At some point this year, the UK\u2019s long-delayed Online Safety Bill is finally expected to become law. In the government\u2019s words, the legislation is an attempt to make the UK \u201cthe safest place in the world to be online<\/a>\u201d by introducing a range of obligations for how large tech firms should design, operate, and moderate their platforms.<\/p>\n<\/div>\n As any self-respecting Verge<\/em> reader knows, content moderation is never simple. It\u2019s difficult for platforms, difficult for regulators, and difficult for lawmakers crafting the rules in the first place. But even by the standards of internet legislation, the Online Safety Bill has had a rocky passage. It\u2019s been developed over years during a particularly turbulent era in British politics, changing dramatically from year to year. And as an example of just how controversial the bill has become, some of the world\u2019s biggest online organizations, from WhatsApp<\/a> to Wikipedia<\/a>, are preemptively refusing to comply with its potential requirements.\u00a0<\/p>\n<\/div>\n So if you\u2019ve tuned out the Online Safety Bill over the past few years \u2014 and let\u2019s be honest, a lot of us have \u2014 it\u2019s time to brush up. Here\u2019s where the bill came from, how it\u2019s changed, and why lawmakers might be about to finally put it on the books.\u00a0<\/p>\n<\/div>\n So let\u2019s start from the beginning. What is the Online Safety Bill?<\/strong><\/p>\n<\/div>\n The UK government\u2019s elevator pitch is that the bill is fundamentally an attempt to make the internet safer, particularly for children. It attempts to crack down on illegal content like child sexual abuse material (CSAM) and to minimize the possibility that kids might encounter<\/a> harmful and age-inappropriate content, including online harassment as well as content that glorifies suicide, self-harm, and eating disorders.<\/p>\n<\/div>\n \u201cThe safest place in the world to be online\u201d<\/p>\n<\/div>\n<\/div>\n But it\u2019s difficult to TL;DR the Online Safety Bill at this point, precisely because it\u2019s become so big and sprawling. On top of these broad strokes, the bill has a host of other rules. It requires online platforms to let people filter out objectionable content. It introduces age verification for porn sites. It criminalizes fraudulent ads. It requires sites to consistently enforce their terms of service. And if companies don\u2019t comply, they could be fined up to \u00a318 million (around $22.5 million) or 10 percent of global revenue, see their services blocked, and even see their executives jailed<\/a>.<\/p>\n<\/div>\n In short, the Online Safety Bill has become a catchall for UK internet regulation, mutating every time a new prime minister or digital minister has taken up the cause.<\/p>\n<\/div>\n How many prime ministers are we talking about here?<\/strong><\/p>\n<\/div>\n Wait, how long has this bill been in the works for?<\/strong><\/p>\n<\/div>\n The Online Safety Bill started with a document called the \u201cOnline Harms White Paper<\/a>,\u201d which was unveiled way back in April 2019 by then-digital minister Jeremy Wright<\/a>. The death of Molly Russell by suicide in 2017<\/a> brought into sharp relief the dangers of children being able to access content relating to self-harm and suicide online, and other events like the Cambridge Analytica scandal<\/a> had created the political impetus to do something<\/em><\/a> to regulate big online platforms.<\/p>\n<\/div>\n The idea was to introduce a so-called \u201cduty of care\u201d for big platforms like Facebook \u2014 similar to how British law asks employers to look after the safety of their employees<\/a>. This meant companies would have to perform risk assessments and make proactive solutions to the potential harms rather than play whack-a-mole with problems as they crop up. As Carnegie UK associate Maeve Walsh<\/a> puts it, \u201cInterventions could take place in the way accounts are created, the incentives given to content creators, in the way content is spread as well as in the tools made available to users before we got to content take down.\u201d<\/p>\n<\/div>\n The white paper laid out fines and the potential to block websites that don\u2019t comply. At that point, it amounted to some of the broadest and potentially strictest online regulations to have been proposed globally.<\/p>\n<\/div>\n What was the response like at the time?<\/strong><\/p>\n<\/div>\n Obviously, there was a healthy amount of skepticism (Wired<\/em>\u2019s take was simply titled \u201cAll that\u2019s wrong with the UK\u2019s crusade against online harms<\/a>\u201d), but there were hints of cautious optimism as well. Mozilla, for example, said the overall approach had \u201cpromising potential<\/a>,\u201d although it warned about several issues that would need to be addressed to avoid infringing on people\u2019s rights.\u00a0<\/p>\n<\/div>\n If the British government was on to such a winner, why hasn\u2019t it passed this bill four years later?\u00a0<\/strong><\/p>\n<\/div>\n Have you paid attention to British politics at all in the past four years? The original white paper was introduced four prime ministers and five digital ministers ago, and it seems to have been forced into the back seat by more urgent matters like leaving the European Union or handling the covid-19 pandemic.\u00a0<\/p>\n<\/div>\n But as it\u2019s passed through all these hands, the bill has ballooned in size \u2014 picking up new provisions and sometimes dropping them when they\u2019re too controversial. In 2021, when the first draft of the bill was presented to Parliament, it was \u201cjust\u201d 145 pages long<\/a>, but by this year, it had almost doubled to 262 pages<\/a>.<\/p>\n<\/div>\n Where did all those extra pages come from?<\/strong><\/p>\n<\/div>\n Given the bill\u2019s broad ambitions for making online life safer in general, many new elements were added by the time it returned to Parliament in March 2022<\/a>. In no particular order, these included:\u00a0<\/p>\n<\/div>\n Over time, the bill\u2019s definition of \u201csafety\u201d has started to look pretty vague. A provision in the May 2021 draft<\/a> forbade companies \u201cfrom discriminating against particular political viewpoints and will need to apply protections equally to a range of political opinions, no matter their affiliation,\u201d echoing now familiar fears that conservative voices are unfairly \u201ccensored\u201d online. Bloomberg <\/em>called this<\/a> an \u201canti-censorship\u201d clause at the time, and it continues to be present in the 2023 version of the bill.<\/p>\n<\/div>\n And last November, ministers were promising to add even more offenses to the bill, including downblousing and the creation of nonconsensual deepfake pornography<\/a>.\u00a0<\/p>\n<\/div>\n Hold up. Why does this pornography age check sound so familiar?<\/strong><\/p>\n<\/div>\n The Conservative Party has been trying to make it happen since well before the Online Safety Bill. Age verification was a planned part of the Digital Economy Bill in 2016<\/a> and then was supposed to happen in 2019<\/a> before being delayed<\/a> and abandoned<\/a> in favor of rolling the requirements into the Online Safety Bill.<\/p>\n<\/div>\n The problem is, it\u2019s very difficult to come up with an age verification system that can\u2019t be either easily circumvented in minutes<\/a> or create the risk that someone\u2019s most intimate web browsing moments could be linked to their real-life identity \u2014 notwithstanding a plan to let users buy a \u201cporn pass\u201d from a local shop.\u00a0<\/p>\n<\/div>\n Age checks for porn are a long-running political project<\/p>\n<\/div>\n<\/div>\n And it\u2019s not clear how the Online Safety Bill will overcome this challenge. An explainer by The<\/em> Guardian<\/em><\/a> notes that Ofcom will issue codes of practice on how to determine users\u2019 ages, with possible solutions involving having age verification companies check official IDs or bank statements.<\/p>\n<\/div>\n Regardless of the difficulties, the government is pushing ahead with the age verification requirements, which is more than can be said for its proposed rules around \u201clegal but harmful\u201d content.<\/p>\n<\/div>\n And what exactly were<\/em> these \u201clegal but harmful\u201d rules?\u00a0<\/strong><\/p>\n<\/div>\n Well, they were one of the most controversial additions to the entire bill \u2014 so much so that they\u2019ve been (at least partially) walked back.<\/p>\n<\/div>\n Originally, the government said it should officially designate certain content as harmful to adults but not necessarily illegal<\/a> \u2014 things like bullying or content relating to eating disorders. (It\u2019s the less catchy cousin of \u201clawful but awful<\/a>.\u201d) Companies wouldn\u2019t necessarily have to remove this content<\/a>, but they\u2019d have to do risk assessments about the harm it might pose and set out clearly in their terms of service how they plan to tackle it.\u00a0<\/p>\n<\/div>\n But critics were wary of letting the state define what counts as \u201charmful,\u201d the fear being that ministers would have the power to censor what people could say online. At a certain point, if the government is formally pushing companies to police legal speech, it\u2019s debatable how \u201clegal\u201d that speech still is.\u00a0<\/p>\n<\/div>\n From \u201clegal but harmful\u201d to the \u201ctriple shield\u201d<\/p>\n<\/div>\n<\/div>\n This criticism had an effect. The \u201clegal but harmful\u201d provisions for adults were removed from the bill in late 2022<\/a> \u2014 and so was a \u201charmful communications\u201d offense<\/a> that covered sending messages that caused \u201cserious distress,\u201d something critics feared could similarly criminalize offensive but legal speech.<\/p>\n<\/div>\n Instead, the government introduced a \u201ctriple shield\u201d covering content meant for adults. The first \u201cshield\u201d rule says platforms must remove illegal content like fraud or death threats. The second says anything that breaches a website\u2019s terms of service should be moderated. And the third says adult users should be offered filters to control the content they see.<\/p>\n<\/div>\n The thinking here is that most websites already restrict \u201charmful communications\u201d and \u201clegal but harmful\u201d content, so if they\u2019re told to apply their terms of service consistently, the problem (theoretically) takes care of itself. Conversely, platforms are actively prohibited<\/em> from restricting content that doesn\u2019t breach the terms of service or break the law. Meanwhile, the filters are supposed to let adults decide whether to block objectionable content like racism, antisemitism, or misogyny. The bill also tells sites to let people block unverified users \u2014 aka those pesky \u201canonymous trolls.\u201d\u00a0<\/p>\n<\/div>\n None of this impacts the rules aimed specifically at children \u2014 in those cases, platforms will still have a duty to mitigate the impact of legal but harmful content.\u00a0<\/p>\n<\/div>\n I\u2019m glad that the government addressed those problems, leaving a completely uncontroversial bill in its wake.\u00a0<\/strong><\/p>\n<\/div>\n Wait, sorry. We\u2019re just getting to the part where the UK might lose encrypted messaging apps.<\/p>\n<\/div>\n Remember WhatsApp? After the Online Safety Bill was introduced, it took issue with a section that asks online tech companies to use \u201caccredited technology\u201d to identify child sexual abuse content \u201cwhether communicated publicly or privately.\u201d Since personal WhatsApp messages are end-to-end encrypted, not even the company itself can see their contents. Asking it to be able to identify CSAM, it says, would inevitably compromise this end-to-end encryption.\u00a0<\/p>\n<\/div>\n WhatsApp is owned by Meta, which is persona non grata among regulators these days, but it\u2019s not the only encrypted messaging service whose operators are concerned. WhatsApp head Will Cathcart wrote an open letter<\/a> that was co-signed by the heads of six other messaging apps, including Signal. \u201cIf implemented as written, [this bill] could empower Ofcom to try to force the proactive scanning of private messages on end-to-end encrypted communication services – nullifying the purpose of end-to-end encryption as a result and compromising the privacy of all users,\u201d says the letter. \u201cIn short, the bill poses an unprecedented threat to the privacy, safety and security of every UK citizen and the people with whom they communicate.\u201d<\/p>\n<\/div>\n The consensus among legal<\/a> and cybersecurity experts<\/a> is that the only way to monitor for CSAM while maintaining encryption is to use some kind of client-side scanning, an approach Apple announced in 2021<\/a> that it would be using for image uploads to iCloud. But the company ditched the plans the following year<\/a> amid widespread criticism from privacy advocates.<\/p>\n<\/div>\n Organizations such as the Internet Society<\/a> say that such scanning risks creating vulnerabilities for criminals and other attackers to exploit and that it could eventually lead to the monitoring of other kinds of speech. The government disagrees and says<\/a> the bill \u201cdoes not represent a ban on end-to-end encryption, nor will it require services to weaken encryption.\u201d But without an existing model for how such monitoring can coexist with end-to-end encryption, it\u2019s hard to see how the law could satisfy critics.<\/p>\n<\/div>\n The UK government already has the power to demand that services remove encryption thanks to a 2016 piece of legislation called the Investigatory Powers Act. But The Guardian<\/em> notes<\/a> that WhatsApp has never received a request to do so. At least one commentator thinks<\/a> the same could happen with the Online Safety Bill, effectively giving Ofcom a radical new power that it may never choose to wield.<\/p>\n<\/div>\n But that hasn\u2019t exactly satisfied WhatsApp, which has suggested it would rather leave the UK than comply with the bill<\/a>.<\/p>\n<\/div>\n Okay, so messaging apps aren\u2019t a fan. What do other companies and campaigners have to say about the bill?<\/strong><\/p>\n<\/div>\n Privacy activists have also been fiercely critical of what they see as an attack on end-to-end encryption. The Electronic Frontier Foundation, Big Brother Watch, and Article 19 published an analysis earlier this year<\/a> that said the only way to identify and remove child sexual exploitation and abuse material would be to monitor all private communications, undermining users\u2019 privacy rights and freedom of expression. Similar objections were raised in another open letter last year<\/a> signed by 70 organizations, cybersecurity experts, and elected officials. The Electronic Frontier Foundation has called the bill \u201ca blueprint for repression around the world<\/a>.\u201d<\/p>\n<\/div>\n Tech giants like Google<\/a> and Meta<\/a> have also raised numerous concerns with the bill. Google says there are practical challenges to distinguishing between illegal and legal content at scale and that this could lead to the over-removal of legal content. Meta suggests that focusing on having users verify their identities risks excluding anyone who doesn\u2019t wish to share their identity from participating in online conversations.<\/p>\n<\/div>\n \u201cA blueprint for repression around the world\u201d<\/p>\n<\/div>\n<\/div>\n Even beyond that, there are more fundamental concerns about the bill. Matthew Lesh, head of public policy at the Institute of Economic Affairs, notes that there\u2019s<\/a> simply a massive disparity between what is acceptable for children to encounter online and what\u2019s acceptable for adults under the bill. So you either risk the privacy and data protection concerns of asking all users to verify their age or you moderate to a children\u2019s standard by default for everyone.\u00a0<\/p>\n<\/div>\n That could put even a relatively safe and educational service like Wikipedia under pressure to ask for the ages of its users<\/a>, which the Wikimedia Foundation\u2019s Rebecca MacKinnon says would \u201cviolate [its] commitment to collect minimal data about readers and contributors.\u201d<\/p>\n<\/div>\n \u201cThe Wikimedia Foundation will not be verifying the age of UK readers or contributors,\u201d MacKinnon wrote.<\/p>\n<\/div>\n Okay, that\u2019s a lot of criticism. So who\u2019s in favor of this bill?<\/strong><\/p>\n<\/div>\n One group that\u2019s been broadly supportive of the bill is children\u2019s charities. The National Society for the Prevention of Cruelty to Children (NSPCC), for example, has called the Online Safety Bill \u201can urgent and necessary child protection measure<\/a>\u201d to tackle grooming and child sexual abuse online. It calls the legislation \u201cworkable and well-designed\u201d and likes that it aims to \u201ctackle the drivers of online harms rather than seek to remove individual pieces of content.\u201d Barnardo\u2019s, another children\u2019s charity, has been supportive of the bill\u2019s introduction of age verification<\/a> for pornography sites.<\/p>\n<\/div>\n Ian Russell, the father of the late Molly Russell, has called the Online Safety Bill \u201ca really important piece of legislation,\u201d though he\u2019s pushed for it to go further<\/a> when it comes to criminal sanctions for executives whose products are found to have endangered children\u2019s well-being.\u00a0<\/p>\n<\/div>\n \u201cI don\u2019t think that without effective regulation the tech industry is going to put its house in order, to prevent tragedies like Molly\u2019s from happening again,\u201d Russell said. This sentiment appears to be shared by increasing numbers of lawmakers internationally, such as those in California who passed the Age-Appropriate Design Code Act in August last year<\/a>.<\/p>\n<\/div>\n Where\u2019s the bill at these days?\u00a0<\/strong><\/p>\n<\/div>\n As of this writing, the bill is currently working its way through the UK\u2019s upper chamber, the House of Lords, after which it\u2019ll be passed back to the House of Commons to consider any amendments that have been made. The government\u2019s hope is to pass it at some point this summer. <\/p>\n<\/div>\n Even after the bill passes, however, there will still be practical decisions made about how it\u2019ll work in practice. Ofcom will need to decide what services pose a high enough risk to be covered by the bill\u2019s strictest rules and develop codes of practice for platforms to abide by, including tackling thorny issues like how to introduce age verification for pornography sites. Only after the regulator completes this consultation process will companies know when and how to fully comply with the bill, and Ofcom has said it expects this to take months<\/a>.<\/p>\n<\/div>\n\n