On 5 December 2022, the UK Government released an amended draft of the Online Safety Bill ("OSB"), the UK's proposed framework intended to improve online safety, which is set to pass in 2023. Meanwhile, the Digital Services Act ("DSA"), the EU's parallel legislative attempt to regulate digital services and user generated content, came into force on 16 November 2022. Although most of its provisions will apply from 17 February 2024, very large online platforms ("VLOPs") and very large online search engines ("VLOSEs"), will be required to comply with their obligations under the DSA just four months after their designation as such by the EU.
While the OSB and DSA have similar aims – with many businesses falling under the scope of both regimes – the pieces of legislation do vary significantly, both in scope and the type of obligations imposed. In this article, we highlight key similarities and differences in five areas.
Services within scope
- Key overlap: to fall under the scope of the DSA and OSB, services must have a link to the UK or EU as applicable. Both sets of legislation have extra-territorial reach, meaning that they will apply to those who provide services in the UK and EU respectively, regardless of whether they are established in either jurisdiction. Services that frequently rely on the hosting defence under the E-Commerce Directive, which limits the liability of providers whose services consist of "storage of information", are likely to fall under the scope of both regimes. Both pieces of legislation impose enhanced obligations on certain services.
- Key difference: services subject to enhanced duties under one regime will not necessarily be subject to enhanced duties under the other (or even fall within the scope of both regimes). The OSB divides services into different categories depending on their size and deemed risk, with Category 1 services (i.e., the largest online platforms with the highest reach and highest risk, including the most popular social media platforms) subject to the most onerous obligations. Conversely, the DSA applies to providers of "online platforms" (i.e., services whose function is to store and disseminate information to the public on behalf of users). This includes online marketplaces, social networks, content-sharing platforms, app stores and online travel and accommodation platforms. It also builds on the existing "mere conduits, caches and hosts" classes provided for under the E-Commerce Directive, introducing two additional subsets of services, VLOPs and VLOSEs, which are subject to enhanced obligations. However, Category 1 services under the OSB will not necessarily be designated as VLOPs and VLOSEs under the DSA, and vice versa.
Content within scope
- Key overlap: content that is illegal under UK or EU law falls under the scope of the OSB and DSA respectively.
- Key difference: The OSB applies different obligations to different types of illegal content, whereas the DSA treats all illegal content equally. (However, depending on their role, size and impact, services are subject to varying levels of obligations in relation to such content). Under the OSB, illegal content includes: (i) offences relating to terrorism or child sexual exploitation/abuse and priority offences, set out in the Schedules to the Bill; and (ii) offences where individuals are victims. Services which are likely to be accessed by children have obligations relating to content that is harmful to children, whereas the DSA applies to illegal content only. The DSA defines illegal content as any information or activity, including the sale of products or provision of services, which is not in compliance with EU law or Member State law. It also covers content relating to the sale of illegal goods and services and intellectual property, while the OSB specifically excludes these types of content (and certain others).
Risk assessments and reporting
- Key overlap: both regimes require that the highest risk and/or largest providers (i.e., Category 1 services and VLOPs) carry out risk assessments and mitigate any risks identified. They also require services to implement mechanisms that allow users to report illegal content.
- Key difference: under the OSB, risk assessments relate to identifying, mitigating and managing illegal content. Under the DSA, assessments relate to systemic risks arising from the design, functioning and use of platforms. All services falling under the scope of the OSB are required to conduct assessments, whereas only VLOPs are required to carry out systemic risk assessments under the DSA.
Freedom of speech
- Key overlap: Under both regimes, services must pay "regard" to users' rights to freedom of expression in respect of any safety measures or content moderation. The OSB requires Category 1 services to conduct impact assessments on how any safety measures affect users' rights to freedom of expression. The DSA requires VLOPs to conduct risk assessments of their content moderation systems.
- Key difference: Under the DSA, VLOPs are also required to identify "significant systemic risks" from "the dissemination of illegal content through their services", "any negative effects for the exercise of the fundamental rights" of users and "intentional manipulation of their service". The latest version of the OSB introduces a “triple shield” of protections for adult users, including that platforms can only remove or restrict legal content only if in breach of their terms of service, and must then offer a right of appeal.
Advertising
- Key overlap: both regimes make it more difficult for fraudulent or misleading advertising to be placed online.
- Key difference: Category 1 services under the OSB will be required to remove fraudulent adverts swiftly when put on notice and prevent users from encountering fraudulent adverts more generally. This includes unlicensed financial promotions, ads for non-existent companies and fraudulent impersonation of legitimate businesses. The DSA aims to crack down on misleading advertising by promoting transparency, including by mandating certain disclosures for paid adverts. The DSA also imposes a blanket ban on targeted advertising for users under the age of 18.
To receive further updates as the OSB progresses, please sign-up to our Online Safety Bill mailing list.