New online safety laws take effect – is your startup ready?

In 2023, the UK’s Online Safety Act came into force. Introduced by the UK’s communications regulator Ofcom, the Act contains a set of rules around online content that many tech startups and small businesses need to comply with.

Firms have already had to carry out a risk assessment, to understand how likely it is that users could encounter illegal content on their service. 

From Monday, online platforms offering user-to-user services, such as messaging sites and gaming apps, are now also legally required to start implementing measures to take down illegal content. The changes could have big repercussions for technology startups.

If companies fail to comply with these new rules, they will be liable to penalties of up to £18 million, or 10% of their global revenue. Here’s what startups need to know.

What are the new rules for startups?

As part of the new regulations, platforms will have to start implementing appropriate measures to remove illegal material quickly when they become aware of it and to reduce the risk of ‘priority’ criminal content from appearing in the first place. 

What this looks like in practice will differ depending on the business. Some measures are recommended only for ‘large services’ with more than seven million monthly active UK users.

Ali Hall is the Online Safety Supervision Principal at Ofcom. Speaking exclusively to Startups, Hall acknowledges this disparity. “The definition of ‘appropriate measures’ for removing illegal content will really depend on the online service in question – what’s right for a social media platform with millions of users, won’t be the same for a small community forum”.

That said, certain measures apply across the board. Hall says the first step for eligible businesses is to assign someone to be responsible for online safety in the business. 

From there, he adds that terms and conditions should clearly outline what kind of materials are prohibited and that content is reviewed efficiently, including the removal of any illegal materials that breach terms and conditions.

Additionally, users should have the ability to report any inappropriate material. That means businesses need a process in place to handle complaints.

“The rules are proportionate and we expect different things from large, high-risk services and small, low-risk services,” says Hall. “The key requirement is that online services have systems and processes to take down illegal content swiftly, once it has been identified.”

How much will it cost businesses?

There’s no exact cost for implementing the new rules, as this will differ depending on the process each business takes. However, for budget-conscious startups, there are some cost-effective ways to adapt.

Hall suggests using Ofcom’s online toolkit, which includes an interactive, step-by-step guide on the new rules, as well as tailored recommendations for a business’s online service. He also stresses that there is no specific way to respond to the Online Safety Act.

“Many of our recommended safety measures are ‘principles-based’, meaning that there’s flexibility about how you implement them,” says Hall.

“Online services should enable users to submit complaints. [But] some services may offer a web portal or ‘help centre’, while small or low-risk services may simply provide an email address through which users can submit reports or complaints.”

What do startups need to do now?

In terms of immediate deadlines, businesses are required to carry out a children’s access assessment to establish if their service (or part of it), is likely to be accessed by under-18s.

If this is the case, companies will have until the 16th of April to start this assessment, and it must be completed by July this year. 

Further responsibilities include ensuring that risk assessments are up to date (Hall recommends reviewing them at least every 12 months) and carrying out a new evaluation if you plan to make significant changes to your services. 

“There are foundational steps that everyone should follow – but if your service is large or high risk, there will be more to do,” Hall said.

“By now, everyone running an online service in the scope of the Act should have completed the first illegal content risk assessment. That will help decide if you’re at higher risk and whether you should consider more of our recommended safety measures.”

“Small tech platforms are crucial for growth”

Understanding and implementing practices around new safety legislation can be a serious red-tape headache for tech startups. However, Ofcom says it is making it easier for businesses to remain innovative while still being compliant with the new rules.

“Small tech platforms are crucial for economic growth in the UK and we want to support that through proportionate regulation,” Hall states. “That’s why we’re producing resources and tools to help make the compliance process easier.” 

While the penalties also sound harsh, Hall adds that Ofcom isn’t setting out to make things harder for tech startups, many of which are already struggling to scale due to the challenges of today’s poor economy.

“Unfortunately, we also know that harm can exist on the smallest services as well as the largest,” he says “We intend to focus our enforcement on services where the risk and impact of harm is highest [and] will only take action where it is proportionate and appropriate.”