Recent developments put online service providers in the firing line

2026 has seen a seismic shift in the debate around online safety in the UK, leading to a position few could have predicted when the UK Online Safety Act (OSA) 2023 was first conceived. The passage and introduction of the OSA was accompanied by considerable discussion of and emphasis on proportionality and protecting privacy and freedom of speech. With the current focus squarely being on protection of children online, these wider considerations seem to have become less prominent in both public debate and UK Government/regulatory statements. 

The Government appears keen to reflect what it sees as the change in public mood around social media with its own tough words and tough action. No-one can doubt the importance of protecting children in the online world. But the seemingly constant and often rushed moving of the goalposts brings its own consequences. 

In this post we recap some of what has been happening in the UK online safety regime and identify potential issues that need to be acknowledged and addressed head on if we are to have a workable, effective and proportionate approach to online safety, whilst protecting other rights crucial for the rule of law. 

The direction of travel

A succession of proposals and announcements in recent months give a clear indication of the Government’s intentions (both under the Starmer and now Burnham governments). 

Blocking nude images

In September, the Government announced that it was preparing legislation to make it impossible for children to take, share or view nude images by introducing requirements for stronger safeguards to be built in on devices. There had been debate about where primary responsibility should lie (i.e. at app or device level), but the Government had indicated earlier in the year that it wanted technical solutions or features to be implemented on devices to detect and block nude images for children, and that if action was not taken within 3 months, it would legislate. By making good on that threat with this recent announcement, alongside consideration of legislation requiring apps to do the same, the Government has made it clear it is making changes across the whole ecosystem beyond platform providers, who, to date, have been the focus of much online safety legislation. 

The press release was unusually frank in discussing ongoing negotiations with major providers over these issues and the Government’s view that, while progress had been made, it did not meet the scale of the Government's ambition. That headline grabbing ambition is to have the “world’s strongest online child safety laws”. 

Illegal intimate images and deepfakes

As part of the duties under the OSA on providers to prevent, mitigate the risk of and remove priority illegal content, such as non-consensual intimate images (NCII), the regulator (Ofcom) recommended in updates to its Illegal Content Codes of Practice that providers have automated technology in place known as ‘hash matching’ to detect and prevent the sharing of such images, including explicit AI-generated deepfakes. By 30 September 2026, when the amendments came into effect, Ofcom expected online platforms to have hash matching in place or otherwise demonstrate that their systems and processes curb the spread of NCII by other equally effective means.

Alongside this, Ofcom intends, by the end of this year, to consult on strengthening its Codes of Practice further to reflect changes to the law via the Crime and Policing Act 2026 requiring platforms to remove NCII content within 48 hours of it being reported. In a reflection of how far and fast things are moving, even as Ofcom struggles to keep up with changing its regulatory documents to reflect changes in the law, reports suggest the Government is considering whether intimate images can be removed within even shorter timescales – almost immediately upon them being flagged. The new wording in s.10(3A) OSA already frames the duty to take down NCII as “as soon as reasonably practicable”, with the 48 hours being a longstop. It would appear that if Ofcom can identify practical routes by which providers should reasonably be able to take down the content within shorter timescales, the duty as drafted would already bite, without needing amendment.  

U16 social media ban and accompanying measures

The most high-profile policy announcement of the year in the online safety context was the social media ban for under 16s. As well as the complete ban on social media, there will be restrictions for under 16s of what are considered harmful functionalities (such as livestreaming) on other types of services such as gaming platforms. After the change of Prime Minister, it has been confirmed that the Government still intends to lay the first regulations by the end of this year and for the ban to come into force in the spring of 2027, but also that they “intend to go somewhat further than our initial proposition statement”.

Some additional measures beyond the under 16s ban have already been announced; for example, measures proposed for 16 and 17-year-olds to prevent a “cliff edge”. These include default overnight curfews and switching off features that are said to keep users scrolling for longer, including videos that play automatically and feeds continuously recommending personalised content. AI chatbots have given rise to considerable public interest, and this is also a priority for the Government. Regular breaks for under 18s using chatbots have been announced, but further options are being considered including banning chatbots that pose a serious threat to children. 

Highly effective age assurance was already an area of focus in the online safety regime but with so many proposed measures differing depending on exact age brackets, it has now become crucial for the effective implementation and workability of the OSA. In the meantime, Ofcom has reminded service providers that the existing requirements in the OSA must not be forgotten even as they prepare for a very different regime going forward. 

Looking further down the line

It seems clear that the beefing up of duties and requirements will not end there. In its recent evidence to the House of Lords Communications and Digital Committee’s Inquiry into the implementation and impact of the OSA, Ofcom representatives made it clear they want to go further and are keen to explore more innovative ways to deliver what they consider to be a more effective online safety regime, including forcing companies to use proactive technology to have more control over the content on their platforms (see our previous blog post for further discussion of Ofcom’s evidence to the Inquiry). 

Issues

Practicality and proportionality 

As Tech UK pointed out when blocking of nude images was first proposed, on-device scanning at scale is not a simple settings change but rather a fundamental overhaul of how devices handle data. The technical feasibility of such changes is a complex matter with significant knock-on implications, not least privacy and data protection issues, the impact on encryption, and the very real risk of exclusion of adult users who cannot (or do not wish to) complete age assurance checks.

Schedule 4, paragraph 2 of the OSA acknowledges the importance of technical feasibility and proportionality in relation to Ofcom’s own codes of practice, including noting that measures that are proportionate or technically feasible for providers of a certain kind, size or capacity may not be proportionate or technically feasible for different providers. Ofcom will need to test amendments and updates to its codes of practice for new policies against these parameters. This should also extend to the time allowed for providers to prepare for and implement necessary changes to their business. 

The detail of further legislation implementing the proposals above remains to be seen, but it will equally need to be technically feasible for the courts to give it effect (based on normal principles of statutory interpretation) and proportionate under the Human Rights Act given the obvious interferences with fundamental rights. 

Whilst proportionality as a legal concept has an established interpretation, there is also a common sense element underscoring requirements of proportionality (which the Divisional Court in a very different context recently summarised as appreciating the likely consequences of doing something and assessing the need to do it). Public lawyers will already be alive to the dangers of using blunt instruments and bright line rules to address complex issues. The proposed wholescale ban may have its advantages, but this is undoubtedly a nuanced issue where various competing considerations and rights need to be balanced. 

Balancing competing rights 

Section 22 of the OSA places duties on all services to have “particular regard” to the importance of free speech and privacy when deciding on and implementing safety measures and policies. For Category 1 services that extends to carrying out an impact assessment and a public statement on the positive steps taken to protect those rights. This duty would always have been a challenging one – balancing safety against free speech and privacy is not an easy line to draw. The services are essentially being asked to conduct the balancing exercise that falls on every public authority under the Human Rights Act: weighing competing priorities and finding a proportionate outcome. It is a job public authorities should be well equipped to carry out, but even so there are many examples of successful litigation showing how difficult it is to get right. But for private commercial entities, subject to entirely different pressures, to carry out that same balancing exercise is even more difficult. Add to that the recently announced measures going further than previously anticipated and any “particular regard” becomes automatically constrained. The Government has become more prescriptive about where it thinks that balancing line needs to be drawn, at least in respect of children. With that mood music coming from above, what does having particular regard to freedom of speech look like in practice for service providers? The obvious risk is that, in seeking to avoid not only enforcement but public disapproval, services may go too far in their removal or restriction of content, thus damaging freedom of speech. Whilst this would give rise to its own potential for enforcement in light of the “have particular regard” duties, it is easy to see that extreme caution may become the default. 

There is an instructive analogy here with educational institutions such as universities, as another sector where regulated entities have had to get to grips with freedom of speech and make difficult decisions balancing competing rights under significant public scrutiny. The regulator there was itself found to have erred in its approach (see our previous blog post), illustrating the scope for error on all sides of such a tricky issue. 

Interaction with AI regulation

The extension of the online safety framework into AI-generated content is a significant expansion of scope. There is a tension between the broader approach to AI regulation in the UK which has been uncertain to say the least (see here for our discussion of AI regulation more broadly), and the apparent acknowledgement in the online safety world that there are regulatory gaps undermining the desire for AI content to be tightly controlled. 

Certainty and predictability

An overarching point that is evident is the lack of predictability service providers have given the numerous further proposals and changes in the pipeline. The original OSA regime itself was a major regulatory change for the industry to adapt to, but before it has had time to settle further changes are already on the way. In addition, many of the requirements are expressed at a fairly high level without concrete detail as to exactly what service providers need to do. This makes it difficult for regulatory and compliance teams to prepare themselves. These are exactly the reasons why principles of clarity, legal certainty and foreseeability are so important in the law and form the baseline of any interference with human rights before proportionality questions are even engaged. 

Concluding thoughts

The UK online safety regime undoubtedly places significant burdens on service providers, with those burdens continuing to change (and increase) at pace. That includes complex questions of assessing technical feasibility, proportionality and balancing of rights, putting providers very much in the firing line in an area where strength of feeling runs high. Ultimately though the Government and Ofcom have their own duties under public law and the Human Rights Act, and, as discussed in our recent blog, we can surely expect these issues to be tested through the courts in the not-too-distant future.