Uncorrected oral evidence: The Online Safety Act: implementation and impact
Oral evidence, 13 October 2026.
The Chair
Thanks, you have gone into quite some detail there. I have a follow-up question that you have already touched on, so perhaps we can just summarise it. Which of the new or emerging harms, technologies or patterns of behaviour are the most concerning? Andy, you might want to talk to us about the com groups again. In particular, is there anything you wish to say about how Ofcom has approached this and what it could have done? That would be helpful.
Andy Burrows
Yes, absolutely. What the response to com groups has shown is the shortcomings in the way that Ofcom has implemented the Act, as well as some of the inherent structural weaknesses in it that I mentioned earlier. If we go back to 2024, that is when we first started to see com groups emerge as a significant threat. At that point, we had the first of two warnings from the FBI. We have subsequently had warnings from the National Crime Agency, Europol, the Australian Federal Police and many others. During that time, we saw a substantial lag before Ofcom updated its register of risks. We have seen measures proposed in respect of livestreaming in the Additional Safety Measures Consultation, on which I think Ofcom will publish its final decisions relatively shortly. But there is a substantial gap between a rapidly growing problem and the codes of practice containing the measures that are needed and are commensurate to deal with a problem of this magnitude. I do not exaggerate when I say that this is the worst threat that I have ever seen. It is, in effect, a melting pot of some of the most egregious harms online. We are seeing radicalised boys with fluid ideologies, very much what we saw in Southport with Axel Rudakubana but taking place online with organised groups every day, and the regulatory response is falling short. One of the areas that I think I mentioned was about the hybrid nature of the threat. The Act deals with silos and with measures being built into codes of practice only where there is evidence that measures will work. We have a situation where, when new harms grow, there is a disincentive for platforms to be invested in safety by design to tackle them, because that will in turn add to the regulatory burden. We are effectively doing this the wrong way round. We are looking at a regime that fails to place duties on platforms to co-operate with each other on the nature of the threat. When you think about com groups, this is grooming that starts on gaming platforms such as Roblox, very often in plain sight. It will then move to the likes of Discord, where the groups will operate, or the likes of encrypted sites such as Telegram. The reality is that no one platform can see the jigsaw because they only have individual pieces of it. In the absence of clear duties on platforms to have to work together on the threat and being outcome-focused—so that the test is: is enough reasonably being done to tackle the threat?—we are seeing a regime that is at best introducing very belated, specific, ad hoc measures, rather than the comprehensive, cohesive set of duties that we really need.
The Chair
Thank you. Katie, and Professor Livingstone, I have another supplementary question. Which of the risks that children face today is the current regulatory framework least well equipped to address, and why? Andy, you have just given us one example. Katie, you talked about chatbots. Do you want to talk about that?
Katie Freeman-Tayler
It broadly comes back to the fact that the OSA and particularly the protection of children’s codes and illegal harms codes are focused on content, and content that is harmful to children, but that is not the only way that harm occurs. It can be down to the design of platforms and services. We see that with AI chatbots, where harmful content is an important consideration but it is also about continued use, misplaced trusts and the blurred lines between a trusted source of information and online and offline relationships. In that circumstance it is very much about the design of these platforms, and that is something that the OSA is least well equipped to address. Similarly, when it comes to impacts on children’s well-being, we know that more time online leads to higher rates of harm but also impacts on how children feel after they have been online, and on sleep. Those impacts are, again, not necessarily because of the content they are seeing, although that can contribute; it is often down to those platforms that are keeping children engaged for longer through mechanisms such as recommender systems and notifications.
The Chair
Professor Livingstone, is there anything you want to tell us about this?
Professor Sonia Livingstone
Yes, the evidence is mounting now very fast that the chatbots are beyond regulation at the moment and causing a whole range of problems for children, from misinformation to inappropriate advice and advice not to tell their parents of a problem that they are worrying about, and indeed, building those relationships that can themselves be so dangerous. Because these are not user-to-user services, it is difficult for the Act to address. A really crucial problem is the personalisation of the feed that children are getting, which is often weaponised against them and tailored to their particular vulnerabilities. It is very hard for anyone else to know what is being fed to an individual, because we all get a very personal and very different feed. We could look over the shoulder, and we should probably do that more, but some of the avatar studies that show what comes to a 13 year-old girl, for example, is so different from anything that will ever come to me that it is a stretch and is hard to measure and get that broad picture. Lastly, just to echo something that Andy said, I hear from children over and over again that someone says, “Look at this YouTube”, and it is not the YouTube but the comments below the YouTube that take them to a Discord server and that then take them somewhere and eventually they get to a Dropbox and see something terrible. It is across the services that are falling through the gaps of the Act at the moment.
The Chair
That is really helpful. I will come to you, Lord Storey.
Lord Storey
Good afternoon. I find your answers very depressing, to be honest. It is almost as though we are playing catch-up. My question will now sound a bit trite after what you have said in your opening comments to question 1. We all thought and hoped when we were dealing with the Online Safety Bill that we were going to be able to make a real improvement to the safety of children online. From what you have been saying, that clearly is not the case. My question was going to be: what changes have online services made to protect children in response to the Online Safety Act, and how effective have they been? It is almost like you cut off one head and another head or tentacle grows up. I do not really know what to say. Sonia, perhaps you can help me.
Professor Sonia Livingstone
I will have a go. The position is not entirely depressing. At our centre, we have been trying to track what changes platforms are making as a result of the Act. Of course, the Act came in at the same time as, and hard on the heels of, the age-appropriate design code, as part of our data protection regulation, and at a similar time to the EU’s Digital Services Act. So the platforms are responding to a number of different regulatory changes all at once. When the Act first came in, we saw a number of efforts to change services by design and by default. Some steps were taken towards the safety by design that I think many of us would advocate. But that is tailing off. We saw less of that in our last effort to look at this. My colleague Steve Wood has looked at 70 services and how they have responded to the Act, and what we see is increasing provision of user guidance, parental tools and age assurance. So there are some greater efforts to keep children away from services that the Act says they should not be using and some greater tools in the hands of parents and children. What we do not see so much is efforts to stop the problem arising in the first place as a matter of by-design and by-default provision.
Katie Freeman-Tayler
Just to build on that, we did research with UK families after the protection of children codes came into force and, similarly, found that children, young people and parents reported that there were more reporting tools and features on platforms, such as age checks and parental controls, and that there were limitations on features on platforms. However, unfortunately, that has not led to the step change in children’s well-being and safety that we expected. In the same study, we asked children whether they had experienced a list of harms in the months after the protection of children codes came into force, and we found that around 50% of children had experienced at least one type of harm. This included seeing violent content, content promoting unrealistic body types and hate speech, which should all be prohibited under the protection of children codes. Examples that were given in focus groups included children seeing the video of the assassination of Charlie Kirk—not seeking it out but it just appearing in their newsfeed—through to localised examples of violence, maybe a fight or weapons in their local area, coming up on their feed as well. Similarly, in the same research, we heard children and young people talking about how much they were struggling with disengaging from online spaces and the impact that that was having on their well-being. If we focus on age checks as an example or microcosm of where a change on a platform is not delivering on the intended outcome, around 50% of children had been through an age check in the two months after the protection of children codes came into force. That might have been on an existing platform or a new platform. However, around the same number of children thought that age checks were easy to bypass and a third of children had actually circumvented an age check. Obviously, that is significant because, if that is what is being used to protect children online and to reliably understand their age, it cannot deliver the protections that are needed for children and young people. We also see this with the fact that so many young people under the age of 13 are on platforms, despite many platforms’ terms of service having 13 as the minimum age. Children are accessing platforms that are not designed for them. We see that kind of disconnect not just with age checks but also with reporting—more reporting features but the same levels of reporting.
Andy Burrows
Katie teases out an important point, which is that so many of Ofcom’s measures feel like they have been outputs rather than being rooted in delivering outcomes. Where measures have been adopted into codes of practice, they are not translating into the change that civil society and Members of both Houses would have expected when the Bill was passed. At the Molly Rose Foundation, we always had a very simple yardstick for the Act: would it do everything that was reasonably possible to prevent further deaths in circumstances such as Molly’s? Unambiguously, the Act has so far failed in that regard. Our research, which we undertook immediately prior to the Act coming into force and then again earlier this year, shows that there has been no change in the proportion of teenagers seeing harmful suicide, self-harm, intense depression and eating disorder content. Some 48% of girls had seen that content, which we would expect to be classified as either primary priority or priority content under the Act and therefore either restricted or throttled. That has dropped by only one percentage point compared to the data from before the Act took effect—so, no real change. One in five girls who see content that actively promotes suicide sees it 10 times or more per week. That is exactly the type of cumulative harm that led to Molly’s death. Of the algorithms recommending large volumes of content, on about 60% of the occasions, on each of the platforms we surveyed where young people were seeing this content, it was because of algorithmic exposure. It is a failure to tackle those systems and processes. The measure that are built into Ofcom’s code are not translating into results. For me, one of the things that is most frustrating is that that data has shown that, on TikTok, young people are three times more likely than on the next platform to see this type of content. As a civil society organisation, I do not know what more evidence we could produce to prompt Ofcom to open an investigation into the algorithmic failings of a platform such as TikTok. It is frankly exasperating that we have seen the European Commission reach provisional findings on an investigation into the same thing, and Ofcom, with the evidence being provided to it, has still not acted.
Lord Storey
It is almost like Ofcom is playing catch-up all the time. Ofcom itself says that it has seen no significant reduction in overall exposure to harmful content among 11 to 17 year-olds. It reminds me of something that the Children’s Commissioner said when she came to speak to us: the platforms themselves have a duty of care. Well, if they do, you would expect them to be proactive—not waiting for the latest piece of legislation to come down the track but to do something about it straight away. I wonder whether we are perhaps not dealing with it in the right sort of way and whether, all the time, we will be faced with the new way of exposing young children to harmful content.
Andy Burrows
That is probably one of the major structural issues with the Act: what was originally intended as being an overarching duty of care, analogous perhaps to health and safety legislation—where the objective is that you have to deliver outcomes and the defence is that you can reasonably point to having taken steps to tackle identified risks—is not what we have ended up with. Instead, we have ended up with a set of safety duties that are operationalised by codes, and then the measures are set so low—in conjunction with the safe harbours, which I imagine we may go on to—that it means that we end up with a regime that is, effectively, capturing the status quo at best.
The Chair
That leads into our next question, from Lord Kirkhope.
Lord Kirkhope of Harrogate
Thank you for coming. I want to ask you some specifics. In doing so, I refer quickly to the reference made to the GDPR, which I had something to do with preparing and drafting when I was in Brussels. It was always going to be an umbrella, if you like, which was going to rely on further legislation of a more individualised nature and particularly on regulators, which would have adequate powers to be able to find the redress and the actions that were necessary. In that context, let me ask you about a specific point: in Section 1 of the Act, as you know, the whole point is that regulated services must be safe by design—that is stated very clearly. I know that the Molly Rose Foundation in particular has expressed concerns about that, around its nebulous nature or the difficulty regarding it. I would like to know your views: in this context, do you think the regulator, Ofcom, has enough scope or powers to enforce changes in service design when it is clearly shown to be inappropriate or unhelpful? Could you answer that one for me first?
Andy Burrows
Sure. I think many of us anticipated this. As you said, the online safety objectives are there, right at the beginning of the Act, and the wording around safety by design is unambiguously clear, but I think Ofcom has expressed that it does not feel that it has the powers in the Act to then be able to operationalise that. I am not sure that I understand those arguments, so I will not try to explain them on Ofcom’s behalf, but I think there is a substantial gap between what we thought the Act would do and the way in which Ofcom’s lawyers have interpreted it. The other part of this is that, where Ofcom has the scope in its codes of practice to introduce safety-by-design measures—for example, relating to the algorithmic recommendation of content—those are then developed in a way that hamstrings their overall effectiveness. The way Ofcom has interpreted this is that provisions have to be clear, detailed and technically feasible, and there has to be an evidentiary threshold to show that they are proportionate. When those things are built in, it means that, even where measures are being built into codes, their potential efficacy is likely to be very low, because they are just being constantly chipped away at to the point that it becomes, effectively, a tick-box exercise.
Professor Sonia Livingstone
I have also been thinking about what Ofcom has been doing. I know there is considerable frustration among civil society groups, as you will have heard, about the piecemeal and one-by-one ways in which it takes some actions. This year, Ofcom looked into how Snap had allocated its risk levels for Snapchat and found that it had not identified as high risk the fact that adult strangers are able to contact children. Ofcom intervened here and got Snap to agree that it would now stop adult strangers contacting children. To many sitting outside, it is just mind-blowing that this was not done the minute the Act came into force, nor indeed under the 20 years of self-regulation that we have all lived through, where probably the public’s No. 1 anxiety is that adult strangers can contact children. Yet this was just this year—and then we go back into the waiting game. Will it happen? Will it be followed through? How will it be checked? How will we be sure that they do not roll back on this promise, given that their business model is expanding content and contacts? How will we be sure that children are safe as a result? A lot of the questions about evidence cut both ways. It is very hard in civil society to see what indicators we could get from how platforms operate to see whether they are indeed acting as they said they would—or as they should—and to see that those improvements, if they exist, continue.
Katie Freeman-Tayler
The only thing I would add is on the pace of change or recognition of challenges. Platforms continue to roll out new features—they add in things such as AI, or new types of messaging or image sharing—and, for some reason, that is not being picked up before those are released, so there is none of that safety by design from the beginning. An example is the new feature that has been added to one of Meta’s platforms. An investigation has been opened into it, but that is after it has been out for around six months. There is also a question around why Ofcom is not addressing these safety-by-design issues at the outset.
Lord Kirkhope of Harrogate
I will put two things to you, if I may, and ask for your comments. One is safe harbour, which in itself some people have suggested should be done away with. There are criticisms of Ofcom having a tick-box mentality regarding it. I would like your comments on that. The other thing is the question of proactive technologies.
The Chair
That is another question.
Lord Kirkhope of Harrogate
Oh, it is; I am so sorry. I shall leave that to my colleague—in which case, I would like your comments on safe harbour, please.
Katie Freeman-Tayler
I will leave that one mostly to Andy. From our perspective, any measures that could improve the safety and well-being of children and young people should absolutely be acted upon.
Andy Burrows
We would support the removal of safe harbours. They can be an effective part of a regulatory regime, but, in reality, the way that Ofcom has developed the codes means that the total measures that platforms have to deliver are barely capturing the status quo, and then the safe harbour means that platforms do not have to go any further. They should go. Even if we were to wave a magic wand and Ofcom were suddenly much more ambitious and assertive than it has been to date, we obviously now have thousands of pages of Ofcom decisions saying that it is not proportionate to do X, Y and Z, so I am not sure that this is merely a step change in ambition; the safe harbours need to go.
Professor Sonia Livingstone
It was plausible at the time, when the Act came into force, that there would be the safe harbour to get the platforms to play ball and take the steps that they could, and then there would be a further assessment and we would see whether that was sufficient and whether the expectations should be raised. Since the platforms have not done what was expected at the start—and the sense is that the safe harbour is setting a ceiling for what they might do, rather than a floor from which they would progress and do more to keep children safe—I would agree. The comparison with Europe’s Digital Services Act is striking: it does not offer that safe harbour, and they are now pushing for safety by design in a more ambitious way.
Lord Tarassenko
Lord Kirkhope has been proactive in flagging my question, which I welcome. The word “proactive” often appears in your submissions. I want to focus on proactive technologies—for example, tools that analyse the content, such as hash-matching tools or even automated classifiers. AI could really have a role to play in that before it even reaches the children. Interestingly, when Ofcom came to see us, they said they would want to see wider use of these technologies to protect children, but their written evidence also said that the OSA limits their ability to require the use of these proactive technologies. If we had OSA 2.0, would you welcome that—legislation that would make it easier for Ofcom to require the use of these proactive technologies? Or can you think of anything else in terms of these tools, or similar ones, that would make a real difference?
Professor Sonia Livingstone
I am thinking about the GDPR and wondering what the barrier might be; I assume it is going to be something about data protection and privacy. There is a serious issue in which that kind of proactive AI-led analysis could involve privacy risks if it were done in a way that was not transparent or open to scrutiny by independent researchers or civil society, or indeed the regulator. That would allow the platforms to conduct all kinds of analysis that at the moment data protection precisely restricts on the grounds of privacy. We would need to be convinced of the benefits that that was proportionate and that people’s data protection rights were protected in the process. At the moment, that would take a lot of trust in the way that platforms operate, since they are so black-boxed that they give us little in terms of their risk assessments and their mode of operation, and the data that was always offered to independent researchers has never materialised. In short, it is very hard to know how we would have any checks and balances that what they were doing was appropriate and effective.
Lord Tarassenko
To take a simple example, which was mentioned by Andy, could you not proactively look for suicide content and prevent it from reaching that young teenage girl?
Professor Sonia Livingstone
Andy, you were going to talk about suicide.
Andy Burrows
Crudely, if we rely only on content moderation, then we are acting after the event and after harmful content has already started to be distributed, and we know that it can be distributed at scale very quickly. So proactive technologies absolutely play a role. Right now the regime does not incentivise the use of proactive technology. This comes back to what Sonia described a moment ago, with Ofcom developing codes of practice that act as a floor rather than a ceiling. There is much more that we could do with proactive technology to identify and remove, or prevent the distribution of, harmful content; to do that to a high standard; and to share signals between platforms of harmful content that is being shared, in respect of com groups and the behavioural nature of risks. That is something that we should see. Right now, we see the industry doing that itself on a voluntary basis—albeit with no meaningful transparency about whether those measures are effective—and that is over and above what Ofcom as the regulator requires. So there is a role for proactive technology, and Ofcom’s remarks were very interesting. My fear is that if we had a clause added into the Act that broadly allowed for proactive technology, we could find ourselves in the same situation where, regardless of the policy intent, Ofcom’s lawyers then chipped away at its usefulness until we ended up with measures that were there but not terrifically effective. We should look much more structurally at how we can have an outcome-based regime with an overarching duty of care that says, “Your job is to make sure that the platform is safe”. Then, by implication, proactive technologies would be one route to achieve that. We have been badly burned by Ofcom’s risk aversion and, frankly, the lawyers chipping away at something until there is not much left.
Katie Freeman-Tayler
Obviously we would support the proactive use of technology if it was effective and privacy-preserving. What I am cautious about is that it might be an either/or, where we say, “We are using this measure now so we don’t have to use those measures”. Children’s online safety is always going to need a layered approach. You need a number of different measures working on top of each other to produce good outcomes, and that needs to be kept in mind. We should not say, for example, “If we’re using this technology then we don’t need to look regularly at how recommender feeds surface content”. That would be my only caution.
Baroness Elliott of Whitburn Bay
I think I know what your answers will be on this from all your comments on Ofcom, but I would like to ask the question in any case to get a clear, straightforward answer. Ofcom has described its approach to supervision and enforcement to date as strategic, saying that it is learning to walk before it runs. Is that a fair characterisation of what it has done? Has it set the right threshold for when to take formal action?
Andy Burrows
The regulator has been far too risk averse, and it has been far too slow to act against the largest companies. Ofcom has set out that it has chosen to focus on certain harms, particularly around pornography and Section 5 of the Act. However, that has been at the expense of the focus on large tech companies. It is striking that we are now seeing investigations being opened into TikTok and Meta. The investigation into Meta is very welcome but it is essentially a procedural slap on the wrist. We have not seen investigations going for the high-risk design features, the algorithms and the fundamental design choices that we know are the drivers of harm and that result in problematic use and problematic experiences. I make the comparison between Ofcom’s approach and that of the European Commission, which came out of the blocks very quickly to enforce the DSA by opening investigations into TikTok, Instagram and Meta. It made very clear that it had the powers and that it intended to use them. From my engagement with the companies, if you ask if they are complying with the OSA then you generally get a bit of a shrug, but if you talk about the DSA then they sit up and take notice. There are lessons to be learned there.
Professor Sonia Livingstone
The other striking example that we have all been paying attention to this year is the litigation happening in the US, especially in California but also from the attorneys-general, particularly against Meta but against others too. There again, we see a focus that is especially concerned with safety by design, with advance warning and with knowing what the risks are on a platform and then being held to account for not having informed children and parents that the risks exist, and we see a focus on the features. That is where, both in Europe and in the US, there is a move away from saying that a platform is good or bad and instead looking at where it is designed with particular features that are available and carry a high risk—live streaming might be a good example, or having open profiles that strangers can contact. It is not hard, and a list of features is now emerging. This approach has not come from here, from the actions of Ofcom and the OSA, but it has become an international consensus that that is the direction of travel and we really hope to see that happening here as well. As a rider—maybe this is more of a political point—from the platforms’ perspective, there is power in numbers: hearing the same message coming from multiple states and big markets has power. In that sense, it feels to me that it would be effective if Ofcom acted in tandem with what is happening in other countries so that the big companies get the idea that the consensus is that change is expected now.
Katie Freeman-Tayler
The slow enforcement has created a gap between expectations and reality. That is what has led, particularly from the public, for a push for more protections for children online. Parents did not think the online world was getting safer—they were not seeing differences, and so they were driving for more changes. We will continue to see that unless we focus, as Andy and Sonia have pointed out, on outcomes—what are we trying to achieve? Compliance is useful only if it drives those outcomes; it is not useful for compliance’s sake.
Baroness Owen of Alderley Edge
Focusing specifically on Ofcom’s investigation of the US-based suicide forum that we all saw, could you tell us more about the limits of Ofcom’s enforcement powers under the Online Safety Act? Would you like to start, Sonia?
Professor Sonia Livingstone
I will probably defer to Andy on this one, but, generally, we see a difficulty in transparency and in understanding how platforms are operating, and a lack of public risk assessments, so that it is very hard to know what is in fact happening. On this particular case, would you like to answer, Andy?
Andy Burrows
Sure. This forum is absolutely appalling. We know that more than 160 lives have been lost because of it, and the true figure is likely to be substantially greater. This forum exists to promote and encourage suicide, and in particular to promote a suicide method which is then sold through the site and related marketplaces. It has been allowed to exist in plain sight for far too long. There are limitations in the Act, but this has also not been an example where Ofcom has covered itself in glory. The Lords amended the Act to give Ofcom powers specifically to regulate small but high-harm sites, which Ofcom then recommended to the Secretary of State should not be enacted, which is a decision I find inexplicable to this day. It has then taken Ofcom a torturously long time to determine that this forum was breaching a whole catalogue of safety duties—frankly, I think many of us could have taken a look and decided that in the course of an afternoon and arrived at a watertight set of conclusions. That has been incredibly retraumatising for bereaved families who have been campaigning for Ofcom to take action on this and have been desperately affected by the failure to grasp the urgency of this; we certainly know of lives that were lost while Ofcom’s investigation interminably dragged on. On the point about the limits of Ofcom’s powers, which I think have been surfaced, there are three that I would really highlight. One is around issues of scope and jurisdiction. This is a forum that has played a cat-and-mouse game of voluntarily geo-blocking itself when the heat comes on it in jurisdictions. That voluntary geo-block means that Ofcom has then said that no further action can be taken against it. We should instead be amending the Act so that action can be taken where there is a significant risk to UK users, so we can shortcut this kind of complicated issue around scope. If it can be accessed in the UK and we know that it can and it is causing harm, then Ofcom should be able to intervene. Secondly, I think Ofcom has felt that it was not possible to apply for an interim service disruption order. Ideally, it could do that where there is an imminent risk, as this case has clearly demonstrated, while an investigation is ongoing. If there is a public safety risk that justifies an immediate service disruption order, Ofcom should have the ability to go to the courts and apply for that. There is also a case for service disruption orders where, for example, a platform does not pay a fine: you have a situation right now where the fine that has been levied against this forum is there with very little chance that it will be recovered. The third gap is around criminal sanctions. We should be looking at how they can play a much more expansive role in the regime, broadly; on this forum specifically, we know who its operators are—they operate this forum and the world’s largest incel forum, and they are fundamentally bad actors responsible for truly appalling, egregious harm—and we should have criminal sanctions that could apply. In practice, what does that mean? I guess that, if they want to try to leave the United States, then there is an Interpol notice on them. There are a range of ways that the Act could be amended so that we really start to bite on some truly appalling individuals and the truly appalling harm that they cause.
Baroness Owen of Alderley Edge
Thank you, Andy. We have touched on the second part of my question; just to conclude it nicely before moving on to Katie, would you say that that would make the biggest practical difference in this case and any future cases to ensure that we capture services that refuse to comply?
Andy Burrows
Yes, absolutely. I would really encourage Ofcom to be working with the Secretary of State at pace to identify what lessons need to be learned here. The reality is that, if other, similar sites appear, which they will, then, right now, the Act has proven that it is limited in its scope to protect some of our most vulnerable.
Baroness Owen of Alderley Edge
Katie, would you like to add anything?
Katie Freeman-Tayler
There is nothing I could add to that—it was very powerful—but we would also support changes that prevented further harm from happening, particularly when an investigation is already under way.
Baroness Owen of Alderley Edge
Thank you so much.
The Chair
Just to complete a question that Lord Kirkhope asked you earlier, I think you all said that safe harbour should go. Is there something it should be replaced with, or is it as Professor Livingstone was saying—it was maybe needed to start with, but let us look at the situation and say that it has not worked having it and that it is getting in the way?
Professor Sonia Livingstone
The alternative would be to have a more articulated and developed code around safety by design—which is now emerging in a number of countries—and, to be crystal clear, what that includes and the standards that we would expect it to live up to. For example, age assurance would be part of safety by design, but a lot of age assurance, as it is being implemented, is not privacy-respecting and does not draw on the existing standards that are being used. I could say the same for parental control tools, for example. But, on pre-emptive actions—I will go back to that list of features and functionalities of platforms—having a risk assessment attached to those and then ensuring that those are embedded in a code, which it is then mandatory for platforms to live to, is probably where the EU kids Act is also going to go, building on the DSA.
The Chair
Do you have anything to add, Andy or Katie? No? I will move on then. The next question is about the potential benefits and risks of preventing under-16s from using social media—a ban, effectively. How do you see those restrictions interacting with the Online Safety Act? Andy, can I start with you?
Andy Burrows
Sure. The Molly Rose Foundation has been concerned that a ban means that we move from an Online Safety Act that has not worked effectively to a measure that is well intentioned but where we have question marks about whether it will work as intended and designed. I spoke earlier about how we have not seen the Online Safety Act deliver a meaningful change in platforms. They are simply not complying. If we are going to introduce a ban with the same incentive structure in place as the Act, I do not see how we should expect materially different results. If that is the case, then my fear is that we will be looking at compliance that is broadly similar to what we have seen in Australia, Indonesia and other countries that have brought in a ban so far. Our big fear there is that in that situation—and this is being borne out by the data we have seen from the eSafety Commissioner in Australia—we will see a disconnect between parents who think their children are no longer on these platforms and the children themselves, who are there in significant numbers. In that case, our fear is about the safeguarding risks. We have spent 10 to 15 years trying to build an approach to online safety based on relationships of trust between parents, professionals and children, but we risk putting a barrier in the way while the harms are still there and are being tackled. The real risk, now that we are moving forward with a ban, has to be thought about carefully to ensure that we do not see unintended consequences. There is one more point here. You mentioned the interplay with the Act. There are some very big unresolved questions about the interplay between a social media ban and the children’s codes under the Online Safety Act. Essentially, this is about whether a form of double jeopardy can apply. If the ban is introduced to a similar level of compliance to what we have seen in Australia, where somewhere between 60% and 85% of children are still viewing content on these platforms, then can a platform be allowed to roll back its measures under the children’s code for under-16s? Can it be held accountable if children are then navigating the ban and accessing content with perhaps even fewer protections than now? I have not yet heard a clear position about what that interplay looks like. The fear is that we could end up with a situation where we have a ban in name only and children continuing to use services with even fewer protections than now. There is an opportunity to surface what that interplay looks like so that we can draft the regulations to avoid that risk, because clearly it is not what anyone, whether they are pro or against the ban, wants to see. We still have that ambiguity, and that ambiguity is worrying me. We need to understand that to make sure that the regulations that will be brought forward in a matter of weeks can adequately deal with those dynamics.
Professor Sonia Livingstone
I absolutely agree about the uncertainty and what it will mean for the implementation of the Act, and indeed what it will mean for the actions of platforms, if children are banned below a certain age. How will the platforms then provide, on the assumption that everyone there is an adult? How will we and Ofcom respond when it turns out that of course children are still using those services but the platforms have been given a licence to withdraw their safety efforts because they will have been told there will not be children there? As I understand it, one key reason why the Australian ban is failing is that the platforms are not implementing age assurance effectively. There is of course a wider debate to be had about whether age assurance can be implemented effectively in a way that is privacy-preserving and will get the trust of the population. It is not that there is a simple technology that they are failing to use; there is a genuine debate, especially in the privacy community, about whether there can be such a thing. We need to find a good age-assurance solution, whether we want to ban or whether we want age-appropriate safety by design. Do we have it today? Not necessarily, but a crucial point is that one might begin to wonder in this conversation why on earth children want to go on social media at all, given all the horrors that we have been elaborating. No one wants children to be in a deeply unsafe space, and neither do children themselves, but they want to be part of a digital world. They want the opportunity to chat with their friends, meet others, participate, express their views, join groups, share culture and so forth. All of those are their rights. In the holistic sense of how we bring up children to live in this digital world, our task is to enable those rights safely rather than, as it were, wrapping them up in cotton wool and keeping them away from everything. That is why there are some real concerns about a high age limit that is, I suggest, too high for children who need to be in touch with people, to get help and to go online to the sources of help, support, belonging, information and action. That is what they often tell us about.
Katie Freeman-Tayler
I think there are some positives to a ban. We find that children experience a significant number of harms on social media platforms; around 85% of the harms that children experience happen on social media, according to our data. We also see that some of the platforms that have personalised feeds based on the child can have really negative impacts on children’s well-being as well. The potential of the ban is that we reduce the amount of harm that children experience and improve their well-being, but these opportunities can only be realised if age assurance is implemented effectively, as both other witnesses have touched on. What we have seen in Australia is that to date that has not been the case. We also need to look at how children may circumvent some of these measures. Unless that piece of the puzzle is solved then a ban is unlikely to deliver those positive outcomes. However, there are a lot of risks that come with a ban. Harm does not just occur on social media; it happens across a range of platforms, such as messaging services, gaming platforms and AI chatbots—smaller platforms that we might not think about just yet. It is unlikely that harm will disappear; it will probably just be displaced to other platforms, and we need to be cognisant of that. As Andy touched on, there is a danger of a false sense of security for families. The online safety landscape is difficult already for parents. There are a number of age checks, and that is only going to become more complicated with a ban as it is likely that children may fall through the gaps. Parents may think they are safe, but they are not. Children of different ages will have different protections. It is important that we support families in that period to understand how children are safe online, with media and digital literacy skills and guidance around that. To touch on Sonia’s point, children want to be in these spaces. They create community connection, and they help them to learn and stay informed. Some children rely on these spaces more than others, particularly those with additional needs, and they will acutely feel that loss. How do we support their well-being from that perspective? On the question of how it intersects with the Online Safety Act, one of the strengths of the OSA is that it is platform agnostic, so we need to not let it take a back foot; we need to continue to keep pressure on the Online Safety Act to keep children safe in those spaces, like gaming platforms, for example. It also covers 16 and 17 year-olds, and one criticism has been that a ban might create a cliff edge for children and young people rather than preparing them for a digital world.
The Chair
You touched on this in earlier responses, but would the approaches being considered in Canada and the EU, which place more responsibility on services to demonstrate that they are safe for children, address all the drawbacks to the under-16 ban?
Katie Freeman-Tayler
That would be an improved approach. The safety-by-design element would serve some of the benefits that we have just talked about. It would probably be less complicated for families, hopefully, and it would stop that cliff edge. Most importantly, when we ask parents about whether they supported a ban or other alternatives, safety by design was a popular alternative. More parents supported alternatives than a ban itself in our research.
Andy Burrows
Both Canada and the EU have strong outline approaches. Canada in particular effectively views a ban as a means to an end; it is a means to incentivise safety-by-design requirements. That is an approach that Ministers have signalled in recent weeks they are looking at in terms of whether there should be off-ramps. That addresses some of the strong disincentives to comply with an outright platform ban. It means that we could be looking at a model where there are stretching targets that are not fixed in aspic but can be amended. If a platform earns an exemption then that is only as good as continuing to invest in safety by design. In terms of seeing compliance, there is a path here for the UK, Canada and the EU to come together as middle powers, with an approach that is broadly similar and focused on safety by design, with a ban as a means to an end. Even compared to back in June, when the then Prime Minister announced the ban, the Australian approach already looks like an increasingly lonelier and harder road than it did just a few months ago.
Professor Sonia Livingstone
The principle sounds great. It resonates with many people that you do not let a product on to the market, especially for children, until you have proven it safe. There are some serious practical problems—I can imagine the lawfare that is going to result as companies start suing because they are not allowed into the marketplace—so we are going to need some very strong regulation if that is the direction. One difficulty that we are currently facing is that we have had a race to the bottom in the way in which social media platforms have provided for the public, so we do not have a diversified market in which we can already say, “This one is safe, this one is child friendly and this one is aspiring to do the right thing”. That comes back to the question of incentives and how we get a more diversified market so that parents and children can make choices and know what to avoid, what could suit them and what could keep them safe.
Baroness Caine of Kentish Town
Thank you so much for all your stimulating evidence. I have the last question, which you might recognise if you have read the previous contributions, which I think you have from some of the evidence that you have been giving: if you had to prioritise, what are the key recommendations that this committee should make to improve children’s safety online, and why? I am going to ask you for two priorities each.
Professor Sonia Livingstone
Oh dear. That is a zero-sum game, is it not? I might start with making age assurance effective because, until we know who is a child online, we cannot treat them as a child. Finding a trusted mechanism that meets privacy-preserving standards and so forth is critical. Secondly, I will mention something that has not really come up yet: an issue of reporting. I work with a child-rights approach, and children need remedy. When something goes wrong, nothing works for children, so can we make something that works? Can we really put some effort into the reporting services that platforms operate, which do not work and which children do not trust, or other services? Can they report to Ofcom? That could perhaps be a helpful change. At the moment, when there is a problem, children have nowhere to go.
Katie Freeman-Tayler
An important part of online safety is not just regulation but education, supporting media literacy and supporting parents. Just last week, the Molly Rose Foundation and Internet Matters wrote a joint letter signed by 70 organisations calling on the Government to make media literacy a national priority. That is not just about protecting children and young people online, particularly from new risks; it is also really important for democracy, social cohesion and growth. As this committee knows more than anyone, it is a shared responsibility: there needs to be action at the government level but platforms can be made safe by design. We need support for teachers to teach media literacy confidently in the classroom, and support for parents who we know are children’s main source of information about online safety. That would be my first one. My second is a focus on outcomes. We cannot just be thinking about compliance. We have to think about what outcome and vision we want for children and young people in the UK. How do we want them to benefit from online spaces and thrive online, and how do we get there?
Baroness Caine of Kentish Town
Thank you. As you are aware, this committee has done a report on media literacy. It is something that is very dear to our hearts, so joining up on that agenda is something we will be looking at.
Andy Burrows
I am conscious that I have been very pessimistic in my answers, so I will say that we are dealing with preventable harm and issues of product safety here. We should not accept that tech products are somehow exceptional and different; we know how to do this in every other part of the economy, so it is just a matter of will and fixing the things that have not been learned. I would like to see the Government commit to a third-Session Bill, and for that to be ambitious in its scope to fix and build on the Act that we have right now. There are two key elements to that. First, we should move back towards an overarching duty of care, which is what many of us envisaged when discussions around online safety legislation first started, very clear outcomes and learning the lessons of what has worked. I mentioned health and safety legislation, which went on to the statute book in 1974 and is as good today as it was back then. The second is a focus on incentives. I would look at what has worked well in financial services regulation, where we have seen huge companies but with a focus on criminal sanctions and conduct measures, which we know has brought about fundamental change in, for example, retail banking. We should be looking at those lessons because, frankly, with some of the most cash-rich companies in the world, we have seen that fines will not work and there are strong incentives not to comply. Let us learn the lessons from financial services.
Baroness Caine of Kentish Town
One issue that you have all touched upon variously is the hybrid nature now of how things are developing and morphing. Do you have any thoughts on what a regulator could do to manage that within the kind of constructs that you have been talking about? You have talked about a duty for people to collaborate, but how would you enshrine that in a legal response?
Andy Burrows
At every stage of the process, whether risk assessment, risk mitigation or showing that you have discharged a duty of care, this is about recognising that there are harms that just do not exist in silos, so you should be co-operating with other platforms to understand the threat. You should be developing appropriate structures, as seen in respect of child sexual abuse and terrorism, to work together to identify, to signal-share, to respond and to mitigate threats. There should be co-operation on what proactive technology looks like and how we can ensure that that meets sensible safeguards. It is about embedding it throughout.
Baroness Caine of Kentish Town
Like the word “Blackpool” through a stick of rock—an expectation all the way through. Maybe that was a bad analogy.
The Chair
We need to finish now because we have run over a bit. Thank you for sticking with us for a slightly longer session. On behalf of the committee, thanks for all the work that you do—not just your presentations to us today, which have been very helpful, but the difficult work you do navigating all this. We know it is difficult and horrible but it is vital work. We all want to protect children but you are on the front line doing it, so thank you.