© National Audit Office 2023

Preparedness for online safety regulation

Ofcom, Department for Science, Innovation & Technology

Session 2022-23
12 July 2023
HC 1660

The National Audit Office (NAO) scrutinises public spending for Parliament and is independent of government and the civil service. We help Parliament hold government to account and we use our insights to help people who manage and govern public bodies improve public services.

The Comptroller and Auditor General (C&AG), Gareth Davies, is an Officer of the House of Commons and leads the NAO. We audit the financial accounts of departments and other public bodies. We also examine and report on the value for money of how public money has been spent.

In 2022, the NAO’s work led to a positive financial impact through reduced costs, improved service delivery, or other benefits to citizens, of £572 million.

We are the UK’s independent public spending watchdog.

We support Parliament in holding government to account and we help improve public services through our high-quality audits.

Preparedness for online safety regulation

Ofcom, Department for Science, Innovation & Technology

Report by the Comptroller and Auditor General

Ordered by the House of Commons
to be printed on 10 July 2023

This report has been prepared under Section 6 of the National Audit Act 1983 for presentation to the House of Commons in accordance with Section 9 of the Act

Gareth Davies
Comptroller and Auditor General
National Audit Office

6 June 2023

Value for money reports

Our value for money reports examine government expenditure in order to form a judgement on whether value for money has been achieved. We also make recommendations to public bodies on how to improve public services.

The material featured in this document is subject to National Audit Office (NAO) copyright. The material may be copied or reproduced for non-commercial purposes only, namely reproduction for research, private study or for limited internal circulation within an organisation for the purpose of review.

Copying for non-commercial purposes is subject to the material being accompanied by a sufficient acknowledgement, reproduced accurately, and not being used in a misleading context. To reproduce NAO copyright material for any other use, you must contact copyright@nao.org.uk. Please tell us who you are, the organisation you represent (if any) and how and why you wish to use our material. Please include your full contact details: name, address, telephone number and email.

Please note that the material featured in this document may not be reproduced for commercial gain without the NAO’s express and direct permission and that the NAO reserves its right to pursue copyright infringement proceedings against individuals or companies who reproduce material for commercial gain without our permission.

Links to external websites were valid at the time of publication of this report. The National Audit Office is not responsible for the future validity of the links.

012226 07/23 NAO

This report can be found on the National Audit Office website at www.nao.org.uk

If you need a version of this report in an alternative format for accessibility reasons, or any of the figures in a different format, contact the NAO at enquiries@nao.org.uk

The National Audit Office study team consisted of:

Alex Ballard, Chris Groom and Howard Revill, with assistance from Leo Bolter, Mohammed Garasia, George Harris, Zainab Mulla and Sahana Sarvendran, under the direction of Louise Bladen.

For further information about the National Audit Office please contact:

National Audit Office
Press Office
157–197 Buckingham Palace Road
Victoria
London
SW1W 9SP

020 7798 7400

www.nao.org.uk

@NAOorguk

Key facts

Summary

Introduction

1 People are increasingly living their lives online. According to research by Ofcom, 93% of UK adults have access to the internet at home, and they spent on average just under four hours online a day in September 2022. Although the internet has many benefits, there are challenges from such online activity. Of internet users in the UK, 68% of child users (aged 13-17), and 62% of adult users (aged 18+), indicated in 2022 that they had experienced at least one potential online harm in the last four weeks. Harmful content can vary in nature, from child sexual abuse material and terrorist content to online fraud and the encouragement of self-harm.

2 The government has set itself an objective of making the UK the safest place in the world to go online. To achieve this, in March 2022, the Department for Digital, Culture, Media & Sport (DCMS) introduced in the House of Commons the Online Safety Bill (the Bill). The government considers that, with this Bill, the UK will be the first country to regulate such a comprehensive range of online harms. The Bill introduces new duties on search engines, firms which host user-generated content, and providers of pornographic content, to minimise the extent of illegal content and content that is harmful to children experienced by their users. Providers failing to meet these duties will be accountable to Ofcom, the UK’s existing communications regulator, in its new role as the UK’s online safety regulator.

3 The Bill requires Ofcom to secure the adequate protection of citizens from harm arising from content on regulated services, through the appropriate use by service providers of systems and processes designed to reduce the risk of such harm. Ofcom has been preparing for its new regulatory role since 2020 when DCMS confirmed its decision to appoint Ofcom as the regulator for online safety.

Scope of this report

4 During our work on this report, responsibility for delivering the Online Safety Bill moved from DCMS to a new department, the Department for Science, Innovation & Technology (DSIT), after machinery-of-government changes in early 2023. In this report, we will refer to DCMS or DSIT, as appropriate, reflecting which department was responsible at that time.

5 This report examines whether the preparations undertaken by DSIT (and previously DCMS) and Ofcom for the implementation of the new online safety legislation are sufficiently advanced. Our evaluation and recommendations are based on our good practice guidance on the principles of effective regulation.1 The report covers work undertaken by the departments and Ofcom to:

establish the regulatory framework;

prepare to implement the regulatory framework; and

enable informed regulation.

Key findings

Establishing the regulatory framework

6 Ofcom has been preparing for the new regulatory regime while Parliament has been considering the Online Safety Bill. Ofcom has been preparing for its new duties since 2020, but this early start has meant that it has been undertaking its preparations while the regulatory regime was still being developed. Although the broad intent and ambition of the legislation have not changed, there have been significant changes to the Bill’s scope, including the introduction of new duties on service providers to tackle fraudulent advertising and limit children’s access to pornography, and amendments to what were previously core duties on tackling legal but harmful content for adults. The government announced further significant amendments to the Bill at the end of June 2023, including, for example, new powers for Ofcom to obtain information on a child’s social media use if requested by a coroner. There have also been significant changes to the Bill’s timetable. The Bill was introduced in the House of Commons in March 2022 and expected to receive Royal Assent in February 2023. However, the Bill did not enter the House of Lords until January 2023, and, as at July 2023, Royal Assent was not expected until October 2023. The scope of the regulatory regime will not be finalised until the Bill receives Royal Assent (paragraphs 1.8 and 1.9).

7 The full regulatory regime will be put in place in phases over the two years after Royal Assent. Ofcom’s new powers are expected to come into force two months after Royal Assent to the Bill has been granted. Ofcom then needs to put in place detailed codes of practice and guidance which set out the details of the regulatory regime. This process will involve extensive consultation with a wide range of stakeholders, including industry, and is dependent in some areas on the passing of secondary legislation. Ofcom will finalise all relevant codes and guidance in phases from 2024, and, as at June 2023, it did not expect the regulatory regime to be fully operational until 2025. During this period, there will continue to be uncertainty around the regulatory regime’s final details, such as how service providers will be categorised in order to determine the exact duties they will face. In July 2022, Ofcom produced a roadmap setting out how it intended to implement the new regime after Royal Assent, but this assumed Royal Assent early in 2023. In June 2023, it published an update to the roadmap, confirming the phased approach to its production of codes and guidance, but with a new assumed date for Royal Assent of autumn 2023. The update did not, however, contain detailed dates for the timings of the various phases. There is a risk that the regime will become fully operational later than 2025 if further significant changes, such as those announced by the government at the end of June 2023, are included in the Bill (paragraphs 1.10 and 1.11).

8 Ofcom has identified its early priorities for action once its powers start to come into force after Royal Assent. Ofcom will still have lots to do to develop the regime. For example, it will have to produce more than 40 regulatory documents, including formal codes of practice and guidance for regulated service providers. In the initial stage after its powers start to come into force, Ofcom is prioritising action against some of the most serious online harms, for example, tackling illegal content and protecting children. However, the duties placed on service providers are not enforceable until the relevant codes of practice and guidance are published and the relevant parts of the regulatory regime fully implemented. Even then, enforcing these duties could be challenging for Ofcom as some service providers may deliberately choose not to comply with the regime out of criminal or malign intent, despite Ofcom taking enforcement action, and most have no UK corporate or economic presence. Users may not notice a significant change to their online experience at first. Ofcom has recognised that some stakeholders might expect immediate changes on the Bill’s Royal Assent or might be unaware that Ofcom will have no specific powers to address individual pieces of harmful content. It has therefore put in place a communications strategy for managing these expectations and addressing misunderstandings (paragraphs 1.12 to 1.16).

Preparing to implement the framework

9 Ofcom has made a good start to its preparations. Ofcom has taken a structured approach to preparing for the new regime and established appropriate programme management and governance arrangements for setting it up. Its preparations are broadly on track against its latest planned timetable. In March 2023 Ofcom rated the programme’s overall progress as ‘Amber’ (that is, a delay of less than four weeks or objectives in terms of scope and budget possibly at risk, but with mitigating actions agreed), highlighting uncertainties in the Bill’s timetable as a risk to its plans. Any further significant changes to the scope of the Bill, such as those announced by the government at the end of June 2023, risk creating a gap in Ofcom’s preparations (paragraphs 2.2, 2.4 and 2.5).

10 Government has enabled Ofcom to commit significant resources to preparing for the new regulatory regime up to 2023-24, but funding for 2024-25 is unclear. Government agreed to Ofcom funding the upfront costs for preparing for the new regime from Wireless Telegraphy Act 2006 receipts, which Ofcom would have otherwise handed to the Exchequer.2 The government expected that the setting up of the new regulatory regime would be completed in 2023-24. Ofcom would then start to recover both its upfront costs, and the ongoing costs of the regime, from fees levied on the industry from 2024-25, making the regime self-financing from that date. However, as at May 2023, Ofcom expected that it would start to recover its online safety costs in 2025-26, a year later than originally expected due to the changes to the Bill’s timetable. Ofcom has also identified that it will need extra resources to take on increases in the scope of the regime, such as the inclusion of fraudulent advertising. As at April 2023, Ofcom estimated that its cumulative costs in preparing for and implementing the regime could total £169 million by the end of 2024-25, of which about £56 million will have been incurred by the end of 2022-23. Ofcom is in the process of finalising its funding requirement for 2024-25 and seeking agreement for this funding from DSIT and HM Treasury. Changes to the Bill’s timetable also mean that the details of the fee regime remain uncertain (paragraphs 2.6 to 2.9).

11 Ofcom has undertaken significant organisational work to prepare for its new responsibilities. In September 2020, Ofcom restructured so that online safety would be embedded in its organisation, and it expanded its technology group. In April 2023, it created a new Online Safety Group with responsibility for strategy delivery and policy development. This Group also contains a dedicated supervision unit, responsible for promoting the compliance of small providers and for managing relationships with what Ofcom expects to be the 20 largest and riskiest service providers, in line with lessons Ofcom learned from its existing regulation of video-sharing platforms. Ofcom is confident that this new structure will enable it to respond quickly to new and emerging harms but acknowledged that it has more to do to embed more responsive ways of working (paragraphs 2.10 to 2.12).

12 Ofcom has significantly expanded its capacity and capabilities since 2020, but challenges remain, for example, in recruiting the extra staff it needs. In July 2020, Ofcom identified that it would require almost 350 extra staff by 2023-24 and beyond to meet its new responsibilities, an increase of more than 35% on its total staff at the end of 2019-20.3 Its progress in delivering this requirement has been broadly in line with its schedule. By March 2023, it had 346 staff in place, based in London, Edinburgh and a new hub in Manchester. However, in February 2023, it revised its estimate of staff needed to more than 450 by the end of 2023-24 and beyond, an increase of more than 100 on its 2020 figure, due to its establishment of a dedicated supervision unit and the need for more staff to cover increases in the regulatory regime’s scope. As at April 2023, it had yet to seek the agreement of DSIT or HM Treasury to the funding it requires for future years. Ofcom had initially focused its recruitment efforts on roles to support the legislative process and set up operations. However, once the regime is under way, some of these staff will transition to supervision roles (paragraphs 2.13 to 2.15, 2.17 and 2.18).

Enabling informed regulation

13 Ofcom has prepared a substantial initial evidence base to inform its implementation of the new regime. As at April 2023, it had completed 24 research projects and had a further 90 either planned or under way. This included, for example, work during 2021-22 with six service providers to understand their approaches to content moderation and measurement of online harms. However, as at the start of July 2023, it was working to identify the impact on its plans for future research of the amendments to the Bill announced by the government at the end of June 2023. Ofcom has also drawn on its existing regulatory experience, including that of regulating video-sharing platforms, and has engaged with other regulators, including those overseas. It has undertaken early engagement with industry, meeting some of the providers likely to be subject to the new legislation. Representatives from industry told us that they appreciated Ofcom’s efforts to engage, but some were concerned about the potential burden of compliance, citing examples of requests from Ofcom for information that would require significant effort to answer (paragraphs 3.2 and 3.4 to 3.10).

14 The Bill will bring a large number of overseas firms into Ofcom’s regulatory remit for the first time, creating significant monitoring challenges. Based on preliminary research carried out by Ofcom, the number of online services subject to regulation could total more than 100,000 and could be significantly higher. The great majority of these will be based overseas and will not have been regulated by Ofcom before and are therefore unfamiliar with it. Monitoring this scale of services will require automated data collection and analysis systems, and the IT capability to support these, which Ofcom is currently developing (paragraphs 3.11 and 3.12).

15 DSIT and Ofcom have yet to finalise their plans for evaluating how well the new regime is working once it is in place, and not all the data required for evaluation are available. DSIT and Ofcom are planning to evaluate the effectiveness of regulation once the regime has begun. However, such evaluation, by nature of the harms involved, will be challenging, and the eventual effectiveness of the new online safety regulatory regime is only partly dependent on the successful implementation of preparations for its introduction. DSIT is progressing its evaluation plans; as at April 2023, work on its evaluation framework was under way. However, there were important evaluation-related gaps in its evidence base that need addressing to enable it to measure the regime’s effectiveness. Filling these gaps will require DSIT and Ofcom to discuss their respective data collection plans as part of their ongoing liaison over evaluation. Ofcom is advancing its own evaluation plans and intends to have identified a short set of evaluation metrics by the time the Bill receives Royal Assent, with a longer list in place by 2025 when the regulatory regime becomes fully operational. Ofcom acknowledges that it will need to fine-tune the regulatory regime after it becomes fully operational, and that the ability to evaluate the effectiveness of the existing regime and future changes will be crucial to this (paragraphs 3.13 to 3.15 and 3.17).

Conclusion on value for money

16 Securing adequate protection of citizens from online harm will be a big new role for Ofcom. It has been preparing for the introduction of the new regulatory regime for online safety at the same time as Parliament has been considering the Online Safety Bill establishing the regime. As a result, Ofcom has had to take account of significant changes to both the regime’s scope and timing. Ofcom has made a good start to its preparations and has taken the steps it could reasonably have done by this point: compiling an evidence base to inform its implementation of the new regime; putting in place the capacity, capabilities and organisational design it needs to begin operating the regime; and engaging with stakeholders. It estimates that its cumulative costs in preparing for and implementing the regime could total £169 million by the end of 2024-25, of which £56 million will have been incurred by the end of 2022-23. The full regulatory regime will, however, only come into effect in phases over the two years after the Bill’s Royal Assent, and Ofcom still has lots to do in terms of finalising its arrangements.

17 Ofcom will need to manage several risks in implementing the new regulatory regime in a way that delivers value for money. It will need to move quickly to cover any gaps in its preparations arising from the significant amendments to the Online Safety Bill announced by the government at the end of June 2023 and any further changes before the Bill receives Royal Assent. It has also yet to secure the funding it needs for the extra staff it has identified that it will require. It will need to regulate a very large number of services, the great majority of which have not been regulated before and are unfamiliar with Ofcom and how it works, and which have no UK corporate or economic presence. It will need to cover its costs by introducing fees so that the regime becomes self-financing. It will also need to obtain good-quality data to monitor the compliance of services and to evaluate its own effectiveness and that of the regime. Furthermore, it will be vital for Ofcom to secure public trust by managing the public’s expectations about the regime’s impact in its early years. This is a significant set of challenges, and Ofcom has already started to consider how it will address them.

Recommendations

18 We make recommendations in four areas. In each of these, both Ofcom and DSIT recognise the need to further develop existing plans, particularly as they begin to implement the full regulatory regime.

Ofcom’s external communication

Ofcom should:

a manage the public’s expectations about the regime’s impact and Ofcom’s role during implementation to give confidence in the credibility of the new regime with the public, industry and others; and

b develop its plans to inform industry about its requirements, particularly ensuring its data requests are coordinated and proportionate, and establishing how it will collect feedback, in particular from smaller, non-categorised companies.

Ofcom’s financial management

Ofcom should:

c establish how it will manage the financial risks presented by the additional year of set-up and increased staffing need; as it does so, it should report transparently on its set-up costs through its normal reporting mechanisms, including its annual report and accounts; and

d clarify its overall approach to long-term financial management, including the scope of its financial modelling and its assumptions about the future costs and funding of the regime.

Ofcom’s internal skills and capacity

Ofcom should:

e identify how it will reach the capability and capacity it needs and keep this relevant and up to date so that it is equipped to keep abreast of technology developments, the development of new online services and platforms, and changes to user behaviour as the regime is implemented and becomes operational.

Monitoring and evaluation

DSIT should:

f work with Ofcom to identify how the data Ofcom plans to collect as part of its evaluation activities will support DSIT’s own evaluation of the effectiveness of the regime and the achievement of its policy objectives.

Ofcom should:

g ensure that its processes for collecting data from service providers and its generation of automated information about these are providing it with data of sufficient quality to inform its regulatory duties and enable it to adapt its approach if the data show it is not achieving its aims.

1 National Audit Office, Principles of effective regulation, May 2021.

2 These receipts arise from Ofcom’s issuing of licences for civil use of the radio spectrum.

3 All staffing figures are for the full-time equivalent (FTE) number of staff.

Part One

Establishing the regulatory framework

1.1 In this Part, we examine the development of the new regulatory framework for online safety, including the need for regulation and Ofcom’s role in this.

The need for regulation

1.2 People are increasingly living their lives online (Figure 1). According to research by Ofcom, 93% of UK adults have access to the internet at home, with the average time spent online, per day, by adults in September 2022 being just under four hours. Much of people’s use of online services is interactive in nature, with, for example, 97% of UK online adults (68% of children) using Meta’s social platforms and communications services. Although the internet has many benefits, there are challenges from such online activity. Of internet users in the UK, 68% of child users (aged 13-17), and 62% of adult users (aged 18+), indicated in 2022 that they had experienced at least one potential online harm in the last four weeks. Harmful content can vary widely in nature, from child sexual abuse material and terrorist content to online fraud and the encouragement of self-harm. Such content can have serious effects. For example, 43 million UK adult internet users have encountered suspected scams online, of whom an estimated 25% have fallen victim to a scam and lost money. In 2020, the Department for Digital, Culture, Media & Sport (DCMS) calculated that online harms have an estimated socioeconomic cost of at least £4.5 billion per year (at 2019 prices). Individuals who are exposed to harmful content can experience serious mental and physical effects (Figure 2) with, for example, evidence linking the risk of children self-harming and attempting suicide with accessing related content online.

1.3 The government has set itself an objective of making the UK the safest place in the world to go online. To achieve this, in March 2022, DCMS introduced in the House of Commons the Online Safety Bill (the Bill). The government considers that, with this Bill, the UK will be the first country to regulate such a comprehensive range of online harms. In January 2022, it had outlined five policy objectives it was seeking to achieve via the Bill:

Increase user safety online.

Preserve and enhance freedom of speech online.

Improve law enforcement’s ability to tackle illegal content online.

Improve users’ ability to keep themselves safe online.

Improve society’s understanding of the online harms landscape.

1.4 During our work on this report, responsibility for delivering the Bill moved to a new department, the Department for Science, Innovation & Technology (DSIT), after machinery-of-government changes in early 2023. DSIT also took over from DCMS as the sponsoring department of Ofcom. In this role, it sets a cap on Ofcom’s expenditure each year, and, under the Online Safety Bill, can issue a statement setting out the government’s strategic priorities for online safety. In this report, we will refer to DCMS or DSIT, as appropriate, reflecting which department was responsible at that time.

1.5 The Home Office has also been involved in the development of the government’s policy on online harms. In April 2019, the Home Office jointly issued the Online Harms white paper with DCMS and was involved in the development of the Online Safety Bill. It will also be involved in the regime’s implementation as the Home Secretary has to sign off on Ofcom’s codes of practice on terrorist and child sexual exploitation and abuse material, and Home Office data will support monitoring of illegal harms.

Ofcom’s role as the independent regulator of online safety

1.6 The Online Safety Bill introduces new duties on search engines, and on firms that host user-generated content and enable user interaction, to take proportionate measures to minimise the extent of illegal content and content that is harmful to children experienced by their users. It will also require providers of services that publish or display online pornography to ensure that children are not normally able to access such content. The Bill also introduces new offences, such as sending false or threatening communications and cyber-flashing.4 Service providers that fail to meet their duties will be accountable to Ofcom, the UK’s existing communications regulator, in its new role as the UK’s online safety regulator.5 The Bill requires Ofcom to protect citizens from harm arising from content on regulated services, by requiring service providers to have systems and processes in place to reduce the risk of harms. The new requirement represents a significant expansion of Ofcom’s responsibilities. The Bill requires Ofcom to produce codes of practice and guidance setting out how regulated providers can comply with their new duties and gives Ofcom powers to collect information to monitor firms’ compliance and to take enforcement action when they do not (Figure 3).

1.7 Ofcom has previous experience in regulating online services, through its regulation of on-demand programme services since 2016 and of video-sharing platforms since 2020. However, its proposed regulation of online safety is more complex since, unlike these other regulatory regimes, the potential number of providers involved is significantly larger and is not confined to service providers with some form of UK corporate or economic presence. Despite this, there are some similarities between the proposed online safety regime and Ofcom’s regulation of video-sharing platforms in that its regulation of platforms aims to encourage these to have systems and processes in place that provide protection to their users from specific types of harmful material in videos, such as terrorist and child sexual abuse material. It has therefore sought to identify lessons from its platform regulation to inform its preparations for online safety.

1.8 Ofcom has been preparing for its new duties since 2020, with DCMS confirming its decision to appoint Ofcom as the regulator for online safety in December 2020 (Figure 4). Ofcom started its preparations then so that it could begin to meet its new duties as soon as they come legally into force. However, this early start has meant that Ofcom has been preparing to implement a regulatory regime that was still being developed and has been subject to significant change. For example, after DCMS published the draft Online Safety Bill in May 2021, pre-legislative scrutiny by Parliament led DCMS to expand the scope of the regulatory regime, including new duties on service providers to tackle fraudulent advertising and limit children’s access to pornography. Although the broad intent and ambition of the legislation has not changed since the Bill formally entered the House of Commons in March 2022, there have been further significant amendments to previously core duties on tackling legal but harmful content for adults in response to concerns expressed by some regarding the impact of the previous provisions on freedom of expression. The government announced further significant amendments at the end of June 2023, including increases in Ofcom’s powers (for example, the power to require regulated services to provide information on a child’s social media use if it is requested by a coroner) and in the duties placed on service providers (for example, services that publish or allow pornographic content on their sites are to be required to use ‘highly effective’ age verification or age estimation tools to prevent children accessing this content).

1.9 As at July 2023, there was still uncertainty around the regulatory regime as its scope will not be finalised until the Bill receives Royal Assent at which point no further changes are possible. The timetable for this Assent has been subject to significant changes. Although introduced in the House of Commons in March 2022, the Bill did not enter the House of Lords until January 2023, and, as at July 2023, DSIT expected that the Bill would receive Royal Assent in October 2023, against the date of February 2023 expected in March 2022.

Establishing Ofcom’s activities and priorities

1.10 The detailed regulatory regime will take effect in phases once the Bill has received Royal Assent. Ofcom’s new powers are expected to come into force two months after Royal Assent has been granted. Ofcom then needs to put in place detailed codes of practice and guidance, spelling out the details of the regulatory regime. This process will involve extensive consultation with a wide range of stakeholders, including industry, and is dependent in some areas on the passing of secondary legislation. Ofcom will finalise the codes and guidance in phases in order to reduce the administrative burden on both itself and industry. In July 2022, Ofcom produced a roadmap setting out how it intended to implement the new regime after Royal Assent. Under this, elements of the regulatory regime were expected to start to come into force in 2024, with the regime not expected to be fully operational until 2025. The roadmap assumed the Bill would receive Royal Assent in early 2023. In June 2023, it published an update to the roadmap, confirming the phased approach to its production of codes and guidance, but with a new assumed date for the Bill’s Royal Assent of autumn 2023. The update did not, however, contain detailed dates for the timings of the various phases. There is a risk that the regime will become fully operational later than 2025 if further significant changes, such as those announced by the government at the end of June 2023, are included in the Bill.

1.11 During this initial period, although the scope of the regulatory regime will have been finalised in the legislation, there will continue to be uncertainty around the final detailed regulatory framework until the codes of practice and guidance are finalised. For example, the Bill stipulates that different categories of providers face differing duties, with the largest/riskiest providers facing more duties (Figure 5). However, details of these categories have yet to be set out, consulted on and agreed. The details will eventually be set out in government secondary legislation, following advice from Ofcom. As at June 2023, Ofcom was intending to produce this advice within six months of the Bill receiving Royal Assent.

1.12 Ofcom still has lots to do to develop the regime. It has identified that it will have to produce more than 40 regulatory documents, including pieces of formal codes of practice and guidance for regulated service providers, risk registers and pieces of research (Figure 6). As at June 2023, it had started the process of producing these, for example, publishing in March 2023 a discussion document on its planned approach to risk assessments. Ofcom has used the time created by changes to the Bill’s timetable to advance its preparations for some of these documents. For example, as at June 2023 it intended to issue its first batch of documents relating to illegal content for consultation very shortly after its powers commence (paragraph 1.10), rather than within the first 100 days of this.

1.13 While it is preparing its first suite of regulatory publications, Ofcom has identified those areas where it will prioritise action – tackling illegal content and protecting children. To this end, it published calls for evidence on illegal harms and the protection of children online in July 2022 and January 2023 respectively. These priorities reflect those areas identified as priority harms in the Bill and discussions with DCMS. Subsequently, under the amendments to the Online Safety Bill announced by the government at the end of June 2023 (paragraph 1.8), Ofcom will be required to produce agreed codes of practice for the implementation of the duties on child safety and illegal content within 18 months of the Bill reaching Royal Assent. It will also be required to produce by the same date guidance on how online publishers of pornography content can protect children from their content through the use of ‘highly effective’ tools for either age verification or age estimation.

1.14 In this initial stage, Ofcom expects to prioritise using its new information-gathering powers to deepen its understanding of the sector. It also intends to work with the most important service providers to encourage robust assessment of risks to users’ safety and to secure improvements in safety processes. The duties placed on service providers in both these two and in other areas are not enforceable until the relevant codes of practice and guidance are published and the relevant parts of the regulatory regime fully implemented. Even after the regime is fully in place, enforcing the new duties could be challenging for Ofcom and success will depend on factors outside of its control, as some service providers may deliberately choose not to comply with the regime out of criminal or malign intent, despite Ofcom taking enforcement action, and most have no UK corporate or economic presence (paragraph 1.7).

1.15 Users may not notice significant changes to their online experience at the start of the regulatory regime. Many of the initial measures focus on service providers’ terms and conditions and their risk assessments, all of which will take time to filter down to changes for the user. Representatives from industry told us that larger service providers already do many of the things Ofcom will be requiring of them. Ofcom’s research also shows that many larger providers already deploy sophisticated processes for dealing with the most serious harmful content, such as terrorist content and child sexual exploitation and abuse material. However, this is not always the case with the smaller service providers which fall outside categories 1, 2a and 2b (Figure 5) and which Ofcom might not initially be able to identify. Users are also less likely to encounter these priority harms than other harms, such as misinformation or generally offensive language, which are the most commonly encountered online harms.

1.16 Ofcom has recognised a risk of stakeholders expecting immediate change on Royal Assent and has in place a communications strategy for managing these expectations and addressing misunderstandings about its role. Some representatives from industry noted a risk that internet users might complain to Ofcom about harmful content, not realising that this is not provided for in the Bill. As at April 2023, the Bill requires all service providers to put procedures in place for handling complaints from users and affected people about potentially harmful content. In comparison, Ofcom is only required to consider complaints from organisations about systemic issues arising from a service provider and impacting on online safety. It has no specific powers to take action, or compel regulated service providers to take action, on individual pieces of content, or to get providers to offer redress to individual users on a case-by-case basis.

4 Cyber-flashing involves the sending of obscene images to strangers online.

5 Ofcom is the independent regulator for the UK’s communications industries; it already regulates TV and radio broadcasters, on-demand programme services, fixed and mobile telecoms, postal services, and the airwaves over which wireless devices operate. Since 2020, it has also been responsible for regulating the video-sharing platforms established in the UK.

Part Two

Preparing to implement the regulatory framework

2.1 In this Part, we examine Ofcom’s programme management and governance of its preparations for the new regulatory regime; its funding; and the work it has done to put in place the required organisational design, staffing and infrastructure to meet its new responsibilities.

Programme management and governance

2.2 Ofcom has taken a structured approach to preparing for the new regime. It initially structured its preparations around five focus areas of activity, which it refreshed annually:

Supporting the legislative process.

Preparing its regulatory approach.

Building public trust and awareness.

Setting up its operation.

Investing in technology, data, sector knowledge and capability.

2.3 Ofcom appointed an accountable director for each focus area and monitored its preparations’ progress by each area. From October 2022, it identified its implementation priorities for the coming calendar year, based on the five areas, and monitored delivery against these priorities.

2.4 Ofcom’s preparations for the new regime are broadly on track against its latest planned timetable. In April 2023, Ofcom rated the programme’s overall progress as ‘Amber’.6 It highlighted uncertainties in the timetable for the Online Safety Bill (the Bill) (paragraph 1.9) as a risk to its plans. Any further significant changes to the scope of the Bill, such as those announced by the government at the end of June 2023, risk creating a gap in Ofcom’s preparations.

2.5 Ofcom has established appropriate programme management and governance arrangements (Figure 7) for setting up the regime, including an Online Safety Programme Board, which has met regularly since February 2021 and reports to Ofcom’s main Board. Once the regulatory regime goes live, the specific governance arrangements for the regime’s implementation will be absorbed into Ofcom’s existing governance structure. Ofcom regularly meets with the Department for Science, Innovation & Technology (DSIT) (previously with the Department for Digital, Culture, Media & Sport (DCMS)) and the Home Office to discuss preparations for the regulatory regime’s implementation at both a senior level, through the Joint Steering Group, and at working level, through the Implementation Working Group.

Funding

2.6 Government has enabled Ofcom to commit significant resources to preparing for the new regulatory regime. Government agreed to Ofcom funding the upfront costs for preparing for the new regime from Wireless Telegraphy Act 2006 receipts, which Ofcom would have otherwise handed to the Exchequer.7 As at autumn 2021, Ofcom estimated that it would incur cumulative set-up costs of £111 million over four years to the end of 2023-24 (Figure 8). It plans that both these costs and the ongoing costs of the regime will be recovered from fees levied on industry once the regulatory regime is fully operational and that the regime will be self-financing from that point. At autumn 2021, DCMS and Ofcom expected that Ofcom would complete its preparations for the new regulatory regime in 2023-24 and that this fee regime would start in 2024-25. Any fines levied on providers for not complying with the regulatory regime are payable to HM Treasury and will not be used by Ofcom to fund its online safety costs.

2.7 Ofcom’s task has been made more difficult by changes to the Bill’s timetable and scope. As at May 2023, Ofcom expected that it would start to recover its online safety costs in 2025-26, a year later than originally expected due to the timetable changes (paragraph 1.9). Ofcom has revised its estimate of its costs to include this extra year. As at April 2023, it estimated that its cumulative costs in preparing for and implementing the regime could total £169 million over five years by the end of 2024-25 (Figure 8). This revised figure also included Ofcom’s need for extra resources to take on increases in the regime’s scope, such as the inclusion of fraudulent advertising (paragraph 1.8). As at April 2023, Ofcom was forecasting that it will have incurred about £56 million of the £169 million by the end of 2022-23.

2.8 Ofcom faces a number of financial risks going forward. As at April 2023, Ofcom was forecasting online safety spending of £50 million for 2023-24 to allow for, among other things, further changes to the Bill’s timetable. It therefore needed to find efficiency savings of £3 million if it was to remain within the £47 million cap placed by DCMS and HM Treasury on such spending for the year. Ofcom is in the process of finalising, and seeking the agreement of DSIT and HM Treasury to, its funding requirement for 2024-25, which it has provisionally estimated at £66 million.

2.9 Changes to the Bill’s timetable also mean that uncertainties remain over the details of the fee regime – for example, the period over which set-up costs will be recovered; the revenue threshold at which firms start to pay fees; and the fee rates payable. As a result, as at June 2023, Ofcom had yet to undertake financial modelling to inform the proposed design of the fee regime.

Organisational design

2.10 Ofcom has undertaken extensive organisational design work to prepare for and operate the new regulatory regime. To integrate its new online safety responsibilities with its other regulatory responsibilities, in September 2020, it restructured itself to embed online safety in the organisation. As part of this, Ofcom expanded its technology group to include the online technology and data skills it needed and established a Data Management Office to manage the large amounts of data it will need to handle to deliver effective regulation.

2.11 Between January and August 2022 Ofcom reviewed its organisation design and decided to create a new Online Safety Group, with a new group director for online safety appointed in November 2022. The new Group came into effect in April 2023 and is responsible for strategy delivery, policy development and supervision. Ofcom is confident that this new structure will enable it to respond quickly to new and emerging harms but acknowledged that more work is needed to embed more responsive ways of working.

2.12 The Online Safety Group contains a dedicated supervision unit, responsible for building and maintaining relationships with what Ofcom expects to be the 20 largest and riskiest service providers and promoting the compliance of small providers. This approach differs from Ofcom’s other regulatory regimes as a key lesson learned from its first year regulating video-sharing platforms was the need to invest in stakeholder management. The diversity of the sector and novelty of the online safety regime also requires Ofcom to work collaboratively with key industry players to establish expectations and bring about change before harm materialises.

Staffing

2.13 Ofcom has significantly increased its staff numbers since 2020 to prepare for its new online safety responsibilities (Figure 9). In July 2020, Ofcom identified that it would require almost 350 staff by 2023-24 and beyond to prepare for and meet its new online safety responsibilities, an increase of more than 35% on its almost 960 staff at the end of 2019-20.8 Progress in meeting Ofcom’s staffing requirement has been broadly in line with its schedule. By March 2023, it had 346 online safety staff in place.

2.14 There was significant uncertainty about the shape and scope of the final regulatory regime when Ofcom identified its original staffing requirement. By February 2023, Ofcom had increased its requirement to more than 450 by the end of 2023-24 and beyond, more than 100 staff more than it had estimated in July 2020 and were in place by the end of 2022-23. Reasons for the increase include Ofcom’s establishment of a dedicated supervision unit (paragraph 2.12) and the need for more policy, technology, data and research staff to cover the increases in the scope of the regulatory regime (paragraph 1.8). As at February 2023, Ofcom had yet to recruit the extra staff to meet its increased staffing requirement, or to seek DSIT and HM Treasury agreement to its funding for future years (paragraph 2.8).

2.15 It has been difficult for Ofcom to estimate and then recruit the number of people it requires as the scope of the regime and Ofcom’s responsibilities have changed over time. For example, according to Ofcom, as at the start of July 2023 it still needed to work out the staffing requirements arising from amendments to the Bill announced by the government at the end of June (paragraph 1.8), and estimating the required staffing levels remained difficult as the regime’s scope was still uncertain as further additions could still be made to the Bill. According to Ofcom, there is also a risk that continuing extensions to the legislative process could cause recruited staff to disengage or leave.

2.16 To successfully implement the regulatory regime, Ofcom must be able to attract the right talent with the right skills and expertise, including knowledge and understanding of the technology sector. Not only does Ofcom require a significant number of extra staff, but many of these are in new areas, such as online safety technology and data. Those Ofcom has appointed have a variety of relevant skills, including content moderation, online technology, including machine learning technologies, data management and analysis, policy-making, regulatory experience and human rights expertise. Ofcom has recruited from a variety of relevant bodies, including civil society bodies such as the National Society for the Prevention of Cruelty to Children (NSPCC) and Internet Watch Foundation, law enforcement agencies, such as the National Crime Agency, other regulators, and online service providers such as Google and Meta.

2.17 The initial focus of Ofcom’s recruitment was on policy roles to support the legislative process and corporate roles to set up operations, with corporate roles making up 44% of hires in 2021-22. Ofcom intends that, once the regime commences, some of the policy staff will transition to supervision roles and it is developing training to support this.

Infrastructure

2.18 Ofcom has based its online safety staff in London, Edinburgh and a new hub in Manchester. In summer 2021, Ofcom entered into a three-year lease for interim accommodation for 150 staff in Manchester. It wanted to avoid acquiring permanent accommodation until it had completed trials to identify the implications of the COVID-19 pandemic on its future ways of working. These trials were due to run from September 2021 after COVID-19 restrictions on office-based working had been eased. As at June 2023, Ofcom was in negotiations with its landlord to secure its interim accommodation on a more permanent basis.

2.19 Ofcom expects that all the necessary IT platforms will be ready on time, especially as Royal Assent is expected eight months later than first planned (paragraph 1.9). Ofcom has had to develop five new IT platforms to deliver the online safety regime. These include a platform where in-scope service providers can register themselves and through which they can receive notifications and invoices. The additional time before Royal Assent has enabled Ofcom to better understand the IT requirements and to develop the new platforms. Ofcom will develop further platforms as it implements the full regime.

6 Amber rating: There is delay against the critical path or key milestones of less than four weeks with agreed mitigation. The objectives (scope, budget, agreed tolerances) may be at risk; teams have agreed mitigating actions.

7 Under section 401 of the Communications Act 2003, Ofcom can retain monies it receives under the Wireless Telegraphy Act 2006 from issuing licences for civil use of the radio spectrum, in order to meet costs which it cannot otherwise recover through its imposition of fees and charges on industry. Government approval is required to its use of these receipts in this way. Otherwise, Ofcom passes on these receipts to the Exchequer.

8 All staffing figures are for the full-time equivalent (FTE) number of staff.

Part Three

Enabling informed regulation

3.1 In this Part, we examine:

Ofcom’s efforts to understand the online sector and the issues around online safety as it prepares to implement the new regulatory regime; and

the arrangements Ofcom and the Department for Science, Innovation & Technology (DSIT) are putting in place to monitor and evaluate the effectiveness of the regime once it becomes operational.

Understanding the online sector and online safety

3.2 Ofcom has produced a substantial initial evidence base to inform its implementation of the new regulatory regime. It has been thinking thoroughly and in a structured way about how it will use its new powers under the Online Safety Bill (the Bill) and develop its regulatory policies on online safety accordingly. According to Ofcom, as at April 2023, it had completed 24 research projects and had a further 90 either planned or under way to support the regime’s introduction. For example, during 2021-22, it had worked with six service providers of different sizes and types to understand their approaches to content moderation, metrics and the measurement of online harms. Its early research focused on the priority areas of illegal harms and protecting children and therefore avoided nugatory work when, in November 2022, the Bill’s provisions on legal but harmful content for adults were amended (paragraph 1.8). As at the start of July 2023, Ofcom was working to identify the impact on its plans for future research of the amendments to the Bill announced by the government at the end of June 2023; for example, the extent of further work required on age verification and assurance tools.

3.3 Ofcom made use of the research it carried out on online media literacy. Under the Communications Act 2003 Ofcom has a statutory duty to promote media literacy so that the public become informed digital decision-makers and so can protect themselves and others against harmful content. It also has a duty under the Act to carry out research into media literacy matters. Some of this research has covered online safety. For example, in June 2022, it released research that revealed the extent of abuse suffered by women online, and in October 2022 published research on how to keep children safe online.

3.4 Ofcom has drawn on its existing regulation experience to inform the developments of its regulatory policies for online safety. As well as its experience of regulating activities across broadcasting, telecommunications and spectrum, Ofcom has drawn on its previous regulation of online services (paragraph 1.7). After its first year as regulator of video-sharing platforms, Ofcom recognised the need to increase its engagement with service providers before introducing online safety regulation, and to set up a dedicated supervision team within the Online Safety Group (paragraph 2.12).

3.5 Ofcom has liaised with other UK regulators in developing the regime. For example, it has worked with the Information Commissioner’s Office (ICO) on the interactions between online safety and data protection regulation, and with the Competition & Markets Authority (CMA) on those between online safety and competition, issuing joint statements with each of these on these topics. It has also worked with the Financial Conduct Authority (FCA) on the Bill’s provisions regarding fraudulent advertising.

3.6 In July 2020, Ofcom co-founded the Digital Regulation Cooperation Forum with the CMA and ICO, with the FCA joining subsequently. The Forum aims to drive cooperation between the UK regulators of digital spaces and deliver coherent approaches to regulation. The Forum has undertaken joint work on algorithm auditing and age assurance, as well as publishing joint statements and hosting roundtables. These outputs have demonstrated to industry the high-level coherence between the different regulators. Some industry representatives told us they appreciated these efforts and held the outputs in positive regard. Other countries (The Netherlands, Australia and Ireland) have adopted the same or similar models to the Forum.

3.7 Ofcom has sought to draw on the experiences of overseas regulators who, like itself, are at the forefront of online safety regulation, such as those in the EU and Australia, and intends to continue to do so in the future. In November 2022, Ofcom launched, with regulators from Australia, Fiji and Ireland, the new Global Online Safety Regulators Network, which aims to pave the way for a coherent international approach to online safety regulation, by enabling online safety regulators to share information, experience and best practices. In March 2023, Ofcom announced the formation of a new International Working Group on Age Verification, which includes regulators from Belgium, Cyprus, France and Germany. The Group shares insights from research and day-to-day work assessing age verification techniques.

3.8 The measures contained in the Online Safety Bill have been well trailed with industry through extensive consultation by the Department for Digital, Culture, Media & Sport (DCMS) on, for example, the April 2019 white paper (Figure 4) and pre-legislative scrutiny by Parliament of the Bill (paragraph 1.8). Ofcom has supplemented this with its own engagement with industry to develop its knowledge and understanding of the sector and to prepare service providers for future regulation, the great majority of whom have not been regulated by Ofcom before and are unfamiliar with Ofcom and how it works. By March 2023, Ofcom had met more than 70 service providers of different sizes and business models. Its chief executive had visited the USA in November 2022 to build relationships with senior leaders in both large (for example, Google, Meta) and mid-sized and smaller service providers (for example, Roblox, Reddit). According to Ofcom, as at April 2023, it had also held 104 bilateral meetings, teach-ins and roundtables with a range of civil society bodies.

3.9 Representatives from industry told us that they appreciated Ofcom’s efforts to engage with them from an early stage. They felt that Ofcom had endeavoured to understand their concerns and to become an informed regulator. They also praised Ofcom’s communication, including the publication of the roadmap to regulation in July 2022 (paragraph 1.10), which has helped them to know what to expect.

3.10 However, several industry representatives expressed concern about the potential burden of compliance and the demands this would place on their resources. A one-person business described its finite resources and worried about nugatory efforts. Larger companies noted that, despite their size, their regulatory compliance resources were limited and greatly outnumbered by Ofcom’s resources. They also described receiving requests from Ofcom for information that would require significant effort to answer.

Monitoring and evaluation

3.11 There are significant challenges facing Ofcom around monitoring compliance with the new regulatory regime, given the scale and nature of the regulated sector. Ofcom will need to monitor the compliance of a very large number of service providers, the great majority of which are based overseas. As a result, under the Bill there will be a two-tier regime for monitoring compliance, with only what Ofcom expects to be the largest and riskiest 20 service providers initially subject to detailed, one-to-one supervision, while Ofcom does not expect to engage regularly with the rest. According to preliminary research carried out by Ofcom as part of its planning for the regime’s implementation, the number of online services subject to regulation could total more than 100,000. This number could be significantly higher, depending on the assumptions made when estimating this figure, for example, where one sets the threshold for the number of UK users of a service, such that this service is included in the estimate. Ofcom considers that the accuracy of its estimates will improve as it undertakes further analysis in this area and develops its knowledge. However, these numbers could increase if more services were to be included within the scope of the Bill. Ofcom also acknowledges that, due to the Bill’s broad scope and the dynamic and innovative nature of the online sector, it may never be able to estimate exactly the number of services within the regime’s scope.

3.12 Monitoring this huge second tier of services will require automated data collection and analysis systems, including automated tools to identify services that are in scope and collect data on them. Ofcom is currently developing these systems and putting in place the necessary IT capability to handle data for such a large number of services. A key challenge facing Ofcom is how it will identify changes in the risk profile of an individual service in this tier that are so significant that the service requires closer monitoring by Ofcom. According to Ofcom, it will be able to identify services who have significant growth in user numbers, and thus may need closer, one-to-one supervision. It also plans to develop its analytical tools to assess risk and to continuously learn and adapt its systems.

3.13 There are also significant challenges around evaluation. Meaningful evaluation of the regime’s impact on online harms and the online environment will be critical to future value-for-money assessments. However, such evaluation, by nature of the harms involved, will be challenging. As DCMS acknowledged in its impact assessment in January 2022, many of the regulated harms do not have standard definitions or reliable metrics. Evaluations will also have to account for the incremental introduction of the regime (paragraph 1.10), and for the fact that the regime’s eventual effectiveness is only partly dependent on the successful implementation of preparations for its introduction. Both DSIT and Ofcom are planning for and will undertake evaluation activities and have been liaising to ensure these activities complement each other.

3.14 The Online Safety Bill requires DSIT to undertake an evaluation of regulatory effectiveness within two to five years after the Bill receives Royal Assent. According to DSIT, its evaluation work is on track to meet this schedule. In 2022, it developed evaluation frameworks for individual elements of the regime and, in January 2023, commissioned consultants to help develop a framework for the whole regime. As at April 2023, work on the first version of the overarching framework was under way. The consultants identified important evaluation-related gaps in DSIT’s evidence base, finding a lack of robust baseline evidence against which to measure the regime’s effectiveness, and a lack of previous, equivalent evaluations that could provide lessons. The consultants recommended a large set of priority data collection activities to ensure that DSIT has the necessary evidence for its evaluation. This will require DSIT and Ofcom to discuss their respective data collection plans as part of their ongoing liaison over evaluation activities.

3.15 To complement DSIT’s work, Ofcom’s evaluations will focus on the impact of its different interventions. Ofcom is developing separate evaluation frameworks for each planned intervention, such as an individual code of practice addressing a particular harm, that set out how this intervention is expected to impact on the harm it is seeking to address. Based on this work, Ofcom plans to have identified a short set of evaluation metrics by the Bill’s Royal Assent, focused on areas that are aligned with its strategic priorities. These metrics will use a range of data sources, including Ofcom’s own surveys and third-party monitoring data. A significant amount of the data will come from the regulated service providers themselves through their transparency reports and responses to requests for information from Ofcom. Ofcom identified limitations with the provider-supplied information during its first year as regulator of video-sharing platforms and is working to improve the data platforms collect. As part of its evaluation of the online safety regime, Ofcom also plans to encourage platforms to evaluate the effectiveness of their safety measures, as well as carrying out its own assessment of these measures and sharing best practice. Ofcom will not be in a position to start fully evaluating the impact of its regulatory efforts until 2025 when the regulatory regime becomes fully operational. Ofcom intends to have a longer set of performance metrics in place by then.

3.16 Both Ofcom and DSIT are conscious about the risk of unintended consequences from the regulatory regime. In particular, both acknowledged a risk that the regime might stifle innovation, although in its impact assessment in January 2022, DCMS assessed the risk of indirectly impacting innovation to be negligible. However, a one-person business platform told us that they feared that any new measures would disproportionately affect small companies and start-ups, thereby prohibiting the emergence of new players and innovation. To monitor this risk going forward, Ofcom is required to assess the impact of all new codes of practice on innovation and small businesses. Ofcom has also identified other unintended consequences for all its planned interventions and has begun identifying metrics to monitor each of these.

3.17 Ofcom acknowledges that it will need to fine-tune the regulatory regime after it becomes fully operational. Such fine-tuning will depend on Ofcom’s ability to evaluate the effectiveness of the existing regime and any future changes. Ofcom has also established a horizon-scanning function to better understand the trends that will impact the online sector and users in future.

Appendix One

Our audit approach

Our evidence base

1 This report presents our independent conclusions on whether the preparations undertaken by the Department for Digital, Culture, Media & Sport (DCMS) (now by the Department for Science, Innovation & Technology (DSIT)) and Ofcom for the implementation of the new online safety legislation are sufficiently advanced. Our conclusions were reached following an analysis of evidence collected primarily between December 2022 and April 2023.

2 The evaluative criteria that we used to assess value for money were based on our 2021 Principles of effective regulation and included whether: the planned regulatory regime is clear and robust; Ofcom is taking steps to track how regulatory interventions may be needed; Ofcom is taking steps to ensure that its regulatory interventions are proportionate and timely; and whether there are arrangements in place for reporting performance, evaluating impacts of interventions, and working with relevant organisations.9

3 The Principles constitute a ‘learning cycle’ for assessing, for an existing regulatory regime, how well regulators and policy makers are applying these principles, as they assess progress and respond to external challenges and pressures. However, the same principles are equally applicable, and can therefore be considered, when a new regulator or regulatory framework is being set up, as in this case.

4 In forming our conclusions, we drew on a range of study methods and a variety of evidence sources, as described in the paragraphs below. We collated and analysed the evidence we obtained, using our evaluative criteria as a framework. We looked across different sources of evidence to support each of our findings. We triangulated any issues, brought to our attention through our interactions with government departments, Ofcom or other stakeholders, against other sources. Where necessary, we asked questions of the relevant parties and/or asked for more information to ensure that we focused on the highest-priority areas.

Methods

Interviews

5 We conducted more than 25 interviews with representatives from DCMS/DSIT, the Home Office, Ofcom, online service providers who will be subject to the new regulatory regime, and other regulators, to inform our audit.

6 Our interviews with Ofcom and DCMS/DSIT were mostly in the form of ‘teach in’ sessions responding to topics identified in advance by the National Audit Office (NAO), with documented presentations by the audited body supported by discussion with the NAO and responses to our questions. The documentary evidence and presentations supporting these sessions informed our evidence base.

7 Ofcom. We carried out nine interviews, both face-to-face and online, in February and March 2023 with Ofcom officials involved in its preparations for the new regulatory regime. Topics included how Ofcom has gone about these preparations, the progress it has made, its future plans for implementation, and the risks to these plans.

8 DCMS/DSIT. In January to March 2023, we carried out online interviews with officials involved in the development and implementation of the Online Safety Bill and the new regulatory regime.

9 Home Office. We met officials from the Home Office in March 2023 to discuss its role in the development and implementation of the new regulatory regime.

10 Regulated providers. In March and April 2023, we carried out online interviews with eight bodies (FreeDating, Google, Meta, Online Dating Association, OnlyFans, Roblox, Twitter and YouTube), which either themselves will be, or represent organisations which will be, subject to the new regulatory regime, in order to gain their views on how government and Ofcom have gone about preparing for the implementation of the new regulatory regime and the progress they have made with this. We also received comments from the Mid-Sized Platform Group.

11 Other regulators. We discussed with other regulators (the Information Commissioner’s Office, Financial Conduct Authority, Competition & Markets Authority) and the Digital Regulation Cooperation Forum the input they have had into preparations for the new regime, including their relationship with Ofcom, as part of our scoping work in August and September 2022. We also met with the secretariat supporting the Digital Regulation Cooperation Forum in February 2023 to discuss subsequent developments.

Document review

12 Between January and April 2023, we reviewed a wide range of published and unpublished documents produced by DCMS/DSIT, Ofcom and others to inform our study.

13 DCMS/DSIT and Ofcom documents included but were not limited to: minutes of the meetings of Ofcom’s Online Safety Programme Board and its associated papers; minutes of the meetings of DCMS’s/DSIT’s Joint Steering Group (attended by DCMS/DSIT, the Home Office and Ofcom) and its associated papers; business cases, budgeting and other planning documents; risk reports; and research into online safety. We reviewed each document to help us better understand how DCMS/DSIT and Ofcom have gone about preparing for the introduction of the new regulatory regime, the planned milestones and the progress they have made against these, future plans for the regime’s implementation, and the risks to these plans.

14 We also extracted relevant data from these documents for analysis – see ‘Data analysis’ below. Where necessary, we followed up with DCMS/DSIT and Ofcom to clarify the contents of the documents and to request further documents as required. We also used our document review to inform our interview questions and to confirm the findings from interviews.

15 We also reviewed relevant documents published by third parties, including research papers and submissions to government consultations, to gain an understanding of the extent of online harms experienced by online users, the issues surrounding online safety and its regulation, and the views of these parties on these topics.

Data analysis

16 In February to April 2023, we examined the expenditure incurred, and the number of staff recruited, by Ofcom in preparation for its implementation of the new regulatory regime. Our examination covered both past years from 2020-21 and future years to 2025-26. We also compared latest figures for these against Ofcom’s original plans. All cost figures we used are in cash (that is, not adjusted for inflation) terms.

9 National Audit Office, Principles of effective regulation, May 2021.

Design and Production by NAO Communications Team
DP Ref: 012226-001