10th August 2022

Long read by Julian Ward and Elaahe Farsimadan

With the Online Safety Bill set to be debated amongst MPs in Parliament, gaming companies should have a keen interest over its development as the likely approval of this Bill will impose additional obligations and duties on them and other online platforms.

What is the purpose of the Bill?

Essentially, the Bill will provide greater power to Ofcom (the UK’s regulatory body for the broadcasting, telecommunications and postal industries), to impose statutory duties of care to online platforms to keep their users (particularly children) safe online.

These platforms will be required to protect users from the following content:

• Illegal content;
• Content that is harmful to children;
• Content that is legal but harmful to adults – this may include content relating to gambling or alcohol.

While it may look as if the Bill is focused on tackling the large online platforms such as Google, Facebook and Twitter, it is also likely to catch game platforms, publishers and distributors.

Click here to read the current version of the Bill (as of 28 June 2022).

Progression of the Bill

The Public Bill Committee recently completed its line-by-line examination of the Bill. The Committee reported the Bill to the House of Commons with amendments for the Report stage. During this stage, the amended Bill can be debated amongst MPs to consider further amendments.  The Bill was due to be discussed in Parliament this month but will now be paused until MPs return from their summer break.

In terms of the Bill’s progression to becoming law, the Bill still needs to be read and examined by the House of Lords and obtain Royal Assent. It is thought that the Bill could become law as soon as 2023, however its progression has been delayed until a new Prime Minister is put in place.

Click here to view the Bill’s passage through the different stages.

Who will be affected by the Bill?

The Bill will apply to ”regulated services” whose services host user-generated content such as images, videos and comments (e.g. Facebook), or which allow users to communicate with other people online through messaging, comments and forums, as well targeting search engines (e.g. Google) with links to the UK.

This will include the biggest and most popular social media platforms such as Facebook and Twitter as well as some online games.

What are ”regulated services”?

According to Part 2 of the draft Bill, ”regulated services” means online user-to-user services or search services where such services have links to the UK.

Schedule 1 of the draft Bill provides a number of services which are exempt from being caught by the Bill. These include:

1. Services which involve one-to-one aural communications; and

2. Services which possess limited functionality, where users are only able to communicate in the following ways:

a) Posting comments or reviews relating to the provider’s content;
b) Sharing such comments or reviews on a different internet service;
c) Expressing a view on such comments or reviews, or on a provider’s content, by means of —

i. applying a “like” or “dislike” button or other button of that nature;
ii. applying an emoji or symbol of any kind;
iii. engaging in yes/no voting; or
iv. rating or scoring the content (or the comments or reviews) in any way (including giving star or numerical ratings).

With the popularity of massively multiplayer online video games (MMOs), and developers’ and publishers’ focus on creating online communities for their games, it is likely that many game platforms, developers, publishers and distributors will fall under the definition of ”regulated service” and in particular, online ”user-to-user services” without the prescribed exemptions applying.

What does it mean to have ”links to the UK”?

In order to have links with the UK, it is immaterial for the company to be based in the UK.

According to Part 2 of the draft Bill, a user-to-user service or a search service “has links with the UK” if —

a) The service has a significant number of UK users;
b) UK users form one of the target markets for the service (or the only target market);
c) The service is capable of being used in the UK by individuals; or
d) There are reasonable grounds to believe that there is a material risk of significant harm to individuals in the UK.

Duties of all online user-to-user service providers

As it is likely that many games companies will fall under the definition of online user-to-user services, such companies will be required to comply with the following duties found in Part 3, Chapter 2 of the draft Bill:

1. Carry out a suitable and sufficient illegal content risk assessment of the service, and keep it up-to-date;
2. Take or use proportionate measures to effectively mitigate and manage the risks of harm to individuals identified in the most recent illegal content risk assessment of the service;
3. Use proportionate systems and processes to prevent users from encountering illegal content, minimise the length of time the illegal content is online, and where the service provider has been alerted to such illegal content, to swiftly take it down.
4. Use systems and processes that allow users to easily report content which they consider to be illegal and harmful;
5. Operate a transparent, easy to access and easy to use (including by children) complaints procedure which the service provider can take appropriate action;
6. Have regard to the importance of protecting users’ right to freedom of expression while also protecting users from breaches of their privacy;
7. Keep a written record (in an easily understandable form) of every risk assessment carried out;
8. Include provisions in the service provider’s Terms of Service specifying how users are to be protected from illegal content; and
9.  Ensure that all detected and unreported UK-linked child sexual exploitation and abuse content present on the service is reported to the National Crime Agency.

Duties of online user-to-user service providers likely to be accessed by children

As children are easily able to access a wide variety of online games (regardless of age classification), additional child safety measures will have to be implemented by games companies.

According to Part 3, Chapter 2 of the draft Bill, user-to-user service providers likely to be accessed by children are required to:

1. Comply with all of the duties and obligations outlined in the heading above (”Duties of all online user-to-user service providers”);
2. Carry out a suitable and sufficient children’s risk assessment, and keep it up-to-date;
3. Take proportionate measures to effectively mitigate and manage the risks of harm to children as identified in the most recent children’s risk assessment present on the service;
4. Use proportionate systems and processes designed to prevent and protect children from encountering harmful content;
5. Specify in its Terms of Service how children are prevented from encountering harmful content;
6. Apply the provisions of its Terms of Service in relation to point (5) consistently;
7. Include provisions in its Terms of Service relating to any information or technology the service provider is using in order to be compliant with points (3) and (4); and
8. Ensure that the provisions of its Terms of Service in connection with points (5) and (7) are clear and accessible.

The draft Bill states that a provider can only conclude that it is not possible for children to access their service (or part of it), if there are systems or processes in place (for example, age verification, or another means of age assurance) which ensures that children are not normally able to access the service (or part of it).

What are ”Category 1” services?

The draft Bill imposes additional duties on service providers which fall under the ”Category 1” threshold e.g., conducting adult risk assessments, protecting journalistic/democratically important content etc.

Part 4, Chapter 1 of the draft Bill states that a provider of a ”Category 1” service must offer all adult users the option to verify their identity (if not already required in order to access the ”Category 1” service). The verification process may be of any kind, and does not require documentation. A provider of a ”Category 1” service must include clear and accessible provisions in their Terms of Service explaining how the verification process works.

Platforms falling under the definition of ”Category 1” include services with the largest audiences and a range of high risk features. This will most likely apply to social media platforms such as Facebook, Twitter, Instagram and now recently TikTok.

As a result, it is unlikely that games companies will be caught under this interpretation.

Consequences of non-compliance

Schedule 13 of the Bill states that if a non-compliant company is penalised by Ofcom, that company may be liable the greater of:

1.  £18 million, or
2. 10% of its annual worldwide revenue.

Ofcom may also pursue criminal action against senior members of companies who fail to adhere to the Bill.

Action points for companies within the games industry

While there may be a grace period before the Online Safety Bill is enforced in 2023 (as expected), it is imperative that game developers, publishers, distributors and platforms start thinking about the impact of the Bill now.

Games companies should be looking into the following action points:

1. Establish whether your service falls under the scope of ”regulated services”;
2. Establish whether any of the prescribed exemptions apply to your service;
3. Confirm whether your service has a link with the UK;
4. Conduct an online safety risk assessment of your service in order to effectively tackle illegal and harmful content;
5. Review the Home Office’s Interim Code of Practice on Online Child Sexual Exploitation and Abuse;
6. Set up a user reporting functionality within your service; and
7. Review the accessibility and transparency of your complaints procedure.

If you have any questions or would like to discuss any of the issues raised in this article (addressing, in particular, the practical measures you may wish to implement to ensure compliance), please contact Julian Ward (Partner and Head of the Games Team at Lee & Thompson). Click here to find out more about our experience in the gaming sector.

This article was written by Julian Ward (Partner and Head of the Games Team) and Elaahe Farsimadan (Paralegal in the Games Team)