Problems with the Online Safety Act: a letter to my MP

I’m writing to express my objections to the Online Safety Act and ask that you support repealing or amending the Act. The Online Safety Act is highly damaging to tech innovation in the UK, is unfair to small and hobby sites, and is a cybersecurity and privacy nightmare.

Unfair burden on small and hobby websites #

In my own time, I run a small website with fewer than 1,000 monthly active users. This is a hobby project and does not make a profit. I have had to do two risk assessments — a time-consuming process with thousands of pages of Ofcom guidance to read. There is no guarantee that I have done these correctly, as I am unable to hire an expert to check them. My website is small and actively moderated; it is not a risk to anyone.

As the Online Safety Act carries a large fine and criminal liabilities, many domestic small and hobby websites are closing down or blocking UK users because they are unwilling to accept the risk or do not have the time/resources to do the compliance.^{footnote 1} The majority of websites are not based in the UK and it is a lot easier for them to just block UK users rather than comply with the Act. This is a huge loss of community and personal freedoms for UK users.

The biggest online safety risks are big tech services like Instagram, Facebook, and X, not hobby forums about hamster care or wood carving.^{footnote 2} The highest risk sites are best placed to handle the additional burden, yet the lowest risk sites are most affected by the additional burden. This is what makes it unfair.

The Online Safety Act’s unfair burden on small and hobby websites is a barrier to entry and will result in the UK becoming a less competitive environment for tech innovation.

From the Government’s response to the Repeal the Online Safety Act petition:

For example, the Government is very concerned about small platforms that host harmful content, such as forums dedicated to encouraging suicide or self-harm. Exempting small services from the Act would mean that services like these forums would not be subject to the Act’s enforcement powers.

At the very most, small sites should be required to have terms of service/rules, moderation, and a reporting system. They should not be subject to costly and time-intensive compliance requiring two risk assessments and reading thousands of pages of Ofcom guidance.

Age verification is a cybersecurity and privacy nightmare #

Age verification is a new and poorly regulated industry that frequently requires UK users to give personal information and ID documents to foreign companies. It desensitises UK users into giving this information to websites online. It is only a matter of time before the identity documents of millions of UK users are leaked.

Additionally, age verification has a negative impact on privacy. It results in disclosing your face and/or full identity to an age verification service. Many of these companies are third-party and have dodgy privacy policies — including those chosen by Reddit, Bluesky, and Grindr.^{footnote 3 footnote 4}

Age verification is harmful to children and misses the point #

One part of the Online Safety Act is strong age verification to access content that is “harmful to children”. I believe that this misses the point and results in more harm to children.^{footnote 4:1}

Nothing will stop a sufficiently motivated teenager from getting porn. In the best case, they will use a VPN^{footnote 5} or find a loophole. Worst case, they will go to the dark web and poorly moderated websites instead of legitimate websites.^{footnote 6} These websites are likely to have extreme porn, revenge porn, and many other kinds of harm that are much worse than a teenager intentionally seeking out porn.

The focus should be on preventing accidental views of content and parental controls. It’s quite common to accidentally see adult content on social media; adult content is often posted on common safe-for-work hashtags, like cosplays. This is actual harm as the user did not consent to seeing the content. Parental controls tools already exist and parents could try talking to their children.

Censorship and government overreach #

The Online Safety Act has a chilling effect on free speech.^{footnote 4:2} Posts about the Gaza war, protests, new political parties, and LGBT+ communities have been put behind age gates.^{footnote 7} This is deeply concerning at a time when Labour is planning to lower the voting age to 16.

Age verification is for all content that is “harmful to children”, not just porn. This results in a chilling effect where sites will ban all such content, very broadly, out of caution.

The Online Safety Act grants new powers that could be exploited by a less favourable future government.

Conclusion #

The Online Safety Act is highly damaging to tech innovation in the UK, is unfair to small and hobby sites, and is a cybersecurity and privacy nightmare. It should be repealed or amended to remove age verification requirements and further exempt small and hobby websites.

Excluding the strong age verification requirements, I do support more obligations being placed on big tech websites to prevent the harms outlined in the act. However, these obligations should only be on large companies with millions of users and not small websites. Too much of the Internet is becoming centralised onto a few large services, and the Online Safety Act only exacerbates this problem.