The lay of the land

The UK’s Online Safety Act 2023 (OSA), enacted in late 2023, brought all game studios which operate multiplayer or social games, friends functionalities, online chat forums or any other form of user-to-user services into regulatory crosshairs. Its aim is to protect all online users, including video game players, from exposure to user generated illegal and harmful online content.

The OSA is reflective of  the UK Government’s commitment  to make the internet a safer place for all users, with similar commitments coming from Europe and made clear in the EU’s Digital Services Act. With many video game companies now offering products and platforms which support the creation and dissemination of user-generated content (UGC), OSA compliance is set to be a topic of discussion for at least the near future. But how does the OSA impact the games industry in practice?

Compliance burdens

The OSA imposes a number of compliance requirements which will be regulated, investigated and enforced by Ofcom, the regulator for online safety.

• Risk assessments: In-scope game studios will need to carry out regular OSA risk assessments to identify the illegal harms which may arise in the context of their games – for example, whether chat rooms could support dissemination of hateful content, or if any illegal in-game behaviour might encourage real-world illegal harms. 
• Child risk assessments: Additional – and  more rigorous – risk assessments will be required wherever children are a likely game audience. Specific guidance from Ofcom on best practice is expected this Spring. 
• Content moderation: All in-scope platforms must actively monitor and remove illegal content, which may include human, manual or automated content moderation tools. 
• In-game reporting systems & complaints procedures: Players must be able to easily report illegal and harmful content within games, with straightforward complaint procedures.  
• Updated Terms of Service: games’ EULAs and Terms of Service must specify how users are protected from illegal content, explain relevant complaint handling policies and new breach of contract rights for users. Where relevant, Terms of Service will also need to clarify how children are prevented from coming across illegal or harmful content, including in respect of any proactive technology used to do so.
• Reporting and record-keeping: operators of online games must keep records of risk assessments and outcomes and report findings to Ofcom. 

Ofcom’s powers

Ofcom will have the power to impose fines of up to £18m or 10% of annual global revenue on offending companies, as well as to conduct investigations, implement business disruption measures and to bring criminal proceedings against senior managers and directors. 

Vulnerabilities & key compliance challenges

While single player, offline games will not be caught by the OSA, most game studios are now developing and publishing games which feature an online or user-to-user element, ranging from web-driven live text, voice chat or livestreaming functionalities to being set in virtual reality and metaverse environments. 

With recent research showing that online gaming is being accessed by an ever-younger audience, the OSA’s focus on the safety of children in the online environment is likely to be a key challenge for online games providers with offerings likely to be played by a younger audience. Effective content moderation systems, child-appropriate complaint handling procedures and stringent age verification tools are all functionalities which game companies should be thinking about. 

Indeed, Ofcom has recently published its draft Children’s Safety Code which sets out practical steps to be adopted by all platforms which fall within the scope of the OSA to ensure that children do not encounter harmful content. The draft Children’s Code includes stronger age verification processes and the requirement for content filters. The code is open for consultation until 17 July 2024.

What can I do now?

The provisions of the OSA will be phased in to force and will begin to come into effect at the end of 2024. Full compliance with the OSA will not be required until late 2025, but online games companies should be aware of upcoming phased compliance deadlines and should look out for Ofcom’s upcoming guidance on child protection.

In the meantime, online games companies which fall into the OSA’s remit can prepare for compliance now by updating their Terms of Service and EULAs, and by considering how they plan to mitigate the online safety vulnerabilities inherent in their games. 

Key Dates