Online Safety Act

The Online Safety Bill received Royal Assenton 26th October 2023, heralding a new era of internet censorship.

The new UK internet Ofcom was quick off the mark to outline its timetable for implementing the new censorship regime.

Ofcom has set out our plans for putting online safety laws into practice, and what we expect from tech firms, now that the Online Safety Act has passed. Ofcom writes:

The Act makes companies that operate a wide range of online services legally responsible for keeping people, especially children, safe online. These companies have new duties to protect UK users by assessing risks of harm, and taking steps to address them. All in-scope services with a significant number of UK users, or targeting the UK market, are covered by the new rules, regardless of where they are based.

While the onus is on companies to decide what safety measures they need given the risks they face, we expect implementation of the Act to ensure people in the UK are safer online by delivering four outcomes:

• stronger safety governance in online firms;

• online services designed and operated with safety in mind;

• choice for users so they can have meaningful control over their online experiences; and

• transparency regarding the safety measures services use, and the action Ofcom is taking to improve them, in order to build trust .

We are moving quickly to implement the new rules

Ofcom will give guidance and set out codes of practice on how in-scope companies can comply with their duties, in three phases, as set out in the Act.

Phase one: illegal harms duties

We will publish draft codes and guidance on these duties on 9 November 2023, including:

• analysis of the causes and impacts of online harm, to support services in carrying out their risk assessments;

• draft guidance on a recommended process for assessing risk;

• draft codes of practice, setting out what services can do to mitigate the risk of harm; and

• draft guidelines on Ofcom's approach to enforcement.

We will consult on these documents, and plan to publish a statement on our final decisions in Autumn 2024. The codes of practices will then be submitted to the Secretary of State for Science, Innovation and Technology, and subject to their approval, laid before Parliament.

Phase two: child safety, pornography and the protection of women and girls

Child protection duties will be set out in two parts. First, online pornography services and other interested stakeholders will be able to read and respond to our draft guidance on age assurance from December 2023. This will be relevant to all services in scope of Part 5 of the Online Safety Act.

Secondly, regulated services and other interested stakeholders will be able to read and respond to draft codes of practice relating to protection of children, in Spring 2024.

Alongside this, we expect to consult on:

• analysis of the causes and impacts of online harm to children; and

• draft risk assessment guidance focusing on children's harms.

We expect to publish draft guidance on protecting women and girls by Spring 2025, when we will have finalised our codes of practice on protection of children.

Phase three: transparency, user empowerment, and other duties on categorised services

A small proportion of regulated services will be designated Category 1, 2A or 2B services if they meet certain thresholds set out in secondary legislation to be made by Government. Our final stage of implementation focuses on additional requirements that fall only on these categorised services. Those requirements include duties to:

• produce transparency reports;

• provide user empowerment tools;

• operate in line with terms of service;

• protect certain types of journalistic content; and

• prevent fraudulent advertising.

We now plan to issue a call for evidence regarding our approach to these duties in early 2024 and a consultation on draft transparency guidance in mid 2024.

Ofcom must produce a register of categorised services. We will advise Government on the thresholds for these categories in early 2024, and Government will then make secondary legislation on categorisation, which we currently expect to happen by summer 2024. Assuming this is achieved, we will:

• publish the register of categorised services by the end of 2024;

• publish draft proposals regarding the additional duties on these services in early 2025; and

• issue transparency notices in mid 2025.

Ofcom has commenced investigations into two pornographic services - Itai Tech Ltd and Score Internet Group LLC - under our age assurance enforcement programme.

Under the Online Safety Act, online services must ensure children cannot access pornographic content on their sites. In January, we wrote to online services that display or publish their own pornographic content to explain that the requirements for them to have highly effective age checks in place to protect children had come into force. We requested details of services' plans for complying, along with an implementation timeline and a named point of contact.

Encouragingly, many services confirmed that they are implementing, or have plans to implement, age assurance on around 1,300 sites. A small number of services chose to block UK users from accessing their sites, rather than putting age checks in place.

Certain services failed to respond to our request and have not taken any steps to implement highly effective age assurance to protect children from pornography.

We are today opening investigations into Itai Tech Ltd - a service which runs the nudification site Undress.cc - and Score Internet Group LLC, which runs the site Scoreland.com. Both sites appear to have no highly effective age assurance in place and are potentially in breach of the Online Safety Act and their duties to protect children from pornography. Next steps

We will provide an update on both investigations on our website in due course, along with details of any further investigations launched under this enforcement programme

 

Update: Low Scores

2nd July 2025. See article from ofcom.org.uk

Ofcom has closed its investigation of scoreland.com after the website introduced age/ID verification. The website now requires that UK users subscribe using a credit card (no debit cards) before content can be viewed. Visitors from other countries can see teaser images and can pay via several other options.

Ofcom writes:

In response to our investigation, Score Internet Group LLC have taken steps to implement highly effective age assurance to ensure compliance with their duties under Part 5 of the OSA.

As such, Ofcom is satisfied that the conduct that led to the opening of the investigation has ceased and we do not consider it appropriate to continue our investigation. We have therefore closed it without making any findings as to Score Internet's compliance with its duties, either currently or prior to its confirmation that it had taken steps to comply with the OSA.

So most of the major tube sites have decided to implement ID verification for UK viewers. But thankfully there are still plenty of options of websites that have not yet implemented ID verification requirements. Here is a useful list of porn sites to try to find those not inflicting ID verification: toppornsites.com .

For viewers stupidly subscribing to the risk of handing over ID to watch porn I noted that many websites were promising to not keep a copy of ID data provided for verification purposes and then immediately demanding an email address that will be kept for furture visits. Surely an email address is a key piece of identity data that should not be retained.

Surely a better idea is purchase a VPN and access porn as if in a different country from the UK. For the moment all the major porn sites stil allow access via VPN. Perhaps one day this will not be 5the case when ID verification is adopted worldwide. Also not that it is up to websites whether they allow access via VPN or not. Under threat of extreme punishment they could reasonably easily one day block access from VPNs. (as the likes of BBC and Netflix already do).

Another option is to install a tor browser (the onion ring I think). See torproject.org . This is a browser that looks bery much like Firefox but obtains page data via  complicated and encrypted routing that evades censorship and country specific blocking. It is not quite as 100% succesful as a VPN but can be used to watch porn on the main porn websites.

But of course the authorities will not be very pleased by these straightforward workarounds, and they have put in place a censorship rule to prevent adult websites from themselves promoting workarounds. According to Ofcom and the BBC, platforms must not host, share or permit content that encourages the use of VPNs to get around age checks and it will be illegal for them to do so.

An Aylo spokesperson, the parent company of Pornhub said parents are advised to block VPN usage just in case, and  told the BBC that the question of VPNs was an issue for governments, adding:

We certainly do not recommend that anyone uses technology to bypass the law.'

Aylo has publicly called for effective and enforceable age assurance solutions that protect minors online, while ensuring the safety and privacy of all users. The United Kingdom is the first country to present these same priorities demonstrably

Thankfully such censorship laws simply don't apply to websites out of Ofcom's remit so there will surely be plenty of sources of information available to workaround the dangers of ID verification for porn.