The Regulator Arrives
Ofcom's rolling implementation of the Online Safety Act — passed in October 2023 after years of parliamentary wrangling — is now well underway. Codes of practice are being published, platforms are submitting their risk assessments, and the regulator is beginning to flex powers that, when examined carefully, are among the most expansive ever granted to a non-departmental public body in British peacetime.
The Act requires platforms to take action against both illegal content and — critically — content that is legal but that Ofcom determines poses a risk of harm to users, particularly children. Failure to comply with Ofcom's codes carries fines of up to ten per cent of global annual turnover, or criminal liability for senior managers. These are not modest deterrents. They are existential threats for smaller platforms and serious commercial pressure even for the largest.
The political consensus that produced this legislation was, in many ways, understandable. The public appetite for action on online harms — driven by genuine and documented cases of children being exposed to self-harm content, grooming, and extremist material — was real and legitimate. No responsible politician wanted to be seen opposing child safety. The result was a bill that expanded steadily in scope throughout its parliamentary passage, accumulating powers that its original architects might not have intended, and which received far less scrutiny than its reach warranted.
Who Decides What Is Harmful?
The central constitutional problem with the Online Safety Act is not its stated goal but its architecture. The Act does not define 'harmful content' in any precise legislative sense. It delegates that definition — in practice — to Ofcom, which is empowered to produce codes of practice specifying what platforms must do to mitigate risks of harm. Parliament has handed a quango the authority to determine, on an ongoing and evolving basis, what speech is too dangerous to be permitted on British platforms.
This is not a theoretical concern. Ofcom's draft codes already extend well beyond the unambiguous cases — child sexual abuse material, terrorist recruitment, content encouraging self-harm in minors — into territory that is genuinely contested. The category of content that is 'harmful to adults' under the Act includes material relating to eating disorders, suicide methods, and content that 'encourages, promotes or provides instructions for' illegal activity. Each of these categories, depending on how they are interpreted and enforced, could sweep up legitimate journalism, medical information, political commentary, or historical documentation.
The strongest defence of the Act's approach is that Ofcom is an experienced, independent regulator with a track record of proportionate intervention, and that the codes it produces are subject to consultation and parliamentary scrutiny before they take effect. This is true, as far as it goes. But it understates the structural problem. Regulatory creep is not hypothetical — it is the default behaviour of regulatory bodies operating in politically charged environments. Today's proportionate code becomes tomorrow's baseline from which further expansion is measured.
The International Evidence Is Not Reassuring
Britain is not the first liberal democracy to travel this road, and the experience of those who have gone further is instructive.
Australia's Online Safety Act, introduced in 2021, has been used by the eSafety Commissioner to issue removal notices against content that included — in a high-profile 2024 case — footage of a violent attack on a bishop in Sydney. The Commissioner sought to have the footage removed globally, not merely from Australian platforms, asserting a jurisdictional reach that prompted a legal battle with X (formerly Twitter) and raised serious questions about the limits of national regulators in a borderless internet. The courts ultimately constrained the Commissioner's position, but the episode illustrated precisely how safety frameworks, once established, tend toward expansive application.
The European Union's Digital Services Act, which operates on comparable principles, has already been used to pressure platforms over content relating to migration, public health policy, and election integrity — categories where the line between 'harmful misinformation' and legitimate political dissent is, to put it charitably, contested. Meta's decision in early 2025 to roll back its third-party fact-checking programme in the United States was driven in part by concerns about exactly this dynamic.
Photo: European Union, via static2.bigstockphoto.com
The lesson from both jurisdictions is consistent: give a regulator the power to define harm, and the definition will expand to meet the regulator's institutional interests and the political pressures of the moment.
The Conservative Principle at Stake
Conservatives have a particular obligation to be clear-eyed about this. The temptation on the right to support online safety regulation is understandable — much of the content that activists and regulators wish to suppress is genuinely objectionable, and there is a coherent conservative case for protecting children from material that no reasonable person would defend.
But conservatism, properly understood, is not merely about agreeing with the immediate application of a power. It is about asking what happens when that power is held by people who do not share your values. The Online Safety Act as currently constructed is a censorship engine. Under a future government — or under a Ofcom board with different instincts — it could be used to suppress conservative voices discussing immigration, to remove content critical of gender ideology, or to penalise platforms that host commentary deemed harmful to undefined 'democratic processes.'
The correct conservative position is not to oppose child protection. It is to insist on a narrowly drawn, legislatively specific child safety law — one that targets illegal content, age verification for adult material, and algorithmic amplification of genuinely dangerous material to minors — whilst stripping out the vague 'legal but harmful' framework that hands Ofcom a roving commission to police British public discourse.
What Parliament Should Do
The Online Safety Act is now law, and unwinding it entirely is not a realistic near-term proposition. But Parliament retains the power to legislate again, to constrain Ofcom's codes through statutory instruments, and to demand that any expansion of the Act's scope returns to the floor of the Commons for primary legislation rather than being handled by regulatory fiat.
The Conservative opposition has an opportunity here that it has been slow to seize: to articulate a principled distinction between child protection — which commands universal support — and speech regulation — which commands no such mandate. That distinction, made clearly and consistently, is both politically potent and constitutionally correct.
Britain does not need a Ministry of Truth. It needs a narrowly targeted, legally precise framework that protects children without empowering bureaucrats to determine the boundaries of permissible thought.
When Parliament delegates the definition of harm to a quango, it has not protected the public — it has abdicated its own responsibility.
