News

We are glad that Ofcom have released their Illegal Harms Codes of Practice within the anticipated timeline.  It is our hope that significant progress will be made in 2025 to see the Online Safety Act become fully operational. Ofcom has a considerable role in this regard. As independent regulator and with a statutory duty to represent the interests of consumers and citizens, Ofcom is responsible for fleshing out the regulatory mechanisms, derived from the Online Safety Act 2023 and to enforce the regulatory code with consistency and clarity.  It is imperative that the codes are robust and effective in delivering an online safety regime that is world class.  Ofcom were mandated to set the regulatory tone and details to deliver this scheme. The release of the codes this week was a critical juncture for bringing the Online Safety Act to life, in a meaningful way, with safety by design as the north star for all measures. 

Following an initial examination of the released codes, we have grave concerns over aspects of this important content, within both the User to User and Search Services codes. As the Illegal Harms codes are a key driver for the delivery of the aims and purpose of the Act, they must ensure that online safety is achieved and maximised, particularly for children and young people, who are amongst the most vulnerable users of online technologies. The Department for Science, Innovation and Technology also reiterated this priority within the draft Statement of Strategic Priorities, (November 2024). Indeed, safety by design and the need to eliminate “safe havens” for illegal content and activity were emphasised as areas of specific importance by DSIT, and which Ofcom must have regard to. 

We are disappointed by the substance of the codes. In their current format, MCF feel they miss the mark in vital areas. This could potentially diminish the intent and impact of the Online Safety Act in real ways, allowing risk of online harm to continue unabated.  Specifically, we are very concerned by the following:

• ICU C2 – (Having a content moderation function that allows for the swift take down of illegal content).  This is the most troubling aspect of what has been released by Ofcom.  This measure outlines the requirement for user-to-user services to take down illegal content, including Child Sexual Abuse Material.  Unfortunately, it is vague (“swiftly” is left undefined) and offers a glaring loophole for services, which we are concerned will be exploited to evade application of the duty. Providers are not required to take down content they have adjudicated as illegal if they consider that it is “currently not technically feasible for them to achieve this outcome.” Although not made explicit in the measure, it is not unreasonable to infer that this effectively permits services to extend existing or introduce new End-to-End encryption functionalities, to design themselves out of the application of their duty to take down illegal content.  As written, the codes allow platforms and services to opt for specific design choices which will allow them to evade their duties in whole/part. The take down duties are therefore weak and easily circumnavigated.
• The operation of ICU C2 elevates user privacy, at the expense of safety as the overarching priority.
• Ofcom’s general approach through the codes is deferential and accommodating towards providers. There is an under-prescription within the measures, lacking any stringent benchmarking, particularly around time frames and the setting of internal policies. This affords providers with too much discretion. In this way, the codes read as purely advisory.
• The supplementary documents to the codes reference “safety in mind”, rather than “safety by design”, which was considered of primary importance in delivering a rigorous online safety framework. Regrettably, “safety in mind” does not convey the depth needed for fundamental root and branch changes in how technology companies develop and deliver their online services. Coupled with the implications of ICU C2, the codes permit services to overlook safety by design, giving way to avoidance by design.
• The emphasis on proportionality within the codes attenuates the overall purpose of the Act, reducing the ambition and appetite for introducing a revolutionary shake-up of in online safety. Analysis of some of the explanatory documents reveals that proportionality is mentioned on almost every page.  This lens contracts an ambitious regulatory regime into a much more modest approach. This is unlikely to have a meaningful effect in creating a safer online ecosystem that puts appropriate responsibility on industry to be innovative and to take their duties seriously. 

Given that the codes will now be laid before Parliament, we are considering our options for the best route to improving the fledgling online safety regime in its entirety.   We appeal to Ofcom to soberly review this feedback and any additional responses by other stakeholders.  The sense of disappointment in these measures is palpable across the sector of those working to counter online risks and enhance safety online, particularly for children. While we have been supportive and engaged with Ofcom throughout the regulatory discernment and development process, including through consultation submissions and direct engagement with Ofcom colleagues, we are troubled by what has been produced. It is our contention that the codes have watered down the Act and will be ineffective in delivering a safer online environment for all users, and most particularly children and young people. Unfortunately, it will now be necessary and crucial to remediate the effects of these codes and to close any gaps which allow providers to eliminate or fatally reduce their duties.