Online Safety – The disputes risks explained

A similar approach has been adopted in the UK, where Ofcom has been charged with turning the landmark Online Safety Act legislation into workable regulation. Companies with sufficient exposure have built dedicated teams of full-time staff and are engaging with Ofcom voluntarily and via compulsory requests for information. But enforcements are also underway, says London-based public law and regulatory disputes partner James Wood: “The regulator has kicked off a number of enforcement actions and they're clearly taking a very proactive approach to checking in with what all platforms – big and small – are doing here. Moving forward, we will see this trend of enforcement action increase and intensify as the regime beds in.”

Ofcom has expanded its team considerably in the last couple of years in preparation for this task. But for businesses with a global footprint, the challenge will be remaining compliant with online safety across multiple jurisdictions, where the territorial and regulatory scope of rules can vary significantly.

"It's another example of where we would recommend early engagement, both in terms of understanding the new obligations platforms are under and also in building a good relationship with the regulator," adds Wood. "That good relationship may assist in helping to understand and meet the current requirements, potentially help shape future developments and ensure companies in the best position should there be any regulatory investigation or action."

Companies have also made efforts to ensure their technology can adjust to geographic differences, such as age-gating in the UK but not in jurisdictions where it isn't required.

While the general approach from business has been voluntary engagement with online safety regulation, there have also been high-profile challenges, with some tech companies arguing certain regulators have overreached.

The most notable examples have come from X Corp, which has challenged the Australian eSafety Commissioner on the validity of enforcement decisions, the applicability of the regulatory regime to social media companies, and on the demarcation of freedom of speech from hate speech in online safety.

"These have been judicial review type actions arguing the commissioner has overstepped the bounds of her powers," explains Smyth. "There has been some success in those actions: last year the eSafety Commissioner was purporting to have extraterritorial reach when it came to people accessing the X platform in foreign jurisdictions, but that was found to be beyond the eSafety Commissioner’s statutory powers in the circumstances of the case."

Similarly, avenues exist in the UK for companies to challenge an Ofcom decision both during and after the process, with such routes a legitimate and necessary backstop to ensure regulators are acting proportionately and within the remit of legal frameworks.

“There is a reasonably high hurdle for a successful challenge against a regulator but there are established legal mechanisms which provide checks and balances,” says Wood. “Companies must be rightly cautious before starting legal challenges, but those within the scope of the regime should hold regulators to account if they think they are overstepping or they're pushing the edges of what a regulator can lawfully do.”

Specifically, companies should consider whether the regulator has been consistent with the existing legal framework, acted fairly and considered all views, and been proportionate. If there is uncertainty about interpretation of a legal provision or questions of disproportionality, then a company can consider a legal challenge.

The outcome of such challenges in nascent regulatory regimes are shaped by precedent: though the High Court dismissed Wikimedia’s challenge to Online Safety thresholds in August, the judgment left open the possibility of future challenges. Meanwhile, companies can also learn from challenges by services providers against regulators under the Digital Services Act.

“As we move forward, we will see more challenges where companies seek to hold the regulator to account,” adds Wood. “Companies will want to make sure the decisions regulators have taken are proportionate to the regime and lawful.”

What are the risks of private actions?

The Online Safety Act in the UK does not grant users rights of action against non-compliant platforms, unlike for example the rights granted to data subjects by the GDPR. So, does that mean there is no risk of private actions arising out of online safety?

"Unfortunately not, as we know there are claimant lawyers and funders closely watching this space," warns London-based disputes lawyer David Shepherd. "In particular, given the large number of users of some platforms, we can expect to see efforts to try and build a class action out of any breaches of new regulatory obligations."

To mitigate the litigation risk, platforms should keep that risk in mind throughout their work in this space. If a regulatory investigation leads to an adverse finding and enforcement action, claimant firms may well look to that as a springboard for a private action.

How will the regulation develop?

Much of the online safety regulation seen around the world has been developed as the power of technologies such as AI have grown. Given the urgency of the task laid down by governments and the pace of technological change, regulators are looking for ways to develop frameworks which are suitably robust and adaptable.

Australia has tried to develop a broad piece of legislation which delegated the building of regulatory codes to the eSafety Commissioner in conjunction with industry. Lawmakers hoped the approach would make for a framework adaptable to constant change.

"There are differing views on how effective that is," says Smyth. "It provides flexibility and the ability to adapt but it gives a lot of discretion to Commissioner. There is also uncertainty regarding the application of the codes to different products and services. These two things in combination have contributed to the merits and judicial review challenges alleging overreach that we’ve seen in Australia."

The debate will continue. But governments around the world have committed to online safety policy and many businesses will find themselves wrestling with how to stay compliant – often across multiple jurisdictions.

"The Online Safety Act is a huge piece of legislation which will result in a plethora of new requirements. and that will take some time to develop and bed in,” concludes Shepherd. "Clients should engage with this in the same way they would with any new piece of regulation, whether they're in the central focus of it or if it only slightly touches part of their business."