely as this would require a vast overhaul of the overall scope of the Bill.
Internal business services
Another exempt group, internal business services, includes internal business resources or tools provided by the business and made available only to a closed group of individuals for uses connected with the business, including management, employees, officers, contactors, consultants or auditors. This would capture services such as employee intranets and portals provided by an employer.
The explanatory notes to the Bill also mention that internal business services may encompass productivity and collaboration tools, content management systems, customer relationship management systems and database management software.
The question of who "provides" the service is essential. The Bill states that the "provider" will be the entity that has control over who can use the service, but, where a party simply provides an "access facility" for a user-to-user service, it will not be deemed to be the "provider".
If an enterprise software provider – for example, a software-as-a-service business collaboration tool – licenses its software to another business for internal use and the business has control of who can access the service, the business rather than the enterprise software provider will be considered the service provider. In this scenario, the business may be able to benefit from the "internal businesses services" exemption, but the enterprise software provider simply by licensing to the business appears to be outside the scope of the Bill.
Limited functionality services
There is an exemption also for "limited functionality services", in which the user-to-user aspects of the service are limited to interactions such as:
- comments and reviews on content posted by or on behalf of the service provider itself (for example, reviews of a product listed for sale on a website or comments on an article);
- the functionality to share those comments and reviews on another service; and
- the functionality for other users to express a view of those comments and reviews or the main content via mechanisms such as "like" and "dislike" buttons, emojis, symbol or ratings and scores.
The intention, as confirmed by the Bill's explanatory notes, is to capture 'below the line' content on media and editorial articles, or reviews where a website provides goods or services directly. However, any service which includes user content functionality beyond just this limited type of user comment functionality will not be exempt.