Policy paper

Guidance to the regulator about fees relating to the Online Safety Act 2023

Published 24 May 2024

Presented to Parliament pursuant to Section 87 of the Online Safety Act 2023

Introduction

Background

Department for Science, Innovation and Technology (DSIT), the Online Safety Act 2023, and the regulator

The UK is leading the way in online safety, delivering comprehensive, forward-looking legislation via the Online Safety Act 2023 (the Act)^{[footnote 1]}. Since its establishment in February 2023, DSIT has prioritised keeping British people, especially children, safe online. The Department also recognises the need to make our economy the most innovative in the world and has invested in research and development to achieve this. It is the government’s aim to attract technology businesses to the UK so they can grow and develop here, and one of DSIT’s goals is to deliver world-class physical and digital infrastructure.

The Act brings in new laws to protect users and tackle criminal activity online. The Act tackles criminal activity online by placing legal duties on regulated providers of user-to-user services to take proportionate measures relating to the design or operation of the service to prevent individuals encountering priority illegal content, such as content relating to terrorism and intimate image abuse, and rapidly remove illegal content when they become aware of it. The Act also requires search services to minimise the risk of individuals encountering illegal content in search results. The strongest protections in the Act are for children. Regulated providers of user-to-user services that are likely to be accessed by children will have to take proportionate measures relating to the design operation of the service to protect children from seeing content that is harmful to them, such as bullying, content which encourages, promotes or provides instructions for suicide, self-harm and eating disorders, and pornography. The Act also requires search services that are likely to be accessed by children to minimise the risk of children encountering content that is harmful to them in search results.

The government has appointed Ofcom as the independent regulator for online safety. Ofcom has been given powers to deliver a robust regulatory framework to make regulated services safer for users. Ofcom is now developing guidance and codes of practice to set out how regulated services can meet their duties under the Act and has published its approach to implementing the Act^{[footnote 2]}.

Funding Ofcom’s online safety functions

Companies raising revenue from online services should cover the costs of regulation to keep the online environment safe for users. Therefore, industry fees will fund the costs of regulation making the regulatory regime cost neutral to the exchequer. Section 88(2)(a) of the Act stipulates that Ofcom’s Statement of Charging Principles (SOCP) must be likely to secure that the aggregate amount of the fees payable to Ofcom should be sufficient to meet, but not exceed, the annual cost to Ofcom of the exercise of their online safety functions.

Regulated services at or above a revenue threshold based on qualifying worldwide revenue (QWR), which will be set by the Secretary of State, will be required to notify Ofcom with relevant information and pay an annual fee, unless they are exempt (section 83 – 86 of the Act). Companies below the threshold will not be required to notify the regulator or pay a fee but will still be required to comply with their duties under the Act.

The government is mindful of the burden fees may put on businesses, both in terms of the financial and administrative costs. It is in the interest of industry, Ofcom and the government that Ofcom’s approach to charging fees is robust and fit for purpose and that it covers the reasonable costs of operating a regulatory regime to make the UK the safest place to be online. The government will have oversight of regulatory costs through setting Ofcom’s total budget cap.

The government and Ofcom are working to establish the fee regime under section 84 of the Act to enable Ofcom to charge fees, which is expected to be in place by 2026/27. Until then, the government is funding Ofcom’s initial costs. Additional fees will then be charged over an initial set period of consecutive years to recoup the online safety regime’s set up costs.

The online safety fees process

Before Ofcom can charge fees, there are a number of implementation steps that need to take place, set out below. Under the Act, both Ofcom and the Secretary of State for DSIT are responsible for implementing the fee regime.

Figure 1: Timeline of milestones

Figure 1: Timeline of milestones.

The first step is for the Secretary of State to issue guidance to Ofcom about the principles to be included in Ofcom’s SOCP. This document constitutes that guidance under section 87(1) of the Act. Ofcom will then carry out a public consultation on fees in Summer 2024 to inform regulations about QWR under section 85(1) of the Act, as well as informing advice on the threshold under section 85(7) of the Act. Regulated services and other stakeholders will have the opportunity to feed in their views into the consultation at this time. Using the information gained through the consultation, Ofcom will make regulations setting out how QWR is to be determined and if considered necessary, any exemptions to paying fees, as well as setting requirements for the way that notification is to be made by regulated providers and the information they must supply.

The Secretary of State for DSIT will then determine the QWR threshold figure in separate regulations, having taken advice from Ofcom following their consultation (section 86(1)). Once the threshold figure regulations come into force, the period for providers to notify Ofcom of revenue information will begin (see section 83(5)(a)). Ofcom intend to publish the SOCP at this time, which will set out the principles they propose to apply in determining fees payable.

Ofcom expect to invoice regulated service providers for fees from financial year 2026/27.

Basis for the Secretary of State’s fee guidance

The Act requires the Secretary of State to issue guidance to Ofcom about the principles to be included in the SOCP that Ofcom propose to apply in determining fees payable (section 87(1) of the Act). See Annex A for reference to the Act. Ofcom must have regard to this guidance when designing the SOCP, as well as when exercising any other functions in connection with part 6 of the Act.

Ofcom have been consulted on this guidance in accordance with section 87(2).

The Secretary of State’s guidance about charging principles

The government has identified three overarching principles that Ofcom should have regard to when developing principles to be included in the SOCP and carrying out other functions in connection to part 6 of the Act. The government recognises that when considering these principles in practice and taking account of detailed information about regulated providers, Ofcom will need to determine the appropriate balance between them. The principles are: 

• Proportionality - fees must be applied in a proportionate way to the range of regulated providers, considering revenue and any other relevant factors, as well as recognising the potential burden on providers
• Transparency - it should be clear to firms what fees they are paying and why they are paying them
• Stability – the principles used to set fees should be clear and consistent so that industry is able to understand how fees will be calculated so they are able to incorporate this into long term plans

Proportionality principle

The government expects Ofcom to put proportionality at the heart of its charging principles, to ensure the fee regime is fair and manageable for the range of different regulated providers in scope of the Act. The range of services and levels of qualifying worldwide revenue will need to be considered. Proportionality can be delivered in a number of ways.

The Act sets out that Ofcom may use other factors in addition to revenue when setting fees (section 84(2)(a)(ii) of the Act). Following this guidance, in Ofcom’s consultation, Ofcom may consult on the basis of additional factors, for example the number of services in scope, the revenue spread and variety of functions across regulated providers, market presence and any other relevant factors relating to providers. Should other factors be used in the computation model after acquiring such information, Ofcom should ensure any additional factors are used in ways that are justifiable and proportionate to providers.

The proportionality principle is important to the government’s overall intention to limit the impact on small and medium enterprises (SMEs) of online safety regulation. This aligns with DSIT’s priority of making the UK the best place to start and grow a technology business. Innovation should not be stifled by high fees but instead, be encouraged to grow and develop to change lives in the UK and sustain economic growth. The government intends on setting a revenue threshold that is high enough to limit the impact on SMEs. The threshold will be defined and set by the Secretary of State via regulations, informed by advice given to the Secretary of State by Ofcom.

Transparency principle

Under the Act, the SOCP must make the relationship between the cost of Ofcom exercising its regulatory functions and the amount of the fees it is charging transparent (section 88(2)(c) of the Act). The government recognises that this transparency is integral to the overall success of the regulatory regime, promoting a positive relationship between the regulator and industry. Therefore, the government recommends that Ofcom includes relevant charging information in the SOCP, to enhance transparency and help ensure the smooth implementation of the fee regime.

Stability principle

The government recognises that for the online safety fee regime to be fit for purpose, regulated service providers need to be able to incorporate fee paying into their long-term plans. Therefore, the principles in the SOCP should enable Ofcom to set fee rates on a consistent basis year on year. The government believes that this will provide reassurance and stability for businesses, allowing our tech sector to continue to grow. Whilst the government realises that costs may vary and fluctuations in fees may occur due to the dynamic nature of the sector, this guidance asks Ofcom to ensure that the principles used to set fees are clear and consistent. In addition, the SOCP should explain how services will be informed of how much they will be charged, to support compliance with this principle.

The government recognises that there will be an initial period of consecutive charging years in which additional fees are charged to industry to recoup set-up costs incurred. These additional fees will be defined via secondary legislation and will come into effect from financial year 2027/28.

Annex A: Online Safety Act 2003, section 87: Secretary of State’s guidance about fees 

1) The Secretary of State must issue guidance to Ofcom about the principles to be included in a statement of principles that Ofcom propose to apply in determining fees payable under section 84 (see section 88).

2) The Secretary of State must consult Ofcom before issuing, revising, or replacing the guidance. 

3) The guidance may not be revised or replaced more frequently than once every three years unless — 

(a) the guidance needs to be corrected because of an amendment, repeal, or modification of any provision of this Part, or 

(b) the revision or replacement is by agreement between the Secretary of State and Ofcom. 

4) The Secretary of State must lay the guidance (including revised or replacement guidance) before Parliament. 

5) The Secretary of State must publish the guidance (and any revised or replacement guidance). 

6) In exercising any functions under this Part, Ofcom must have regard to the guidance for the time being published under this section.

1. The Online Safety Act 2023 https://www.legislation.gov.uk/ukpga/2023/50/enacted ↩

2. Ofcom’s approach to implementing the Online Safety Act https://www.ofcom.org.uk/online-safety/information-for-industry/roadmap-to-regulation ↩