A row of peers has gathered in Westminster to decide whether the Online Safety Act has been cruel enough to the internet yet. After some hours of evidence, the verdict came back: not nearly.
The Communications and Digital Committee has been quizzing stakeholders about how the law is going, and the charities it called have a grievance: Ofcom is too soft. Andy Burrows of the Molly Rose Foundation put it like this: “I do not get the impression that the companies are quaking in their boots at Ofcom’s enforcement approach.” The boots, by every account, stood steady.
The censorship law, for anyone who missed its arrival, will make Britain the safest place in the world to be online. It says so itself. The maximum fine runs to £18 million ($24M) or a tenth of worldwide revenue, whichever bites harder, which for the biggest platforms would reach into the billions. And still, no boots.
So the room reached for the obvious cure. More of it. Baroness Kidron of the 5Rights Foundation, defending Ofcom and filleting it in the same breath, allowed that “the act is wrong in certain places and does leave certain gaps, and will need some more work.” Some more work. The gaps, you understand, all run in the one direction.
Look at the machinery already bolted on. A platform that performs “Ofcom’s 44 measures, or whichever number it is now” — Kidron’s phrase — is safe. Do the 44 things, claim your safe harbor, go home. Try something cleverer and you forfeit the protection. The law rewards the box-tick over the better idea. A bold design.
And the boxes do get ticked. Nearly two-thirds of daily visits to Britain’s adult sites now pass through an age check. Lord Vaizey told the Lords that Ofcom had begun investigating 47 sites for non-compliance. Ofcom’s own spokesperson said 69. Enforcement is one of those two numbers.
Ofcom says the picture is better than that. Change was already happening, its spokesperson offered; platforms held to account, fast enforcement launched, more protections put forward. Burrows allowed that some of the action already under way might be supervisory, Ofcom working with a firm rather than fining it, though the process is opaque enough that nobody could say how industrious it was.
Meanwhile, the children the whole edifice was raised to protect. On the risk it already knew well, child sexual abuse, Burrows granted Ofcom was doing a good job. His worry was the newer harms. He kept returning to the Com groups; networks largely of teenage boys, whose reported numbers rose sixfold between 2022 and 2024, running a new kind of grooming pointed at suicide and self-harm. The Molly Rose Foundation carries the name of Molly Russell, fourteen, who viewed thousands of images promoting suicide and self-harm before she took her own life.
Rani Govender of the NSPCC laid out the trap: when a platform spots a harm the codes of practice never named, it carries no obligation to act on it. The law covers what the law already wrote down. More scope. More codes. More measures numbered 44, or whichever it is now.
One problem stayed off the agenda. The Act treats two hard engineering questions as things a statute can order into being. The first is reliable age estimation; in the opening days of the new rules, people strolled past the checks using video game avatars to pass as adults. The second is reading encrypted messages without breaking the encryption, which cannot be done, a point Signal made by offering to leave the country rather than build the back door. “If the choice came down to being forced to build a backdoor, or leaving, we’d leave,” its president wrote. A mandate is a wish with a fine attached.
The public has been voting with its downloads. When the age checks landed on July 25, Proton VPN clocked an hourly sign-up increase of over 1,400 percent. Ofcom’s answer was to tell the BBC it would be illegal for platforms to encourage VPN use. To Ofcom, a loophole to close. The verdict in it went unheard.
And the petition to repeal the whole thing has passed 550,000 signatures. Having heard all of this (the avatars, the VPN stampede, the third of a million names) the committee asked whether the age-check regime might also be extended to VPN providers.
You must be logged in to post a comment.