The Online Safety Act and safeguarding users in digital projects

Let’s start with an example ­of the types of arts project that would be covered and the law’s potential impact. A live stream experience from the US in 2017 called “He Will Not Divide Us” is a good illustration. Actor and artist Shia LaBeouf ran a live stream video experience outside the Museum of the Moving Image in New York. The project occurred in the aftermath of Trump’s presidential victory and aimed to unite people through chanting protest slogans and displaying messages of resistance to a camera that was constantly live streaming.

Unfortunately, this user-to-user service inadvertently attracted the attention of online trolls who then singled out and targeted individual participants, revealing their real life identities and subjecting them to online abuse, including racial harassment and hatred. What was intended as an effort to bring people together in a time of national turmoil ended in some harrowing real-world consequences, raising questions about the mitigation of such risks. If a user-to-user project such as this was launched in the UK in the coming years then things might indeed be different – perhaps most notably because the OSA requires a user safety risk assessment and proactive mitigation measures to be put in place.

What do you need to know now?

The Act is still evolving, some aspects came into force at the end of 2024, but there’s still time to get acquainted with your obligations. Ofcom, the UK’s communications regulator, will oversee this Act. As well as being the regulator, they’re tasked by the Government with publishing initial guidance, and this information is readily available on their website.

The big question is, who is in scope?

The Act applies to three types of service providers:

1. Those allowing users to interact with each other’s content.

Some examples of these include:

• Image sharing platform
• Forum website
• Instant messaging app
• Chatroom
• Virtual reality multi-user space
• User generated live video streaming service
• Virtual event where users can interact with each other
• Audio journey sharing platform

2. Providers of search engines enabling users to search multiple websites and databases.

3. Providers of internet services that publish or display pornographic content.

Now, to determine whether the rules apply to you, consider three factors:

1. Does your service have links with the UK, making it accessible to individuals there?

2. Do you provide one of the relevant services outlined earlier?

3. Are there any exemptions that might apply to your service?

Exemptions include internal business use, public authorities, and educational childcare providers. 

Non-compliance with the Act can result in substantial fines, the severity of which depends on the organisation’s size and scale. In addition to financial penalties, senior executives may face criminal sanctions, reinforcing the urgency of adhering to regulatory requirements.

How to prepare?

1. Review your digital projects: Assess which of your current and upcoming digital projects fall under the scope of the Act, particularly those involving user-to-user communication, forums, or content sharing. Consider this for any new digital project idea and grant application.

2. Update policies: Revise your organisation’s policies and guidelines to align with the Act’s upcoming requirements, especially those related to content moderation and user safety.

3. Training: Consider, like many have done with GDPR, appointing a ‘champion’ for OSA compliance before the act comes into force. Train staff members to understand the Act’s implications (perhaps led by the ‘champion’) and their responsibilities in maintaining user safety.

4. Monitoring and reporting: If you haven’t already, implement mechanisms for monitoring and reporting harmful content or behaviour in your existing digital projects. Don’t wait until the act comes into force to do this.

5. User engagement: Actively engage with your existing audience to gather feedback and address any concerns, proactively demonstrating your commitment to their online safety and wellbeing. This might be in the form of focus groups or surveys. It might be worth sharing the findings of this process back with your funders.

6. Stay informed: Keep up to date with any developments or changes related to the Act’s regulation thorough Ofcom’s consultation phase.

There is of course immense creative potential in the evolving intersection of digital technologies and arts and culture. The possibilities offered by technologies like AI, user generated content and virtual reality can enrich audience experiences in ways previously unimagined.

However, it is crucial to remember the lessons of history: just as with most other forms of technology, be it cars, planes, or even just preparing food, a solid foundation of safety and end-user trust is essential to really make the most of benefits of these innovations. In my own experience with my company Limina Immersive’s touring VR theatre, the more emphasis we placed on audience members feeling comfortable and secure, the more tickets we sold and the better our audience feedback was.

The advent of the Online Safety Act represents a significant cultural and legal shift. While your project may not be directly in scope of the Act, the core process of conducting a user safety risk assessment, even at an early stage, can offer your project longevity and really strengthen its appeal to audiences.